Improved on the previous fix and added a test case to cover both types

of carries.

Author: Janos Follath

library/bignum.c

@@ -883,22 +883,11 @@ int mbedtls_mpi_add_abs( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
 {
     int ret;
     size_t i, j;
-    mbedtls_mpi_uint *o, *p, c;
-    mbedtls_mpi TB;
+    mbedtls_mpi_uint *o, *p, c, tmp;
 
     if( X == B )
     {
-        B = A; A = X;
-
-        if( B == A )
-        {
-            // Making a temporary copy instead of shifting by one to deny
-            // the possibility of corresponding side-channel attacks.
-            mbedtls_mpi_init( &TB );
-            MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &TB, B ) );
-            
-            B = &TB;
-        }
+        const mbedtls_mpi *T = A; A = X; B = T;
     }
 
     if( X != A )
@@ -917,10 +906,14 @@ int mbedtls_mpi_add_abs( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
 
     o = B->p; p = X->p; c = 0;
 
+    /*
+     * tmp is used because it might happen that p == o
+     */
     for( i = 0; i < j; i++, o++, p++ )
     {
+        tmp= *o;
         *p +=  c; c  = ( *p <  c );
-        *p += *o; c += ( *p < *o );
+        *p += tmp; c += ( *p < tmp );
     }
 
     while( c != 0 )
@@ -935,10 +928,6 @@ int mbedtls_mpi_add_abs( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
     }
 
 cleanup:
-    if( &TB == B ) 
-    {
-        mbedtls_mpi_free( &TB );
-    }
 
     return( ret );
 }

tests/suites/test_suite_mpi.data

@@ -301,6 +301,9 @@ mbedtls_mpi_add_mpi_inplace:10:"12345678":10:"24691356"
 Test mbedtls_mpi_add_mpi inplace #2 
 mbedtls_mpi_add_mpi_inplace:10:"643808006803554439230129854961492699151386107534013432918073439524138264842370630061369715394739134090922937332590384720397133335969549256322620979036686633213903952966175107096769180017646161851573147596390153":10:"1287616013607108878460259709922985398302772215068026865836146879048276529684741260122739430789478268181845874665180769440794266671939098512645241958073373266427807905932350214193538360035292323703146295192780306"
 
+Test mbedtls_mpi_add_mpi inplace #3 
+mbedtls_mpi_add_mpi_inplace:16:"ffffffffffffffffffffffffffffffff":16:"01fffffffffffffffffffffffffffffffe"
+
 Test mbedtls_mpi_add_int #1
 mbedtls_mpi_add_int:10:"2039568783564019774057658669290345772801939933143482630947726464532830627227012776329":9871232:10:"2039568783564019774057658669290345772801939933143482630947726464532830627227022647561"