Merge pull request #6492 from daverodgman/ecp_mul_mxz-timing-leak-2.28
Fix a timing leak in ecp_mul_mxz() - 2.28 backport
diff --git a/library/ecp.c b/library/ecp.c
index dc73638..abe7bcd 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -2594,7 +2594,7 @@
MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
/* Loop invariant: R = result so far, RP = R + P */
- i = mbedtls_mpi_bitlen( m ); /* one past the (zero-based) most significant bit */
+ i = grp->nbits + 1; /* one past the (zero-based) required msb for private keys */
while( i-- > 0 )
{
b = mbedtls_mpi_get_bit( m, i );