diff --git a/src/ssl.c b/src/ssl.c index 33d70b416..9b08c35ed 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -35907,7 +35907,8 @@ int wolfSSL_BN_is_word(const WOLFSSL_BIGNUM* bn, WOLFSSL_BN_ULONG w) return WOLFSSL_FAILURE; } - if (w <= (WOLFSSL_BN_ULONG)MP_MASK) { + /* Check operand sizes before value check to avoid pointless comparison */ + if ((sizeof(w) <= sizeof(MP_MASK)) || (w <= (WOLFSSL_BN_ULONG)MP_MASK)) { if (mp_isword((mp_int*)bn->internal, (mp_digit)w) == MP_YES) { return WOLFSSL_SUCCESS; } @@ -36565,7 +36566,8 @@ static int wolfSSL_BN_add_word_int(WOLFSSL_BIGNUM *bn, WOLFSSL_BN_ULONG w, } if (ret == WOLFSSL_SUCCESS) { - if (w <= (WOLFSSL_BN_ULONG)MP_MASK) { + /* Check operand sizes before value check to avoid pointless comparison */ + if ((sizeof(w) <= sizeof(MP_MASK)) || (w <= (WOLFSSL_BN_ULONG)MP_MASK)) { if (sub == 1) { rc = mp_sub_d((mp_int*)bn->internal, (mp_digit)w, (mp_int*)bn->internal); @@ -36877,7 +36879,8 @@ WOLFSSL_BN_ULONG wolfSSL_BN_mod_word(const WOLFSSL_BIGNUM *bn, return (WOLFSSL_BN_ULONG)WOLFSSL_FATAL_ERROR; } - if (w <= (WOLFSSL_BN_ULONG)MP_MASK) { + /* Check operand sizes before value check to avoid pointless comparison */ + if ((sizeof(w) <= sizeof(MP_MASK)) || (w <= (WOLFSSL_BN_ULONG)MP_MASK)) { mp_digit bn_ret; if (mp_mod_d((mp_int*)bn->internal, (mp_digit)w, &bn_ret) != MP_OKAY) { WOLFSSL_MSG("mp_add_d error");