lzero = num - flen; if (lzero < 0) goto decoding_err; maskeddb = from - lzero + SHA_DIGEST_LENGTH;  dblen = num - SHA_DIGEST_LENGTH; db = OPENSSL_malloc(dblen); if (db == NULL) { RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE); return (-1);
lzero = num - flen; if (lzero < 0) goto decoding_err; maskeddb = from - lzero + SHA_DIGEST_LENGTH;  dblen = num - SHA_DIGEST_LENGTH; db = OPENSSL_malloc(dblen); if (db == NULL) { RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE); return (-1); }  MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen); for (i = lzero; i < SHA_DIGEST_LENGTH; i++) seed[i] ^= from[i - lzero];  MGF1(db, dblen, seed, SHA_DIGEST_LENGTH); for (i = 0; i < dblen; i++) db[i] ^= maskeddb[i];  EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1());  if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0) goto decoding_err; else { for (i = SHA_DIGEST_LENGTH; i < dblen; i++) if (db[i] != 0x00) break; if (db[i] != 0x01 || i++ >= dblen) goto decoding_err; else { mlen = dblen - i; if (tlen < mlen) { RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE); mlen = -1; } else memcpy(to, db + i, mlen); } } OPENSSL_free(db); return mlen;  decoding_err:  RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_OAEP_DECODING_ERROR); if (db != NULL) OPENSSL_free(db); return -1;
int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,	const unsigned char *from, int flen, int num,	const unsigned char *param, int plen)    {    int i, dblen, mlen = -1;    const unsigned char *maskeddb;    int lzero;    unsigned char *db = NULL, seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH];    if (--num < 2 * SHA_DIGEST_LENGTH + 1)	goto decoding_err;    lzero = num - flen;    if (lzero < 0)	goto decoding_err;    maskeddb = from - lzero + SHA_DIGEST_LENGTH;        dblen = num - SHA_DIGEST_LENGTH;    db = OPENSSL_malloc(dblen);    if (db == NULL)	{	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);	return (-1);	}    MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen);    for (i = lzero; i < SHA_DIGEST_LENGTH; i++)	seed[i] ^= from[i - lzero];      MGF1(db, dblen, seed, SHA_DIGEST_LENGTH);    for (i = 0; i < dblen; i++)	db[i] ^= maskeddb[i];    EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1());    if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0)	goto decoding_err;    else	{	for (i = SHA_DIGEST_LENGTH; i < dblen; i++)	    if (db[i] != 0x00)		break;	if (db[i] != 0x01 || i++ >= dblen)	  goto decoding_err;	else	    {	    mlen = dblen - i;	    if (tlen < mlen)		{		RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE);		mlen = -1;		}	    else		memcpy(to, db + i, mlen);	    }	}    OPENSSL_free(db);    return (mlen);decoding_err:    /* to avoid chosen ciphertext attacks, the error message should not reveal     * which kind of decoding error happened */    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_OAEP_DECODING_ERROR);    if (db != NULL) OPENSSL_free(db);    return -1;    }