Fix a bug in bigint_sub_abs

If one of the values had leading zero words, this could end up
calling bigint_sub with x_size < y_size.

OSS-Fuzz 11664 and 11656

1 files changed, 7 insertions, 0 deletions

diff --git a/src/lib/math/mp/mp_core.h b/src/lib/math/mp/mp_core.h
index d01c13a5e..4c08a0a23 100644
--- a/src/lib/math/mp/mp_core.h
+++ b/src/lib/math/mp/mp_core.h
@@ -679,6 +679,13 @@ bigint_sub_abs(word z[],
       std::swap(x_size, y_size);
       }
 
+   /*
+   * We know at this point that x >= y so if y_size is larger than
+   * x_size, we are guaranteed they are just leading zeros which can
+   * be ignored
+   */
+   y_size = std::min(x_size, y_size);
+
    bigint_sub3(z, x, x_size, y, y_size);
 
    return relative_size;