Skip to content
Browse files
bn/asm/ fix carry bug in bn_sqrx8x_internal.
Credit to OSS-Fuzz for finding this.


Reviewed-by: Rich Salz <>
  • Loading branch information
dot-asm authored and mattcaswell committed Nov 2, 2017
1 parent 23f7e97 commit 38d600147331d36e74174ebbd4008b63188b321b
Showing with 10 additions and 2 deletions.
  1. +10 −2 crypto/bn/asm/
@@ -3090,11 +3090,19 @@
.align 32
sub 16+8(%rsp),%r8 # consume last carry
xor $zero,$zero
sub 16+8(%rsp),%rbx # mov 16(%rsp),%cf
adcx $zero,%r8
mov 24+8(%rsp),$carry # initial $tptr, borrow $carry
adcx $zero,%r9
mov 0*8($aptr),%rdx # a[8], modulo-scheduled
xor %ebp,%ebp # xor $zero,$zero
adc \$0,%r10
mov %r8,0*8($tptr)
adc \$0,%r11
adc \$0,%r12
adc \$0,%r13
adc \$0,%r14
adc \$0,%r15
cmp $carry,$tptr # cf=0, of=0
je .Lsqrx8x_outer_loop

0 comments on commit 38d6001

Please sign in to comment.