Avoid undefined behavior adding or subtracting two BN_zero() values

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 14:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31916)

diff --git a/crypto/bn/bn_add.c b/crypto/bn/bn_add.c
index 88d77c534f0cb4b3075d14e107f92de090a815b8..24151d0e13d8ffe14882d875a449b26f0d6d8fc3 100644 (file)
--- a/crypto/bn/bn_add.c
+++ b/crypto/bn/bn_add.c
@@ -97,6 +97,8 @@ int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         return 0;
 
     r->top = max;
+    if (max == 0)
+        goto end;
 
     ap = a->d;
     bp = b->d;
@@ -116,6 +118,7 @@ int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
     *rp = carry;
     r->top += (int)carry;
 
+end:
     r->neg = 0;
     bn_check_top(r);
     return 1;
@@ -143,6 +146,9 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
     if (bn_wexpand(r, max) == NULL)
         return 0;
 
+    if (max == 0)
+        goto end;
+
     ap = a->d;
     bp = b->d;
     rp = r->d;
@@ -162,6 +168,7 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
     while (max && *--rp == 0)
         max--;
 
+end:
     r->top = max;
     r->neg = 0;
     bn_pollute(r);