/* Provenance: openssl/openssl rsa_blinding_invert (fixed).
 * repo: openssl/openssl
 * commit: a00d757d9ca212994625d1a02c81cc5edd27e13b
 * parent: 908eaceb62624f5b5c505b286d904bd3a4e8a64a
 * commit_url: https://github.com/openssl/openssl/commit/a00d757d9ca212994625d1a02c81cc5edd27e13b
 * cve: CVE-2022-4304
 * license: Apache-2.0
 * function: rsa_blinding_invert
 * relpath: crypto/rsa/rsa_ossl.c
 */

static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
                               BN_CTX *ctx)
{
    /*
     * For local blinding, unblind is set to NULL, and BN_BLINDING_invert_ex
     * will use the unblinding factor stored in BN_BLINDING. If BN_BLINDING
     * is shared between threads, unblind must be non-null:
     * BN_BLINDING_invert_ex will then use the local unblinding factor, and
     * will only read the modulus from BN_BLINDING. In both cases it's safe
     * to access the blinding without a lock.
     */
    BN_set_flags(f, BN_FLG_CONSTTIME);
    return BN_BLINDING_invert_ex(f, unblind, b, ctx);
}