commit 91070e43a6f33e6ce99f2d5779918f7d6b259dd6
author Gilles Peskine <Gilles.Peskine@arm.com> Thu Jul 23 01:16:46 2020 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> Wed Sep 30 00:22:37 2020 +0200
tree abc88ac20a94b0a4e190faa7e378f8d2f049d4d7
parent e7876341af8812c6d6571fe88bc8595e8591ce77

Fix memory leak in mbedtls_mpi_sub_abs

Fix a memory leak in mbedtls_mpi_sub_abs when the output parameter is
aliased to the second operand (X = A - X) and the result is negative.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

library/bignum.c

diff --git a/library/bignum.c b/library/bignum.c
index 0e39e3a..c4eb7b0 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -1201,7 +1201,10 @@
         /* If we ran out of space for the carry, it means that the result
          * is negative. */
         if( n == X->n )
-            return( MBEDTLS_ERR_MPI_NEGATIVE_VALUE );
+        {
+            ret = MBEDTLS_ERR_MPI_NEGATIVE_VALUE;
+            goto cleanup;
+        }
         --X->p[n];
     }