tree 72ea82a29931540207af7f6eb304fda4867fe485
parent 46bf7da684643ecaea16635dd3afd38cceeb4b16
author Gilles Peskine <Gilles.Peskine@arm.com> 1591646302 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1591695090 +0200

Move carry propagation out of mpi_sub_hlp

The function mpi_sub_hlp had confusing semantics: although it took a
size parameter, it accessed the limb array d beyond this size, to
propagate the carry. This made the function difficult to understand
and analyze, with a potential buffer overflow if misused (not enough
room to propagate the carry).

Change the function so that it only performs the subtraction within
the specified number of limbs, and returns the carry.

Move the carry propagation out of mpi_sub_hlp and into its caller
mbedtls_mpi_sub_abs. This makes the code of subtraction very slightly
less neat, but not significantly different.

In the one other place where mpi_sub_hlp is used, namely mpi_montmul,
this is a net win because the carry is potentially sensitive data and
the function carefully arranges to not have to propagate it.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>