Reporting bug in mpi_ec_mul_point()

Hi all,

I'm reporting the following bug detected by Coverity:

The _scalar_copied_ variable is set to 0 at

lib/mpi/ec.c:1255:
1255 int scalar_copied = 0;

and it is never updated before reaching the code below:

lib/mpi/ec.c:1317
1317 if (scalar_copied)
1318 mpi_free(scalar);

This code was introduced by commit d58bb7e55a8a ("lib/mpi: Introduce ec implementation to MPI library")

Any ideas on what's the right solution for this?

Thanks
--
Gustavo

I think it should be removed.

---8<---
The scalar_copied variable is not as the scalar is never copied in that block. This patch removes it.

index c21470122dfc..40f5908e57a4 100644
@@ -1252,7 +1252,6 @@ void mpi_ec_mul_point(MPI_POINT result,
 		MPI_POINT q1, q2, prd, sum;
 		unsigned long sw;
 		mpi_size_t rsize;
-		int scalar_copied = 0;
 
 		/* Compute scalar point multiplication with Montgomery Ladder.
 		 * Note that we don't use Y-coordinate in the points at all.

@@ -1314,8 +1313,6 @@ void mpi_ec_mul_point(MPI_POINT result,
 		point_free(&p2);
 		point_free(&p1_);
 		point_free(&p2_);
-		if (scalar_copied)
-			mpi_free(scalar);
 		return;
 	}
 

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt