uadk_engine: fixup a bug in rsa X931 padding mode

lizhi · JiangShui Yang · commit 914300d18da6 · 2025-12-18T14:38:31.000+08:00
Fix a null pointer dereference bug in RSA X931 mode.

Signed-off-by: lizhi &lt;lizhi206@huawei.com&gt;
Signed-off-by: JiangShui Yang &lt;yangjiangshui@h-partners.com&gt;
diff --git a/src/uadk_rsa.c b/src/uadk_rsa.c
@@ -656,11 +656,9 @@ static int rsa_get_sign_res(int padding, BIGNUM *to_bn, const BIGNUM *n,
 
 static int rsa_get_verify_res(int padding, const BIGNUM *n, BIGNUM *ret_bn)
 {
-	BIGNUM *to_bn = NULL;
-
 	if ((padding == RSA_X931_PADDING) && ((bn_get_words(ret_bn)[0] & 0xf)
 	    != 0x0c)) {
-		if (!BN_sub(to_bn, n, ret_bn))
+		if (!BN_sub(ret_bn, n, ret_bn))
 			return UADK_E_FAIL;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -656,11 +656,9 @@ static int rsa_get_sign_res(int padding, BIGNUM to_bn, const BIGNUM n,`
`656`	`656`
`657`	`657`	`static int rsa_get_verify_res(int padding, const BIGNUM n, BIGNUM ret_bn)`
`658`	`658`	`{`
`659`		`- BIGNUM *to_bn = NULL;`
`660`		`-`
`661`	`659`	`if ((padding == RSA_X931_PADDING) && ((bn_get_words(ret_bn)[0] & 0xf)`
`662`	`660`	`!= 0x0c)) {`
`663`		`- if (!BN_sub(to_bn, n, ret_bn))`
	`661`	`+ if (!BN_sub(ret_bn, n, ret_bn))`
`664`	`662`	`return UADK_E_FAIL;`
`665`	`663`	`}`
`666`	`664`