X-Git-Url: https://www.bearssl.org/gitweb//home/git/?p=BearSSL;a=blobdiff_plain;f=src%2Fint%2Fi15_mulacc.c;h=7a073ac67f950d58875189ed0206523af8869c35;hp=7bde395df7e96ec7a450321515109b050d69eace;hb=001d094d140488def90cb3876d5c03f4d79b3e27;hpb=2f454aad577ae53798935cc32438a2d3f02ba31f

diff --git a/src/int/i15_mulacc.c b/src/int/i15_mulacc.c
index 7bde395..7a073ac 100644
--- a/src/int/i15_mulacc.c
+++ b/src/int/i15_mulacc.c
@@ -29,10 +29,19 @@ void
 br_i15_mulacc(uint16_t *d, const uint16_t *a, const uint16_t *b)
 {
 	size_t alen, blen, u;
+	unsigned dl, dh;
 
 	alen = (a[0] + 15) >> 4;
 	blen = (b[0] + 15) >> 4;
-	d[0] = a[0] + b[0];
+
+	/*
+	 * Announced bit length of d[] will be the sum of the announced
+	 * bit lengths of a[] and b[]; but the lengths are encoded.
+	 */
+	dl = (a[0] & 15) + (b[0] & 15);
+	dh = (a[0] >> 4) + (b[0] >> 4);
+	d[0] = (dh << 4) + dl + (~(uint32_t)(dl - 15) >> 31);
+
 	for (u = 0; u < blen; u ++) {
 		uint32_t f;
 		size_t v;