tree 6492a16273dec71d8139582acfb986574df0c8ca
parent be4b5dd8c13944bd8e683d4f0be5cda6c62f6c66
author Gilles Peskine <Gilles.Peskine@arm.com> 1617285438 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1622662770 +0200

Fix mbedtls_mpi_random when N has leading zeros

mbedtls_mpi_random() uses mbedtls_mpi_cmp_mpi_ct(), which requires its
two arguments to have the same storage size. This was not the case
when the upper bound passed to mbedtls_mpi_random() had leading zero
limbs.

Fix this by forcing the result MPI to the desired size. Since this is
not what mbedtls_mpi_fill_random() does, don't call it from
mbedtls_mpi_random(), but instead call a new auxiliary function.

Add tests to cover this and other conditions with varying sizes for
the two arguments.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>