Check size passed to mp_init_size() 1..SP_INT_DIGITS. More checks of parameters to SP int functions to ensure result is big enough to hold value calculated.
Check size passed to mp_init_size() 1..SP_INT_DIGITS. More checks of parameters to SP int functions to ensure result is big enough to hold value calculated.