RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_OAEP_DECODING_ERROR);
goto decoding_err;
int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,	const unsigned char *from, int flen, int num,	const unsigned char *param, int plen)    {    int i, dblen, mlen = -1;    const unsigned char *maskeddb;    int lzero;    unsigned char *db = NULL, seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH];    if (--num < 2 * SHA_DIGEST_LENGTH + 1)	goto decoding_err;    lzero = num - flen;    if (lzero < 0)	goto decoding_err;    maskeddb = from - lzero + SHA_DIGEST_LENGTH;        dblen = num - SHA_DIGEST_LENGTH;    db = OPENSSL_malloc(dblen);    if (db == NULL)	{	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);	return (-1);	}    MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen);    for (i = lzero; i < SHA_DIGEST_LENGTH; i++)	seed[i] ^= from[i - lzero];      MGF1(db, dblen, seed, SHA_DIGEST_LENGTH);    for (i = 0; i < dblen; i++)	db[i] ^= maskeddb[i];    SHA1(param, plen, phash);    if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0)	goto decoding_err;    else	{	for (i = SHA_DIGEST_LENGTH; i < dblen; i++)	    if (db[i] != 0x00)		break;	if (db[i] != 0x01 || i++ >= dblen)	    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP,		   RSA_R_OAEP_DECODING_ERROR);	else	    {	    mlen = dblen - i;	    if (tlen < mlen)		{		RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE);		mlen = -1;		}	    else		memcpy(to, db + i, mlen);	    }	}    OPENSSL_free(db);    return (mlen);decoding_err:    /* to avoid chosen ciphertext attacks, the error message should not reveal     * which kind of decoding error happened */    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_OAEP_DECODING_ERROR);    if (db != NULL) OPENSSL_free(db);    return -1;    }