tree cd29bdb1d97d688eaeba58f8fdf0329f26733ba1
parent 349b37273ee1337f9b0b3d622c0e27932580cfdd
author Gilles Peskine <Gilles.Peskine@arm.com> 1617474103 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1617491441 +0200

Fix low-probability arithmetic error in ECC

Fix the subtraction in fix_negative, which was incorrectly not looking
for a carry. This caused the result to be wrong when the least
significant limb of N was 0. Fix #4296.

The bug was introduced by d10e8fae9e30cac60297b1e1834002db183429e5
"Optimize fix_negative". Thanks to Philippe Antoine (catenacyber) for
reporting the bug which was found by his EC differential fuzzer.
Credit to OSS-Fuzz.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>