Commit f8c26111ba for openssl.org

commit f8c26111bab30399d0c9262269089639ff8e4746
Author: Kurt Roeckx <kurt@roeckx.be>
Date:   Tue Jul 14 19:20:21 2026 +0200

    Add value_barrier in MOD_EXP_CTIME_COPY_FROM_PREBUF

    Without it, compilers can figure out the possible values and optimize
    based on it.

    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    MergeDate: Wed Jul 29 17:04:46 2026
    (Merged from https://github.com/openssl/openssl/pull/31957)

diff --git a/crypto/bn/bn_exp.c b/crypto/bn/bn_exp.c
index c3bd5e7b5d..dfe19447c4 100644
--- a/crypto/bn/bn_exp.c
+++ b/crypto/bn/bn_exp.c
@@ -573,8 +573,9 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
             BN_ULONG acc = 0;

             for (j = 0; j < xstride; j++) {
-                acc |= ((table[j + 0 * xstride] & y0) | (table[j + 1 * xstride] & y1) | (table[j + 2 * xstride] & y2) | (table[j + 3 * xstride] & y3))
-                    & ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
+                acc |= ((table[j + 0 * xstride] & value_barrier_bn(y0)) | (table[j + 1 * xstride] & value_barrier_bn(y1))
+                           | (table[j + 2 * xstride] & value_barrier_bn(y2)) | (table[j + 3 * xstride] & value_barrier_bn(y3)))
+                    & value_barrier_bn((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
             }

             b->d[i] = acc;