Relax and test aliasing rules
This is consistent with the general rules documented at the top of the
file:
- when computing GCD(A, N), there is no modular arithmetic, so the
output can alias any of the inputs;
- when computing a modular inverse, N is the modulus, so it can't be
aliased by any of the outputs (we'll use it for modular operations
over the entire course of the function's execution).
But since this function has two modes of operations with different
aliasing rules (G can alias N only if I == NULL), I think it should
really be stated explicitly.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
diff --git a/library/bignum_core.c b/library/bignum_core.c
index 1e80a5b..e020da1 100644
--- a/library/bignum_core.c
+++ b/library/bignum_core.c
@@ -1094,11 +1094,19 @@
* Initial values:
* u, v = A, N
* q, r = 0, 1
+ *
+ * We only write to G (aka v) after reading from inputs (A and N), which
+ * allows aliasing, except with N when I != NULL, as then we'll be operating
+ * mod N on q and r later - see the public documentation.
+ *
+ * Also avoid possible UB with memcpy when src == dst.
*/
memcpy(u, A, A_limbs * ciL);
memset((char *) u + A_limbs * ciL, 0, (N_limbs - A_limbs) * ciL);
- memcpy(v, N, N_limbs * ciL);
+ if (v != N) {
+ memcpy(v, N, N_limbs * ciL);
+ }
if (I != NULL) {
memset(q, 0, N_limbs * ciL);