Restoring authorship annotation for <deshevoy@yandex-team.ru>. Commit 1 of 2.

1 files changed, 957 insertions, 957 deletions

diff --git a/contrib/libs/openssl/crypto/rsa/rsa_ossl.c b/contrib/libs/openssl/crypto/rsa/rsa_ossl.c
index b52a66f6a6..e232fa3626 100644
--- a/contrib/libs/openssl/crypto/rsa/rsa_ossl.c
+++ b/contrib/libs/openssl/crypto/rsa/rsa_ossl.c
@@ -1,976 +1,976 @@
-/*
+/* 
  * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include "internal/cryptlib.h"
+ * 
+ * Licensed under the OpenSSL license (the "License").  You may not use 
+ * this file except in compliance with the License.  You can obtain a copy 
+ * in the file LICENSE in the source distribution or at 
+ * https://www.openssl.org/source/license.html 
+ */ 
+ 
+#include "internal/cryptlib.h" 
 #include "crypto/bn.h"
 #include "rsa_local.h"
 #include "internal/constant_time.h"
-
-static int rsa_ossl_public_encrypt(int flen, const unsigned char *from,
-                                  unsigned char *to, RSA *rsa, int padding);
-static int rsa_ossl_private_encrypt(int flen, const unsigned char *from,
-                                   unsigned char *to, RSA *rsa, int padding);
-static int rsa_ossl_public_decrypt(int flen, const unsigned char *from,
-                                  unsigned char *to, RSA *rsa, int padding);
-static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,
-                                   unsigned char *to, RSA *rsa, int padding);
-static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa,
-                           BN_CTX *ctx);
-static int rsa_ossl_init(RSA *rsa);
-static int rsa_ossl_finish(RSA *rsa);
-static RSA_METHOD rsa_pkcs1_ossl_meth = {
-    "OpenSSL PKCS#1 RSA",
-    rsa_ossl_public_encrypt,
-    rsa_ossl_public_decrypt,     /* signature verification */
-    rsa_ossl_private_encrypt,    /* signing */
-    rsa_ossl_private_decrypt,
-    rsa_ossl_mod_exp,
-    BN_mod_exp_mont,            /* XXX probably we should not use Montgomery
-                                 * if e == 3 */
-    rsa_ossl_init,
-    rsa_ossl_finish,
-    RSA_FLAG_FIPS_METHOD,       /* flags */
-    NULL,
-    0,                          /* rsa_sign */
-    0,                          /* rsa_verify */
-    NULL,                       /* rsa_keygen */
-    NULL                        /* rsa_multi_prime_keygen */
-};
-
-static const RSA_METHOD *default_RSA_meth = &rsa_pkcs1_ossl_meth;
-
-void RSA_set_default_method(const RSA_METHOD *meth)
-{
-    default_RSA_meth = meth;
-}
-
-const RSA_METHOD *RSA_get_default_method(void)
-{
-    return default_RSA_meth;
-}
-
-const RSA_METHOD *RSA_PKCS1_OpenSSL(void)
-{
-    return &rsa_pkcs1_ossl_meth;
-}
-
-const RSA_METHOD *RSA_null_method(void)
-{
-    return NULL;
-}
-
-static int rsa_ossl_public_encrypt(int flen, const unsigned char *from,
-                                  unsigned char *to, RSA *rsa, int padding)
-{
-    BIGNUM *f, *ret;
-    int i, num = 0, r = -1;
-    unsigned char *buf = NULL;
-    BN_CTX *ctx = NULL;
-
-    if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
-        return -1;
-    }
-
-    if (BN_ucmp(rsa->n, rsa->e) <= 0) {
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
-        return -1;
-    }
-
-    /* for large moduli, enforce exponent limit */
-    if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) {
-        if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {
-            RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
-            return -1;
-        }
-    }
-
-    if ((ctx = BN_CTX_new()) == NULL)
-        goto err;
-    BN_CTX_start(ctx);
-    f = BN_CTX_get(ctx);
-    ret = BN_CTX_get(ctx);
-    num = BN_num_bytes(rsa->n);
-    buf = OPENSSL_malloc(num);
-    if (ret == NULL || buf == NULL) {
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-
-    switch (padding) {
-    case RSA_PKCS1_PADDING:
-        i = RSA_padding_add_PKCS1_type_2(buf, num, from, flen);
-        break;
-    case RSA_PKCS1_OAEP_PADDING:
-        i = RSA_padding_add_PKCS1_OAEP(buf, num, from, flen, NULL, 0);
-        break;
-    case RSA_SSLV23_PADDING:
-        i = RSA_padding_add_SSLv23(buf, num, from, flen);
-        break;
-    case RSA_NO_PADDING:
-        i = RSA_padding_add_none(buf, num, from, flen);
-        break;
-    default:
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
-        goto err;
-    }
-    if (i <= 0)
-        goto err;
-
-    if (BN_bin2bn(buf, num, f) == NULL)
-        goto err;
-
-    if (BN_ucmp(f, rsa->n) >= 0) {
-        /* usually the padding functions would catch this */
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT,
-               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
-        goto err;
-    }
-
-    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
-        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
-                                    rsa->n, ctx))
-            goto err;
-
-    if (!rsa->meth->bn_mod_exp(ret, f, rsa->e, rsa->n, ctx,
-                               rsa->_method_mod_n))
-        goto err;
-
-    /*
-     * BN_bn2binpad puts in leading 0 bytes if the number is less than
-     * the length of the modulus.
-     */
-    r = BN_bn2binpad(ret, to, num);
- err:
+ 
+static int rsa_ossl_public_encrypt(int flen, const unsigned char *from, 
+                                  unsigned char *to, RSA *rsa, int padding); 
+static int rsa_ossl_private_encrypt(int flen, const unsigned char *from, 
+                                   unsigned char *to, RSA *rsa, int padding); 
+static int rsa_ossl_public_decrypt(int flen, const unsigned char *from, 
+                                  unsigned char *to, RSA *rsa, int padding); 
+static int rsa_ossl_private_decrypt(int flen, const unsigned char *from, 
+                                   unsigned char *to, RSA *rsa, int padding); 
+static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa, 
+                           BN_CTX *ctx); 
+static int rsa_ossl_init(RSA *rsa); 
+static int rsa_ossl_finish(RSA *rsa); 
+static RSA_METHOD rsa_pkcs1_ossl_meth = { 
+    "OpenSSL PKCS#1 RSA", 
+    rsa_ossl_public_encrypt, 
+    rsa_ossl_public_decrypt,     /* signature verification */ 
+    rsa_ossl_private_encrypt,    /* signing */ 
+    rsa_ossl_private_decrypt, 
+    rsa_ossl_mod_exp, 
+    BN_mod_exp_mont,            /* XXX probably we should not use Montgomery 
+                                 * if e == 3 */ 
+    rsa_ossl_init, 
+    rsa_ossl_finish, 
+    RSA_FLAG_FIPS_METHOD,       /* flags */ 
+    NULL, 
+    0,                          /* rsa_sign */ 
+    0,                          /* rsa_verify */ 
+    NULL,                       /* rsa_keygen */ 
+    NULL                        /* rsa_multi_prime_keygen */ 
+}; 
+ 
+static const RSA_METHOD *default_RSA_meth = &rsa_pkcs1_ossl_meth; 
+ 
+void RSA_set_default_method(const RSA_METHOD *meth) 
+{ 
+    default_RSA_meth = meth; 
+} 
+ 
+const RSA_METHOD *RSA_get_default_method(void) 
+{ 
+    return default_RSA_meth; 
+} 
+ 
+const RSA_METHOD *RSA_PKCS1_OpenSSL(void) 
+{ 
+    return &rsa_pkcs1_ossl_meth; 
+} 
+ 
+const RSA_METHOD *RSA_null_method(void) 
+{ 
+    return NULL; 
+} 
+ 
+static int rsa_ossl_public_encrypt(int flen, const unsigned char *from, 
+                                  unsigned char *to, RSA *rsa, int padding) 
+{ 
+    BIGNUM *f, *ret; 
+    int i, num = 0, r = -1; 
+    unsigned char *buf = NULL; 
+    BN_CTX *ctx = NULL; 
+ 
+    if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) { 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE); 
+        return -1; 
+    } 
+ 
+    if (BN_ucmp(rsa->n, rsa->e) <= 0) { 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE); 
+        return -1; 
+    } 
+ 
+    /* for large moduli, enforce exponent limit */ 
+    if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) { 
+        if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) { 
+            RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE); 
+            return -1; 
+        } 
+    } 
+ 
+    if ((ctx = BN_CTX_new()) == NULL) 
+        goto err; 
+    BN_CTX_start(ctx); 
+    f = BN_CTX_get(ctx); 
+    ret = BN_CTX_get(ctx); 
+    num = BN_num_bytes(rsa->n); 
+    buf = OPENSSL_malloc(num); 
+    if (ret == NULL || buf == NULL) { 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, ERR_R_MALLOC_FAILURE); 
+        goto err; 
+    } 
+ 
+    switch (padding) { 
+    case RSA_PKCS1_PADDING: 
+        i = RSA_padding_add_PKCS1_type_2(buf, num, from, flen); 
+        break; 
+    case RSA_PKCS1_OAEP_PADDING: 
+        i = RSA_padding_add_PKCS1_OAEP(buf, num, from, flen, NULL, 0); 
+        break; 
+    case RSA_SSLV23_PADDING: 
+        i = RSA_padding_add_SSLv23(buf, num, from, flen); 
+        break; 
+    case RSA_NO_PADDING: 
+        i = RSA_padding_add_none(buf, num, from, flen); 
+        break; 
+    default: 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE); 
+        goto err; 
+    } 
+    if (i <= 0) 
+        goto err; 
+ 
+    if (BN_bin2bn(buf, num, f) == NULL) 
+        goto err; 
+ 
+    if (BN_ucmp(f, rsa->n) >= 0) { 
+        /* usually the padding functions would catch this */ 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, 
+               RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 
+        goto err; 
+    } 
+ 
+    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) 
+        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock, 
+                                    rsa->n, ctx)) 
+            goto err; 
+ 
+    if (!rsa->meth->bn_mod_exp(ret, f, rsa->e, rsa->n, ctx, 
+                               rsa->_method_mod_n)) 
+        goto err; 
+ 
+    /* 
+     * BN_bn2binpad puts in leading 0 bytes if the number is less than 
+     * the length of the modulus. 
+     */ 
+    r = BN_bn2binpad(ret, to, num); 
+ err: 
     BN_CTX_end(ctx);
-    BN_CTX_free(ctx);
-    OPENSSL_clear_free(buf, num);
-    return r;
-}
-
-static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
-{
-    BN_BLINDING *ret;
-
-    CRYPTO_THREAD_write_lock(rsa->lock);
-
-    if (rsa->blinding == NULL) {
-        rsa->blinding = RSA_setup_blinding(rsa, ctx);
-    }
-
-    ret = rsa->blinding;
-    if (ret == NULL)
-        goto err;
-
-    if (BN_BLINDING_is_current_thread(ret)) {
-        /* rsa->blinding is ours! */
-
-        *local = 1;
-    } else {
-        /* resort to rsa->mt_blinding instead */
-
-        /*
-         * instructs rsa_blinding_convert(), rsa_blinding_invert() that the
-         * BN_BLINDING is shared, meaning that accesses require locks, and
-         * that the blinding factor must be stored outside the BN_BLINDING
-         */
-        *local = 0;
-
-        if (rsa->mt_blinding == NULL) {
-            rsa->mt_blinding = RSA_setup_blinding(rsa, ctx);
-        }
-        ret = rsa->mt_blinding;
-    }
-
- err:
-    CRYPTO_THREAD_unlock(rsa->lock);
-    return ret;
-}
-
-static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
-                                BN_CTX *ctx)
-{
-    if (unblind == NULL) {
-        /*
-         * Local blinding: store the unblinding factor in BN_BLINDING.
-         */
-        return BN_BLINDING_convert_ex(f, NULL, b, ctx);
-    } else {
-        /*
-         * Shared blinding: store the unblinding factor outside BN_BLINDING.
-         */
-        int ret;
-
-        BN_BLINDING_lock(b);
-        ret = BN_BLINDING_convert_ex(f, unblind, b, ctx);
-        BN_BLINDING_unlock(b);
-
-        return ret;
-    }
-}
-
-static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
-                               BN_CTX *ctx)
-{
-    /*
-     * For local blinding, unblind is set to NULL, and BN_BLINDING_invert_ex
-     * will use the unblinding factor stored in BN_BLINDING. If BN_BLINDING
-     * is shared between threads, unblind must be non-null:
-     * BN_BLINDING_invert_ex will then use the local unblinding factor, and
-     * will only read the modulus from BN_BLINDING. In both cases it's safe
-     * to access the blinding without a lock.
-     */
-    return BN_BLINDING_invert_ex(f, unblind, b, ctx);
-}
-
-/* signing */
-static int rsa_ossl_private_encrypt(int flen, const unsigned char *from,
-                                   unsigned char *to, RSA *rsa, int padding)
-{
-    BIGNUM *f, *ret, *res;
-    int i, num = 0, r = -1;
-    unsigned char *buf = NULL;
-    BN_CTX *ctx = NULL;
-    int local_blinding = 0;
-    /*
-     * Used only if the blinding structure is shared. A non-NULL unblind
-     * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
-     * the unblinding factor outside the blinding structure.
-     */
-    BIGNUM *unblind = NULL;
-    BN_BLINDING *blinding = NULL;
-
-    if ((ctx = BN_CTX_new()) == NULL)
-        goto err;
-    BN_CTX_start(ctx);
-    f = BN_CTX_get(ctx);
-    ret = BN_CTX_get(ctx);
-    num = BN_num_bytes(rsa->n);
-    buf = OPENSSL_malloc(num);
-    if (ret == NULL || buf == NULL) {
-        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-
-    switch (padding) {
-    case RSA_PKCS1_PADDING:
-        i = RSA_padding_add_PKCS1_type_1(buf, num, from, flen);
-        break;
-    case RSA_X931_PADDING:
-        i = RSA_padding_add_X931(buf, num, from, flen);
-        break;
-    case RSA_NO_PADDING:
-        i = RSA_padding_add_none(buf, num, from, flen);
-        break;
-    case RSA_SSLV23_PADDING:
-    default:
-        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
-        goto err;
-    }
-    if (i <= 0)
-        goto err;
-
-    if (BN_bin2bn(buf, num, f) == NULL)
-        goto err;
-
-    if (BN_ucmp(f, rsa->n) >= 0) {
-        /* usually the padding functions would catch this */
-        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT,
-               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
-        goto err;
-    }
-
-    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
-        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
-                                    rsa->n, ctx))
-            goto err;
-
-    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {
-        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
-        if (blinding == NULL) {
-            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);
-            goto err;
-        }
-    }
-
-    if (blinding != NULL) {
-        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {
-            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);
-            goto err;
-        }
-        if (!rsa_blinding_convert(blinding, f, unblind, ctx))
-            goto err;
-    }
-
-    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||
-        (rsa->version == RSA_ASN1_VERSION_MULTI) ||
-        ((rsa->p != NULL) &&
-         (rsa->q != NULL) &&
-         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {
-        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))
-            goto err;
-    } else {
-        BIGNUM *d = BN_new();
-        if (d == NULL) {
-            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);
-            goto err;
-        }
+    BN_CTX_free(ctx); 
+    OPENSSL_clear_free(buf, num); 
+    return r; 
+} 
+ 
+static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx) 
+{ 
+    BN_BLINDING *ret; 
+ 
+    CRYPTO_THREAD_write_lock(rsa->lock); 
+ 
+    if (rsa->blinding == NULL) { 
+        rsa->blinding = RSA_setup_blinding(rsa, ctx); 
+    } 
+ 
+    ret = rsa->blinding; 
+    if (ret == NULL) 
+        goto err; 
+ 
+    if (BN_BLINDING_is_current_thread(ret)) { 
+        /* rsa->blinding is ours! */ 
+ 
+        *local = 1; 
+    } else { 
+        /* resort to rsa->mt_blinding instead */ 
+ 
+        /* 
+         * instructs rsa_blinding_convert(), rsa_blinding_invert() that the 
+         * BN_BLINDING is shared, meaning that accesses require locks, and 
+         * that the blinding factor must be stored outside the BN_BLINDING 
+         */ 
+        *local = 0; 
+ 
+        if (rsa->mt_blinding == NULL) { 
+            rsa->mt_blinding = RSA_setup_blinding(rsa, ctx); 
+        } 
+        ret = rsa->mt_blinding; 
+    } 
+ 
+ err: 
+    CRYPTO_THREAD_unlock(rsa->lock); 
+    return ret; 
+} 
+ 
+static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind, 
+                                BN_CTX *ctx) 
+{ 
+    if (unblind == NULL) { 
+        /* 
+         * Local blinding: store the unblinding factor in BN_BLINDING. 
+         */ 
+        return BN_BLINDING_convert_ex(f, NULL, b, ctx); 
+    } else { 
+        /* 
+         * Shared blinding: store the unblinding factor outside BN_BLINDING. 
+         */ 
+        int ret; 
+ 
+        BN_BLINDING_lock(b); 
+        ret = BN_BLINDING_convert_ex(f, unblind, b, ctx); 
+        BN_BLINDING_unlock(b); 
+ 
+        return ret; 
+    } 
+} 
+ 
+static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind, 
+                               BN_CTX *ctx) 
+{ 
+    /* 
+     * For local blinding, unblind is set to NULL, and BN_BLINDING_invert_ex 
+     * will use the unblinding factor stored in BN_BLINDING. If BN_BLINDING 
+     * is shared between threads, unblind must be non-null: 
+     * BN_BLINDING_invert_ex will then use the local unblinding factor, and 
+     * will only read the modulus from BN_BLINDING. In both cases it's safe 
+     * to access the blinding without a lock. 
+     */ 
+    return BN_BLINDING_invert_ex(f, unblind, b, ctx); 
+} 
+ 
+/* signing */ 
+static int rsa_ossl_private_encrypt(int flen, const unsigned char *from, 
+                                   unsigned char *to, RSA *rsa, int padding) 
+{ 
+    BIGNUM *f, *ret, *res; 
+    int i, num = 0, r = -1; 
+    unsigned char *buf = NULL; 
+    BN_CTX *ctx = NULL; 
+    int local_blinding = 0; 
+    /* 
+     * Used only if the blinding structure is shared. A non-NULL unblind 
+     * instructs rsa_blinding_convert() and rsa_blinding_invert() to store 
+     * the unblinding factor outside the blinding structure. 
+     */ 
+    BIGNUM *unblind = NULL; 
+    BN_BLINDING *blinding = NULL; 
+ 
+    if ((ctx = BN_CTX_new()) == NULL) 
+        goto err; 
+    BN_CTX_start(ctx); 
+    f = BN_CTX_get(ctx); 
+    ret = BN_CTX_get(ctx); 
+    num = BN_num_bytes(rsa->n); 
+    buf = OPENSSL_malloc(num); 
+    if (ret == NULL || buf == NULL) { 
+        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE); 
+        goto err; 
+    } 
+ 
+    switch (padding) { 
+    case RSA_PKCS1_PADDING: 
+        i = RSA_padding_add_PKCS1_type_1(buf, num, from, flen); 
+        break; 
+    case RSA_X931_PADDING: 
+        i = RSA_padding_add_X931(buf, num, from, flen); 
+        break; 
+    case RSA_NO_PADDING: 
+        i = RSA_padding_add_none(buf, num, from, flen); 
+        break; 
+    case RSA_SSLV23_PADDING: 
+    default: 
+        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE); 
+        goto err; 
+    } 
+    if (i <= 0) 
+        goto err; 
+ 
+    if (BN_bin2bn(buf, num, f) == NULL) 
+        goto err; 
+ 
+    if (BN_ucmp(f, rsa->n) >= 0) { 
+        /* usually the padding functions would catch this */ 
+        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, 
+               RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 
+        goto err; 
+    } 
+ 
+    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) 
+        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock, 
+                                    rsa->n, ctx)) 
+            goto err; 
+ 
+    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) { 
+        blinding = rsa_get_blinding(rsa, &local_blinding, ctx); 
+        if (blinding == NULL) { 
+            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR); 
+            goto err; 
+        } 
+    } 
+ 
+    if (blinding != NULL) { 
+        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) { 
+            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE); 
+            goto err; 
+        } 
+        if (!rsa_blinding_convert(blinding, f, unblind, ctx)) 
+            goto err; 
+    } 
+ 
+    if ((rsa->flags & RSA_FLAG_EXT_PKEY) || 
+        (rsa->version == RSA_ASN1_VERSION_MULTI) || 
+        ((rsa->p != NULL) && 
+         (rsa->q != NULL) && 
+         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) { 
+        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) 
+            goto err; 
+    } else { 
+        BIGNUM *d = BN_new(); 
+        if (d == NULL) { 
+            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE); 
+            goto err; 
+        } 
         if (rsa->d == NULL) {
             RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, RSA_R_MISSING_PRIVATE_KEY);
             BN_free(d);
             goto err;
         }
-        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
-
-        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,
-                                   rsa->_method_mod_n)) {
-            BN_free(d);
-            goto err;
-        }
-        /* We MUST free d before any further use of rsa->d */
-        BN_free(d);
-    }
-
-    if (blinding)
-        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
-            goto err;
-
-    if (padding == RSA_X931_PADDING) {
-        if (!BN_sub(f, rsa->n, ret))
-            goto err;
-        if (BN_cmp(ret, f) > 0)
-            res = f;
-        else
-            res = ret;
-    } else {
-        res = ret;
-    }
-
-    /*
-     * BN_bn2binpad puts in leading 0 bytes if the number is less than
-     * the length of the modulus.
-     */
-    r = BN_bn2binpad(res, to, num);
- err:
+        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME); 
+ 
+        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx, 
+                                   rsa->_method_mod_n)) { 
+            BN_free(d); 
+            goto err; 
+        } 
+        /* We MUST free d before any further use of rsa->d */ 
+        BN_free(d); 
+    } 
+ 
+    if (blinding) 
+        if (!rsa_blinding_invert(blinding, ret, unblind, ctx)) 
+            goto err; 
+ 
+    if (padding == RSA_X931_PADDING) { 
+        if (!BN_sub(f, rsa->n, ret)) 
+            goto err; 
+        if (BN_cmp(ret, f) > 0) 
+            res = f; 
+        else 
+            res = ret; 
+    } else { 
+        res = ret; 
+    } 
+ 
+    /* 
+     * BN_bn2binpad puts in leading 0 bytes if the number is less than 
+     * the length of the modulus. 
+     */ 
+    r = BN_bn2binpad(res, to, num); 
+ err: 
     BN_CTX_end(ctx);
-    BN_CTX_free(ctx);
-    OPENSSL_clear_free(buf, num);
-    return r;
-}
-
-static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,
-                                   unsigned char *to, RSA *rsa, int padding)
-{
-    BIGNUM *f, *ret;
-    int j, num = 0, r = -1;
-    unsigned char *buf = NULL;
-    BN_CTX *ctx = NULL;
-    int local_blinding = 0;
-    /*
-     * Used only if the blinding structure is shared. A non-NULL unblind
-     * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
-     * the unblinding factor outside the blinding structure.
-     */
-    BIGNUM *unblind = NULL;
-    BN_BLINDING *blinding = NULL;
-
-    if ((ctx = BN_CTX_new()) == NULL)
-        goto err;
-    BN_CTX_start(ctx);
-    f = BN_CTX_get(ctx);
-    ret = BN_CTX_get(ctx);
-    num = BN_num_bytes(rsa->n);
-    buf = OPENSSL_malloc(num);
-    if (ret == NULL || buf == NULL) {
-        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-
-    /*
-     * This check was for equality but PGP does evil things and chops off the
-     * top '0' bytes
-     */
-    if (flen > num) {
-        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,
-               RSA_R_DATA_GREATER_THAN_MOD_LEN);
-        goto err;
-    }
-
-    /* make data into a big number */
-    if (BN_bin2bn(from, (int)flen, f) == NULL)
-        goto err;
-
-    if (BN_ucmp(f, rsa->n) >= 0) {
-        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,
-               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
-        goto err;
-    }
-
-    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {
-        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
-        if (blinding == NULL) {
-            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);
-            goto err;
-        }
-    }
-
-    if (blinding != NULL) {
-        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {
-            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);
-            goto err;
-        }
-        if (!rsa_blinding_convert(blinding, f, unblind, ctx))
-            goto err;
-    }
-
-    /* do the decrypt */
-    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||
-        (rsa->version == RSA_ASN1_VERSION_MULTI) ||
-        ((rsa->p != NULL) &&
-         (rsa->q != NULL) &&
-         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {
-        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))
-            goto err;
-    } else {
-        BIGNUM *d = BN_new();
-        if (d == NULL) {
-            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);
-            goto err;
-        }
+    BN_CTX_free(ctx); 
+    OPENSSL_clear_free(buf, num); 
+    return r; 
+} 
+ 
+static int rsa_ossl_private_decrypt(int flen, const unsigned char *from, 
+                                   unsigned char *to, RSA *rsa, int padding) 
+{ 
+    BIGNUM *f, *ret; 
+    int j, num = 0, r = -1; 
+    unsigned char *buf = NULL; 
+    BN_CTX *ctx = NULL; 
+    int local_blinding = 0; 
+    /* 
+     * Used only if the blinding structure is shared. A non-NULL unblind 
+     * instructs rsa_blinding_convert() and rsa_blinding_invert() to store 
+     * the unblinding factor outside the blinding structure. 
+     */ 
+    BIGNUM *unblind = NULL; 
+    BN_BLINDING *blinding = NULL; 
+ 
+    if ((ctx = BN_CTX_new()) == NULL) 
+        goto err; 
+    BN_CTX_start(ctx); 
+    f = BN_CTX_get(ctx); 
+    ret = BN_CTX_get(ctx); 
+    num = BN_num_bytes(rsa->n); 
+    buf = OPENSSL_malloc(num); 
+    if (ret == NULL || buf == NULL) { 
+        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE); 
+        goto err; 
+    } 
+ 
+    /* 
+     * This check was for equality but PGP does evil things and chops off the 
+     * top '0' bytes 
+     */ 
+    if (flen > num) { 
+        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, 
+               RSA_R_DATA_GREATER_THAN_MOD_LEN); 
+        goto err; 
+    } 
+ 
+    /* make data into a big number */ 
+    if (BN_bin2bn(from, (int)flen, f) == NULL) 
+        goto err; 
+ 
+    if (BN_ucmp(f, rsa->n) >= 0) { 
+        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, 
+               RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 
+        goto err; 
+    } 
+ 
+    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) { 
+        blinding = rsa_get_blinding(rsa, &local_blinding, ctx); 
+        if (blinding == NULL) { 
+            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR); 
+            goto err; 
+        } 
+    } 
+ 
+    if (blinding != NULL) { 
+        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) { 
+            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE); 
+            goto err; 
+        } 
+        if (!rsa_blinding_convert(blinding, f, unblind, ctx)) 
+            goto err; 
+    } 
+ 
+    /* do the decrypt */ 
+    if ((rsa->flags & RSA_FLAG_EXT_PKEY) || 
+        (rsa->version == RSA_ASN1_VERSION_MULTI) || 
+        ((rsa->p != NULL) && 
+         (rsa->q != NULL) && 
+         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) { 
+        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) 
+            goto err; 
+    } else { 
+        BIGNUM *d = BN_new(); 
+        if (d == NULL) { 
+            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE); 
+            goto err; 
+        } 
         if (rsa->d == NULL) {
             RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_MISSING_PRIVATE_KEY);
             BN_free(d);
             goto err;
         }
-        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
-
-        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
-            if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
-                                        rsa->n, ctx)) {
-                BN_free(d);
-                goto err;
-            }
-        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,
-                                   rsa->_method_mod_n)) {
-            BN_free(d);
-            goto err;
-        }
-        /* We MUST free d before any further use of rsa->d */
-        BN_free(d);
-    }
-
-    if (blinding)
-        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
-            goto err;
-
-    j = BN_bn2binpad(ret, buf, num);
-
-    switch (padding) {
-    case RSA_PKCS1_PADDING:
-        r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num);
-        break;
-    case RSA_PKCS1_OAEP_PADDING:
-        r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);
-        break;
-    case RSA_SSLV23_PADDING:
-        r = RSA_padding_check_SSLv23(to, num, buf, j, num);
-        break;
-    case RSA_NO_PADDING:
-        memcpy(to, buf, (r = j));
-        break;
-    default:
-        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
-        goto err;
-    }
-    RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED);
+        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME); 
+ 
+        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) 
+            if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock, 
+                                        rsa->n, ctx)) { 
+                BN_free(d); 
+                goto err; 
+            } 
+        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx, 
+                                   rsa->_method_mod_n)) { 
+            BN_free(d); 
+            goto err; 
+        } 
+        /* We MUST free d before any further use of rsa->d */ 
+        BN_free(d); 
+    } 
+ 
+    if (blinding) 
+        if (!rsa_blinding_invert(blinding, ret, unblind, ctx)) 
+            goto err; 
+ 
+    j = BN_bn2binpad(ret, buf, num); 
+ 
+    switch (padding) { 
+    case RSA_PKCS1_PADDING: 
+        r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num); 
+        break; 
+    case RSA_PKCS1_OAEP_PADDING: 
+        r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0); 
+        break; 
+    case RSA_SSLV23_PADDING: 
+        r = RSA_padding_check_SSLv23(to, num, buf, j, num); 
+        break; 
+    case RSA_NO_PADDING: 
+        memcpy(to, buf, (r = j)); 
+        break; 
+    default: 
+        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE); 
+        goto err; 
+    } 
+    RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED); 
     err_clear_last_constant_time(1 & ~constant_time_msb(r));
-
- err:
-    BN_CTX_end(ctx);
-    BN_CTX_free(ctx);
-    OPENSSL_clear_free(buf, num);
-    return r;
-}
-
-/* signature verification */
-static int rsa_ossl_public_decrypt(int flen, const unsigned char *from,
-                                  unsigned char *to, RSA *rsa, int padding)
-{
-    BIGNUM *f, *ret;
-    int i, num = 0, r = -1;
-    unsigned char *buf = NULL;
-    BN_CTX *ctx = NULL;
-
-    if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
-        return -1;
-    }
-
-    if (BN_ucmp(rsa->n, rsa->e) <= 0) {
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
-        return -1;
-    }
-
-    /* for large moduli, enforce exponent limit */
-    if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) {
-        if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {
-            RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
-            return -1;
-        }
-    }
-
-    if ((ctx = BN_CTX_new()) == NULL)
-        goto err;
-    BN_CTX_start(ctx);
-    f = BN_CTX_get(ctx);
-    ret = BN_CTX_get(ctx);
-    num = BN_num_bytes(rsa->n);
-    buf = OPENSSL_malloc(num);
-    if (ret == NULL || buf == NULL) {
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-
-    /*
-     * This check was for equality but PGP does evil things and chops off the
-     * top '0' bytes
-     */
-    if (flen > num) {
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_DATA_GREATER_THAN_MOD_LEN);
-        goto err;
-    }
-
-    if (BN_bin2bn(from, flen, f) == NULL)
-        goto err;
-
-    if (BN_ucmp(f, rsa->n) >= 0) {
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT,
-               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
-        goto err;
-    }
-
-    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
-        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
-                                    rsa->n, ctx))
-            goto err;
-
-    if (!rsa->meth->bn_mod_exp(ret, f, rsa->e, rsa->n, ctx,
-                               rsa->_method_mod_n))
-        goto err;
-
-    if ((padding == RSA_X931_PADDING) && ((bn_get_words(ret)[0] & 0xf) != 12))
-        if (!BN_sub(ret, rsa->n, ret))
-            goto err;
-
-    i = BN_bn2binpad(ret, buf, num);
-
-    switch (padding) {
-    case RSA_PKCS1_PADDING:
-        r = RSA_padding_check_PKCS1_type_1(to, num, buf, i, num);
-        break;
-    case RSA_X931_PADDING:
-        r = RSA_padding_check_X931(to, num, buf, i, num);
-        break;
-    case RSA_NO_PADDING:
-        memcpy(to, buf, (r = i));
-        break;
-    default:
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
-        goto err;
-    }
-    if (r < 0)
-        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_PADDING_CHECK_FAILED);
-
- err:
+ 
+ err: 
     BN_CTX_end(ctx);
-    BN_CTX_free(ctx);
-    OPENSSL_clear_free(buf, num);
-    return r;
-}
-
-static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
-{
-    BIGNUM *r1, *m1, *vrfy, *r2, *m[RSA_MAX_PRIME_NUM - 2];
-    int ret = 0, i, ex_primes = 0, smooth = 0;
-    RSA_PRIME_INFO *pinfo;
-
-    BN_CTX_start(ctx);
-
-    r1 = BN_CTX_get(ctx);
-    r2 = BN_CTX_get(ctx);
-    m1 = BN_CTX_get(ctx);
-    vrfy = BN_CTX_get(ctx);
-    if (vrfy == NULL)
-        goto err;
-
-    if (rsa->version == RSA_ASN1_VERSION_MULTI
-        && ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0
-             || ex_primes > RSA_MAX_PRIME_NUM - 2))
-        goto err;
-
-    if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) {
-        BIGNUM *factor = BN_new();
-
-        if (factor == NULL)
-            goto err;
-
-        /*
-         * Make sure BN_mod_inverse in Montgomery initialization uses the
-         * BN_FLG_CONSTTIME flag
-         */
-        if (!(BN_with_flags(factor, rsa->p, BN_FLG_CONSTTIME),
-              BN_MONT_CTX_set_locked(&rsa->_method_mod_p, rsa->lock,
-                                     factor, ctx))
-            || !(BN_with_flags(factor, rsa->q, BN_FLG_CONSTTIME),
-                 BN_MONT_CTX_set_locked(&rsa->_method_mod_q, rsa->lock,
-                                        factor, ctx))) {
-            BN_free(factor);
-            goto err;
-        }
-        for (i = 0; i < ex_primes; i++) {
-            pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
-            BN_with_flags(factor, pinfo->r, BN_FLG_CONSTTIME);
-            if (!BN_MONT_CTX_set_locked(&pinfo->m, rsa->lock, factor, ctx)) {
-                BN_free(factor);
-                goto err;
-            }
-        }
-        /*
-         * We MUST free |factor| before any further use of the prime factors
-         */
-        BN_free(factor);
-
-        smooth = (ex_primes == 0)
-                 && (rsa->meth->bn_mod_exp == BN_mod_exp_mont)
-                 && (BN_num_bits(rsa->q) == BN_num_bits(rsa->p));
-    }
-
-    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
-        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,
-                                    rsa->n, ctx))
-            goto err;
-
-    if (smooth) {
-        /*
-         * Conversion from Montgomery domain, a.k.a. Montgomery reduction,
-         * accepts values in [0-m*2^w) range. w is m's bit width rounded up
-         * to limb width. So that at the very least if |I| is fully reduced,
-         * i.e. less than p*q, we can count on from-to round to perform
-         * below modulo operations on |I|. Unlike BN_mod it's constant time.
-         */
-        if (/* m1 = I moq q */
-            !bn_from_mont_fixed_top(m1, I, rsa->_method_mod_q, ctx)
-            || !bn_to_mont_fixed_top(m1, m1, rsa->_method_mod_q, ctx)
-            /* m1 = m1^dmq1 mod q */
-            || !BN_mod_exp_mont_consttime(m1, m1, rsa->dmq1, rsa->q, ctx,
-                                          rsa->_method_mod_q)
-            /* r1 = I mod p */
-            || !bn_from_mont_fixed_top(r1, I, rsa->_method_mod_p, ctx)
-            || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx)
-            /* r1 = r1^dmp1 mod p */
-            || !BN_mod_exp_mont_consttime(r1, r1, rsa->dmp1, rsa->p, ctx,
-                                          rsa->_method_mod_p)
-            /* r1 = (r1 - m1) mod p */
-            /*
-             * bn_mod_sub_fixed_top is not regular modular subtraction,
-             * it can tolerate subtrahend to be larger than modulus, but
-             * not bit-wise wider. This makes up for uncommon q>p case,
-             * when |m1| can be larger than |rsa->p|.
-             */
-            || !bn_mod_sub_fixed_top(r1, r1, m1, rsa->p)
-
-            /* r1 = r1 * iqmp mod p */
-            || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx)
-            || !bn_mul_mont_fixed_top(r1, r1, rsa->iqmp, rsa->_method_mod_p,
-                                      ctx)
-            /* r0 = r1 * q + m1 */
-            || !bn_mul_fixed_top(r0, r1, rsa->q, ctx)
-            || !bn_mod_add_fixed_top(r0, r0, m1, rsa->n))
-            goto err;
-
-        goto tail;
-    }
-
-    /* compute I mod q */
-    {
-        BIGNUM *c = BN_new();
-        if (c == NULL)
-            goto err;
-        BN_with_flags(c, I, BN_FLG_CONSTTIME);
-
-        if (!BN_mod(r1, c, rsa->q, ctx)) {
-            BN_free(c);
-            goto err;
-        }
-
-        {
-            BIGNUM *dmq1 = BN_new();
-            if (dmq1 == NULL) {
-                BN_free(c);
-                goto err;
-            }
-            BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);
-
-            /* compute r1^dmq1 mod q */
-            if (!rsa->meth->bn_mod_exp(m1, r1, dmq1, rsa->q, ctx,
-                                       rsa->_method_mod_q)) {
-                BN_free(c);
-                BN_free(dmq1);
-                goto err;
-            }
-            /* We MUST free dmq1 before any further use of rsa->dmq1 */
-            BN_free(dmq1);
-        }
-
-        /* compute I mod p */
-        if (!BN_mod(r1, c, rsa->p, ctx)) {
-            BN_free(c);
-            goto err;
-        }
-        /* We MUST free c before any further use of I */
-        BN_free(c);
-    }
-
-    {
-        BIGNUM *dmp1 = BN_new();
-        if (dmp1 == NULL)
-            goto err;
-        BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);
-
-        /* compute r1^dmp1 mod p */
-        if (!rsa->meth->bn_mod_exp(r0, r1, dmp1, rsa->p, ctx,
-                                   rsa->_method_mod_p)) {
-            BN_free(dmp1);
-            goto err;
-        }
-        /* We MUST free dmp1 before any further use of rsa->dmp1 */
-        BN_free(dmp1);
-    }
-
-    /*
-     * calculate m_i in multi-prime case
-     *
-     * TODO:
-     * 1. squash the following two loops and calculate |m_i| there.
-     * 2. remove cc and reuse |c|.
-     * 3. remove |dmq1| and |dmp1| in previous block and use |di|.
-     *
-     * If these things are done, the code will be more readable.
-     */
-    if (ex_primes > 0) {
-        BIGNUM *di = BN_new(), *cc = BN_new();
-
-        if (cc == NULL || di == NULL) {
-            BN_free(cc);
-            BN_free(di);
-            goto err;
-        }
-
-        for (i = 0; i < ex_primes; i++) {
-            /* prepare m_i */
-            if ((m[i] = BN_CTX_get(ctx)) == NULL) {
-                BN_free(cc);
-                BN_free(di);
-                goto err;
-            }
-
-            pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
-
-            /* prepare c and d_i */
-            BN_with_flags(cc, I, BN_FLG_CONSTTIME);
-            BN_with_flags(di, pinfo->d, BN_FLG_CONSTTIME);
-
-            if (!BN_mod(r1, cc, pinfo->r, ctx)) {
-                BN_free(cc);
-                BN_free(di);
-                goto err;
-            }
-            /* compute r1 ^ d_i mod r_i */
-            if (!rsa->meth->bn_mod_exp(m[i], r1, di, pinfo->r, ctx, pinfo->m)) {
-                BN_free(cc);
-                BN_free(di);
-                goto err;
-            }
-        }
-
-        BN_free(cc);
-        BN_free(di);
-    }
-
-    if (!BN_sub(r0, r0, m1))
-        goto err;
-    /*
-     * This will help stop the size of r0 increasing, which does affect the
-     * multiply if it optimised for a power of 2 size
-     */
-    if (BN_is_negative(r0))
-        if (!BN_add(r0, r0, rsa->p))
-            goto err;
-
-    if (!BN_mul(r1, r0, rsa->iqmp, ctx))
-        goto err;
-
-    {
-        BIGNUM *pr1 = BN_new();
-        if (pr1 == NULL)
-            goto err;
-        BN_with_flags(pr1, r1, BN_FLG_CONSTTIME);
-
-        if (!BN_mod(r0, pr1, rsa->p, ctx)) {
-            BN_free(pr1);
-            goto err;
-        }
-        /* We MUST free pr1 before any further use of r1 */
-        BN_free(pr1);
-    }
-
-    /*
-     * If p < q it is occasionally possible for the correction of adding 'p'
-     * if r0 is negative above to leave the result still negative. This can
-     * break the private key operations: the following second correction
-     * should *always* correct this rare occurrence. This will *never* happen
-     * with OpenSSL generated keys because they ensure p > q [steve]
-     */
-    if (BN_is_negative(r0))
-        if (!BN_add(r0, r0, rsa->p))
-            goto err;
-    if (!BN_mul(r1, r0, rsa->q, ctx))
-        goto err;
-    if (!BN_add(r0, r1, m1))
-        goto err;
-
-    /* add m_i to m in multi-prime case */
-    if (ex_primes > 0) {
-        BIGNUM *pr2 = BN_new();
-
-        if (pr2 == NULL)
-            goto err;
-
-        for (i = 0; i < ex_primes; i++) {
-            pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
-            if (!BN_sub(r1, m[i], r0)) {
-                BN_free(pr2);
-                goto err;
-            }
-
-            if (!BN_mul(r2, r1, pinfo->t, ctx)) {
-                BN_free(pr2);
-                goto err;
-            }
-
-            BN_with_flags(pr2, r2, BN_FLG_CONSTTIME);
-
-            if (!BN_mod(r1, pr2, pinfo->r, ctx)) {
-                BN_free(pr2);
-                goto err;
-            }
-
-            if (BN_is_negative(r1))
-                if (!BN_add(r1, r1, pinfo->r)) {
-                    BN_free(pr2);
-                    goto err;
-                }
-            if (!BN_mul(r1, r1, pinfo->pp, ctx)) {
-                BN_free(pr2);
-                goto err;
-            }
-            if (!BN_add(r0, r0, r1)) {
-                BN_free(pr2);
-                goto err;
-            }
-        }
-        BN_free(pr2);
-    }
-
- tail:
-    if (rsa->e && rsa->n) {
-        if (rsa->meth->bn_mod_exp == BN_mod_exp_mont) {
-            if (!BN_mod_exp_mont(vrfy, r0, rsa->e, rsa->n, ctx,
-                                 rsa->_method_mod_n))
-                goto err;
-        } else {
-            bn_correct_top(r0);
-            if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx,
-                                       rsa->_method_mod_n))
-                goto err;
-        }
-        /*
-         * If 'I' was greater than (or equal to) rsa->n, the operation will
-         * be equivalent to using 'I mod n'. However, the result of the
-         * verify will *always* be less than 'n' so we don't check for
-         * absolute equality, just congruency.
-         */
-        if (!BN_sub(vrfy, vrfy, I))
-            goto err;
-        if (BN_is_zero(vrfy)) {
-            bn_correct_top(r0);
-            ret = 1;
-            goto err;   /* not actually error */
-        }
-        if (!BN_mod(vrfy, vrfy, rsa->n, ctx))
-            goto err;
-        if (BN_is_negative(vrfy))
-            if (!BN_add(vrfy, vrfy, rsa->n))
-                goto err;
-        if (!BN_is_zero(vrfy)) {
-            /*
-             * 'I' and 'vrfy' aren't congruent mod n. Don't leak
-             * miscalculated CRT output, just do a raw (slower) mod_exp and
-             * return that instead.
-             */
-
-            BIGNUM *d = BN_new();
-            if (d == NULL)
-                goto err;
-            BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
-
-            if (!rsa->meth->bn_mod_exp(r0, I, d, rsa->n, ctx,
-                                       rsa->_method_mod_n)) {
-                BN_free(d);
-                goto err;
-            }
-            /* We MUST free d before any further use of rsa->d */
-            BN_free(d);
-        }
-    }
-    /*
-     * It's unfortunate that we have to bn_correct_top(r0). What hopefully
-     * saves the day is that correction is highly unlike, and private key
-     * operations are customarily performed on blinded message. Which means
-     * that attacker won't observe correlation with chosen plaintext.
-     * Secondly, remaining code would still handle it in same computational
-     * time and even conceal memory access pattern around corrected top.
-     */
-    bn_correct_top(r0);
-    ret = 1;
- err:
+    BN_CTX_free(ctx); 
+    OPENSSL_clear_free(buf, num); 
+    return r; 
+} 
+ 
+/* signature verification */ 
+static int rsa_ossl_public_decrypt(int flen, const unsigned char *from, 
+                                  unsigned char *to, RSA *rsa, int padding) 
+{ 
+    BIGNUM *f, *ret; 
+    int i, num = 0, r = -1; 
+    unsigned char *buf = NULL; 
+    BN_CTX *ctx = NULL; 
+ 
+    if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) { 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE); 
+        return -1; 
+    } 
+ 
+    if (BN_ucmp(rsa->n, rsa->e) <= 0) { 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE); 
+        return -1; 
+    } 
+ 
+    /* for large moduli, enforce exponent limit */ 
+    if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) { 
+        if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) { 
+            RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE); 
+            return -1; 
+        } 
+    } 
+ 
+    if ((ctx = BN_CTX_new()) == NULL) 
+        goto err; 
+    BN_CTX_start(ctx); 
+    f = BN_CTX_get(ctx); 
+    ret = BN_CTX_get(ctx); 
+    num = BN_num_bytes(rsa->n); 
+    buf = OPENSSL_malloc(num); 
+    if (ret == NULL || buf == NULL) { 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, ERR_R_MALLOC_FAILURE); 
+        goto err; 
+    } 
+ 
+    /* 
+     * This check was for equality but PGP does evil things and chops off the 
+     * top '0' bytes 
+     */ 
+    if (flen > num) { 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_DATA_GREATER_THAN_MOD_LEN); 
+        goto err; 
+    } 
+ 
+    if (BN_bin2bn(from, flen, f) == NULL) 
+        goto err; 
+ 
+    if (BN_ucmp(f, rsa->n) >= 0) { 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, 
+               RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 
+        goto err; 
+    } 
+ 
+    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) 
+        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock, 
+                                    rsa->n, ctx)) 
+            goto err; 
+ 
+    if (!rsa->meth->bn_mod_exp(ret, f, rsa->e, rsa->n, ctx, 
+                               rsa->_method_mod_n)) 
+        goto err; 
+ 
+    if ((padding == RSA_X931_PADDING) && ((bn_get_words(ret)[0] & 0xf) != 12)) 
+        if (!BN_sub(ret, rsa->n, ret)) 
+            goto err; 
+ 
+    i = BN_bn2binpad(ret, buf, num); 
+ 
+    switch (padding) { 
+    case RSA_PKCS1_PADDING: 
+        r = RSA_padding_check_PKCS1_type_1(to, num, buf, i, num); 
+        break; 
+    case RSA_X931_PADDING: 
+        r = RSA_padding_check_X931(to, num, buf, i, num); 
+        break; 
+    case RSA_NO_PADDING: 
+        memcpy(to, buf, (r = i)); 
+        break; 
+    default: 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE); 
+        goto err; 
+    } 
+    if (r < 0) 
+        RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_PADDING_CHECK_FAILED); 
+ 
+ err: 
     BN_CTX_end(ctx);
-    return ret;
-}
-
-static int rsa_ossl_init(RSA *rsa)
-{
-    rsa->flags |= RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE;
-    return 1;
-}
-
-static int rsa_ossl_finish(RSA *rsa)
-{
-    int i;
-    RSA_PRIME_INFO *pinfo;
-
-    BN_MONT_CTX_free(rsa->_method_mod_n);
-    BN_MONT_CTX_free(rsa->_method_mod_p);
-    BN_MONT_CTX_free(rsa->_method_mod_q);
-    for (i = 0; i < sk_RSA_PRIME_INFO_num(rsa->prime_infos); i++) {
-        pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);
-        BN_MONT_CTX_free(pinfo->m);
-    }
-    return 1;
-}
+    BN_CTX_free(ctx); 
+    OPENSSL_clear_free(buf, num); 
+    return r; 
+} 
+ 
+static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) 
+{ 
+    BIGNUM *r1, *m1, *vrfy, *r2, *m[RSA_MAX_PRIME_NUM - 2]; 
+    int ret = 0, i, ex_primes = 0, smooth = 0; 
+    RSA_PRIME_INFO *pinfo; 
+ 
+    BN_CTX_start(ctx); 
+ 
+    r1 = BN_CTX_get(ctx); 
+    r2 = BN_CTX_get(ctx); 
+    m1 = BN_CTX_get(ctx); 
+    vrfy = BN_CTX_get(ctx); 
+    if (vrfy == NULL) 
+        goto err; 
+ 
+    if (rsa->version == RSA_ASN1_VERSION_MULTI 
+        && ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0 
+             || ex_primes > RSA_MAX_PRIME_NUM - 2)) 
+        goto err; 
+ 
+    if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) { 
+        BIGNUM *factor = BN_new(); 
+ 
+        if (factor == NULL) 
+            goto err; 
+ 
+        /* 
+         * Make sure BN_mod_inverse in Montgomery initialization uses the 
+         * BN_FLG_CONSTTIME flag 
+         */ 
+        if (!(BN_with_flags(factor, rsa->p, BN_FLG_CONSTTIME), 
+              BN_MONT_CTX_set_locked(&rsa->_method_mod_p, rsa->lock, 
+                                     factor, ctx)) 
+            || !(BN_with_flags(factor, rsa->q, BN_FLG_CONSTTIME), 
+                 BN_MONT_CTX_set_locked(&rsa->_method_mod_q, rsa->lock, 
+                                        factor, ctx))) { 
+            BN_free(factor); 
+            goto err; 
+        } 
+        for (i = 0; i < ex_primes; i++) { 
+            pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i); 
+            BN_with_flags(factor, pinfo->r, BN_FLG_CONSTTIME); 
+            if (!BN_MONT_CTX_set_locked(&pinfo->m, rsa->lock, factor, ctx)) { 
+                BN_free(factor); 
+                goto err; 
+            } 
+        } 
+        /* 
+         * We MUST free |factor| before any further use of the prime factors 
+         */ 
+        BN_free(factor); 
+ 
+        smooth = (ex_primes == 0) 
+                 && (rsa->meth->bn_mod_exp == BN_mod_exp_mont) 
+                 && (BN_num_bits(rsa->q) == BN_num_bits(rsa->p)); 
+    } 
+ 
+    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) 
+        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock, 
+                                    rsa->n, ctx)) 
+            goto err; 
+ 
+    if (smooth) { 
+        /* 
+         * Conversion from Montgomery domain, a.k.a. Montgomery reduction, 
+         * accepts values in [0-m*2^w) range. w is m's bit width rounded up 
+         * to limb width. So that at the very least if |I| is fully reduced, 
+         * i.e. less than p*q, we can count on from-to round to perform 
+         * below modulo operations on |I|. Unlike BN_mod it's constant time. 
+         */ 
+        if (/* m1 = I moq q */ 
+            !bn_from_mont_fixed_top(m1, I, rsa->_method_mod_q, ctx) 
+            || !bn_to_mont_fixed_top(m1, m1, rsa->_method_mod_q, ctx) 
+            /* m1 = m1^dmq1 mod q */ 
+            || !BN_mod_exp_mont_consttime(m1, m1, rsa->dmq1, rsa->q, ctx, 
+                                          rsa->_method_mod_q) 
+            /* r1 = I mod p */ 
+            || !bn_from_mont_fixed_top(r1, I, rsa->_method_mod_p, ctx) 
+            || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx) 
+            /* r1 = r1^dmp1 mod p */ 
+            || !BN_mod_exp_mont_consttime(r1, r1, rsa->dmp1, rsa->p, ctx, 
+                                          rsa->_method_mod_p) 
+            /* r1 = (r1 - m1) mod p */ 
+            /* 
+             * bn_mod_sub_fixed_top is not regular modular subtraction, 
+             * it can tolerate subtrahend to be larger than modulus, but 
+             * not bit-wise wider. This makes up for uncommon q>p case, 
+             * when |m1| can be larger than |rsa->p|. 
+             */ 
+            || !bn_mod_sub_fixed_top(r1, r1, m1, rsa->p) 
+ 
+            /* r1 = r1 * iqmp mod p */ 
+            || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx) 
+            || !bn_mul_mont_fixed_top(r1, r1, rsa->iqmp, rsa->_method_mod_p, 
+                                      ctx) 
+            /* r0 = r1 * q + m1 */ 
+            || !bn_mul_fixed_top(r0, r1, rsa->q, ctx) 
+            || !bn_mod_add_fixed_top(r0, r0, m1, rsa->n)) 
+            goto err; 
+ 
+        goto tail; 
+    } 
+ 
+    /* compute I mod q */ 
+    { 
+        BIGNUM *c = BN_new(); 
+        if (c == NULL) 
+            goto err; 
+        BN_with_flags(c, I, BN_FLG_CONSTTIME); 
+ 
+        if (!BN_mod(r1, c, rsa->q, ctx)) { 
+            BN_free(c); 
+            goto err; 
+        } 
+ 
+        { 
+            BIGNUM *dmq1 = BN_new(); 
+            if (dmq1 == NULL) { 
+                BN_free(c); 
+                goto err; 
+            } 
+            BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME); 
+ 
+            /* compute r1^dmq1 mod q */ 
+            if (!rsa->meth->bn_mod_exp(m1, r1, dmq1, rsa->q, ctx, 
+                                       rsa->_method_mod_q)) { 
+                BN_free(c); 
+                BN_free(dmq1); 
+                goto err; 
+            } 
+            /* We MUST free dmq1 before any further use of rsa->dmq1 */ 
+            BN_free(dmq1); 
+        } 
+ 
+        /* compute I mod p */ 
+        if (!BN_mod(r1, c, rsa->p, ctx)) { 
+            BN_free(c); 
+            goto err; 
+        } 
+        /* We MUST free c before any further use of I */ 
+        BN_free(c); 
+    } 
+ 
+    { 
+        BIGNUM *dmp1 = BN_new(); 
+        if (dmp1 == NULL) 
+            goto err; 
+        BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME); 
+ 
+        /* compute r1^dmp1 mod p */ 
+        if (!rsa->meth->bn_mod_exp(r0, r1, dmp1, rsa->p, ctx, 
+                                   rsa->_method_mod_p)) { 
+            BN_free(dmp1); 
+            goto err; 
+        } 
+        /* We MUST free dmp1 before any further use of rsa->dmp1 */ 
+        BN_free(dmp1); 
+    } 
+ 
+    /* 
+     * calculate m_i in multi-prime case 
+     * 
+     * TODO: 
+     * 1. squash the following two loops and calculate |m_i| there. 
+     * 2. remove cc and reuse |c|. 
+     * 3. remove |dmq1| and |dmp1| in previous block and use |di|. 
+     * 
+     * If these things are done, the code will be more readable. 
+     */ 
+    if (ex_primes > 0) { 
+        BIGNUM *di = BN_new(), *cc = BN_new(); 
+ 
+        if (cc == NULL || di == NULL) { 
+            BN_free(cc); 
+            BN_free(di); 
+            goto err; 
+        } 
+ 
+        for (i = 0; i < ex_primes; i++) { 
+            /* prepare m_i */ 
+            if ((m[i] = BN_CTX_get(ctx)) == NULL) { 
+                BN_free(cc); 
+                BN_free(di); 
+                goto err; 
+            } 
+ 
+            pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i); 
+ 
+            /* prepare c and d_i */ 
+            BN_with_flags(cc, I, BN_FLG_CONSTTIME); 
+            BN_with_flags(di, pinfo->d, BN_FLG_CONSTTIME); 
+ 
+            if (!BN_mod(r1, cc, pinfo->r, ctx)) { 
+                BN_free(cc); 
+                BN_free(di); 
+                goto err; 
+            } 
+            /* compute r1 ^ d_i mod r_i */ 
+            if (!rsa->meth->bn_mod_exp(m[i], r1, di, pinfo->r, ctx, pinfo->m)) { 
+                BN_free(cc); 
+                BN_free(di); 
+                goto err; 
+            } 
+        } 
+ 
+        BN_free(cc); 
+        BN_free(di); 
+    } 
+ 
+    if (!BN_sub(r0, r0, m1)) 
+        goto err; 
+    /* 
+     * This will help stop the size of r0 increasing, which does affect the 
+     * multiply if it optimised for a power of 2 size 
+     */ 
+    if (BN_is_negative(r0)) 
+        if (!BN_add(r0, r0, rsa->p)) 
+            goto err; 
+ 
+    if (!BN_mul(r1, r0, rsa->iqmp, ctx)) 
+        goto err; 
+ 
+    { 
+        BIGNUM *pr1 = BN_new(); 
+        if (pr1 == NULL) 
+            goto err; 
+        BN_with_flags(pr1, r1, BN_FLG_CONSTTIME); 
+ 
+        if (!BN_mod(r0, pr1, rsa->p, ctx)) { 
+            BN_free(pr1); 
+            goto err; 
+        } 
+        /* We MUST free pr1 before any further use of r1 */ 
+        BN_free(pr1); 
+    } 
+ 
+    /* 
+     * If p < q it is occasionally possible for the correction of adding 'p' 
+     * if r0 is negative above to leave the result still negative. This can 
+     * break the private key operations: the following second correction 
+     * should *always* correct this rare occurrence. This will *never* happen 
+     * with OpenSSL generated keys because they ensure p > q [steve] 
+     */ 
+    if (BN_is_negative(r0)) 
+        if (!BN_add(r0, r0, rsa->p)) 
+            goto err; 
+    if (!BN_mul(r1, r0, rsa->q, ctx)) 
+        goto err; 
+    if (!BN_add(r0, r1, m1)) 
+        goto err; 
+ 
+    /* add m_i to m in multi-prime case */ 
+    if (ex_primes > 0) { 
+        BIGNUM *pr2 = BN_new(); 
+ 
+        if (pr2 == NULL) 
+            goto err; 
+ 
+        for (i = 0; i < ex_primes; i++) { 
+            pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i); 
+            if (!BN_sub(r1, m[i], r0)) { 
+                BN_free(pr2); 
+                goto err; 
+            } 
+ 
+            if (!BN_mul(r2, r1, pinfo->t, ctx)) { 
+                BN_free(pr2); 
+                goto err; 
+            } 
+ 
+            BN_with_flags(pr2, r2, BN_FLG_CONSTTIME); 
+ 
+            if (!BN_mod(r1, pr2, pinfo->r, ctx)) { 
+                BN_free(pr2); 
+                goto err; 
+            } 
+ 
+            if (BN_is_negative(r1)) 
+                if (!BN_add(r1, r1, pinfo->r)) { 
+                    BN_free(pr2); 
+                    goto err; 
+                } 
+            if (!BN_mul(r1, r1, pinfo->pp, ctx)) { 
+                BN_free(pr2); 
+                goto err; 
+            } 
+            if (!BN_add(r0, r0, r1)) { 
+                BN_free(pr2); 
+                goto err; 
+            } 
+        } 
+        BN_free(pr2); 
+    } 
+ 
+ tail: 
+    if (rsa->e && rsa->n) { 
+        if (rsa->meth->bn_mod_exp == BN_mod_exp_mont) { 
+            if (!BN_mod_exp_mont(vrfy, r0, rsa->e, rsa->n, ctx, 
+                                 rsa->_method_mod_n)) 
+                goto err; 
+        } else { 
+            bn_correct_top(r0); 
+            if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx, 
+                                       rsa->_method_mod_n)) 
+                goto err; 
+        } 
+        /* 
+         * If 'I' was greater than (or equal to) rsa->n, the operation will 
+         * be equivalent to using 'I mod n'. However, the result of the 
+         * verify will *always* be less than 'n' so we don't check for 
+         * absolute equality, just congruency. 
+         */ 
+        if (!BN_sub(vrfy, vrfy, I)) 
+            goto err; 
+        if (BN_is_zero(vrfy)) { 
+            bn_correct_top(r0); 
+            ret = 1; 
+            goto err;   /* not actually error */ 
+        } 
+        if (!BN_mod(vrfy, vrfy, rsa->n, ctx)) 
+            goto err; 
+        if (BN_is_negative(vrfy)) 
+            if (!BN_add(vrfy, vrfy, rsa->n)) 
+                goto err; 
+        if (!BN_is_zero(vrfy)) { 
+            /* 
+             * 'I' and 'vrfy' aren't congruent mod n. Don't leak 
+             * miscalculated CRT output, just do a raw (slower) mod_exp and 
+             * return that instead. 
+             */ 
+ 
+            BIGNUM *d = BN_new(); 
+            if (d == NULL) 
+                goto err; 
+            BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME); 
+ 
+            if (!rsa->meth->bn_mod_exp(r0, I, d, rsa->n, ctx, 
+                                       rsa->_method_mod_n)) { 
+                BN_free(d); 
+                goto err; 
+            } 
+            /* We MUST free d before any further use of rsa->d */ 
+            BN_free(d); 
+        } 
+    } 
+    /* 
+     * It's unfortunate that we have to bn_correct_top(r0). What hopefully 
+     * saves the day is that correction is highly unlike, and private key 
+     * operations are customarily performed on blinded message. Which means 
+     * that attacker won't observe correlation with chosen plaintext. 
+     * Secondly, remaining code would still handle it in same computational 
+     * time and even conceal memory access pattern around corrected top. 
+     */ 
+    bn_correct_top(r0); 
+    ret = 1; 
+ err: 
+    BN_CTX_end(ctx); 
+    return ret; 
+} 
+ 
+static int rsa_ossl_init(RSA *rsa) 
+{ 
+    rsa->flags |= RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE; 
+    return 1; 
+} 
+ 
+static int rsa_ossl_finish(RSA *rsa) 
+{ 
+    int i; 
+    RSA_PRIME_INFO *pinfo; 
+ 
+    BN_MONT_CTX_free(rsa->_method_mod_n); 
+    BN_MONT_CTX_free(rsa->_method_mod_p); 
+    BN_MONT_CTX_free(rsa->_method_mod_q); 
+    for (i = 0; i < sk_RSA_PRIME_INFO_num(rsa->prime_infos); i++) { 
+        pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i); 
+        BN_MONT_CTX_free(pinfo->m); 
+    } 
+    return 1; 
+}