diff -up openssl-1.0.1e/crypto/bn/bn_print.c.bn-overflow openssl-1.0.1e/crypto/bn/bn_print.c

--- openssl-1.0.1e/crypto/bn/bn_print.c.bn-overflow	2016-09-20 14:55:57.000000000 +0200

+++ openssl-1.0.1e/crypto/bn/bn_print.c	2016-09-20 16:53:29.825854773 +0200

@@ -108,6 +108,7 @@ char *BN_bn2dec(const BIGNUM *a)

 	char *p;

 	BIGNUM *t=NULL;

 	BN_ULONG *bn_data=NULL,*lp;

+	int bn_data_num;

 	/* get an upper bound for the length of the decimal integer

 	 * num <= (BN_num_bits(a) + 1) * log(2)

@@ -116,7 +117,8 @@ char *BN_bn2dec(const BIGNUM *a)

 	 */

 	i=BN_num_bits(a)*3;

 	num=(i/10+i/1000+1)+1;

-	bn_data=(BN_ULONG *)OPENSSL_malloc((num/BN_DEC_NUM+1)*sizeof(BN_ULONG));

+	bn_data_num=num/BN_DEC_NUM + 1;

+	bn_data=(BN_ULONG *)OPENSSL_malloc(bn_data_num*sizeof(BN_ULONG));

 	buf=(char *)OPENSSL_malloc(num+3);

 	if ((buf == NULL) || (bn_data == NULL))

 		{

@@ -141,7 +143,11 @@ char *BN_bn2dec(const BIGNUM *a)

 		i=0;

 		while (!BN_is_zero(t))

 			{

+			if (lp - bn_data >= bn_data_num)

+				goto err;

 			*lp=BN_div_word(t,BN_DEC_CONV);

+			if (*lp == (BN_ULONG)-1)

+				goto err;

 			lp++;

 			}

 		lp--;