math/big: fix shift for recursive division

The previous s value could cause a crash
for certain inputs.

Will check in tests and documentation improvements later.

Thanks to the Go Ethereum team and the OSS-Fuzz project for reporting this.
Thanks to Rémy Oudompheng and Robert Griesemer for their help
developing and validating the fix.

Fixes CVE-2020-28362

Change-Id: Ibbf455c4436bcdb07c84a34fa6551fb3422356d3
Reviewed-by: Roland Shoemaker <>
Reviewed-by: Filippo Valsorda <>
Trust: Katie Hockman <>
Trust: Roland Shoemaker <>
Run-TryBot: Katie Hockman <>
Reviewed-by: Roland Shoemaker <>
TryBot-Result: Go Bot <>
diff --git a/src/math/big/nat.go b/src/math/big/nat.go
index c2f3787..068176e 100644
--- a/src/math/big/nat.go
+++ b/src/math/big/nat.go
@@ -929,7 +929,7 @@
 	// Now u < (v<<B), compute lower bits in the same way.
 	// Choose shift = B-1 again.
-	s := B
+	s := B - 1
 	qhat := *temps[depth]
 	qhat.divRecursiveStep(u[s:].norm(), v[s:], depth+1, tmp, temps)