diff -up gnutls-3.1.11/lib/gnutls_ecc.c.suiteb gnutls-3.1.11/lib/gnutls_ecc.c

--- gnutls-3.1.11/lib/gnutls_ecc.c.suiteb	2013-04-27 10:04:48.000000000 +0200

+++ gnutls-3.1.11/lib/gnutls_ecc.c	2013-05-23 10:08:45.331883555 +0200

@@ -129,6 +129,12 @@ int ret;

       goto cleanup;

     }

   params->params_nr++;

+

+  if (_gnutls_mpi_get_nbits(params->params[ECC_PRIME]) < 256)

+    {

+      ret = gnutls_assert_val(GNUTLS_E_ECC_UNSUPPORTED_CURVE);

+      goto cleanup;

+    }

   val_size = sizeof(val);

   ret = _gnutls_hex2bin(st->order, strlen(st->order), val, &val_size);

diff -up gnutls-3.1.11/lib/nettle/ecc_mulmod_cached.c.suiteb gnutls-3.1.11/lib/nettle/ecc_mulmod_cached.c

--- gnutls-3.1.11/lib/nettle/ecc_mulmod_cached.c.suiteb	2013-04-27 10:04:48.000000000 +0200

+++ gnutls-3.1.11/lib/nettle/ecc_mulmod_cached.c	2013-05-23 10:24:56.575967312 +0200

@@ -42,6 +42,7 @@ typedef struct

 /* global cache */

 static gnutls_ecc_curve_cache_entry_t *ecc_wmnaf_cache = NULL;

+static gnutls_ecc_curve_cache_entry_t *ecc_wmnaf_cache_last = NULL;

 /* free single cache entry */

 static void

@@ -63,9 +64,10 @@ ecc_wmnaf_cache_free (void)

   gnutls_ecc_curve_cache_entry_t *p = ecc_wmnaf_cache;

   if (p)

     {

-      for (; p->id != GNUTLS_ECC_CURVE_INVALID; ++p)

+      for (; p <= ecc_wmnaf_cache_last; ++p)

         {

-          _ecc_wmnaf_cache_entry_free (p);

+          if (p->id != GNUTLS_ECC_CURVE_INVALID)

+            _ecc_wmnaf_cache_entry_free (p);

         }

       free (ecc_wmnaf_cache);

@@ -198,7 +200,7 @@ ecc_wmnaf_cache_init (void)

   const gnutls_ecc_curve_t *p;

   ret = (gnutls_ecc_curve_cache_entry_t *)

-    malloc (MAX_ALGOS * sizeof (gnutls_ecc_curve_cache_entry_t));

+    calloc (MAX_ALGOS, sizeof (gnutls_ecc_curve_cache_entry_t));

   if (ret == NULL)

     return GNUTLS_E_MEMORY_ERROR;

@@ -207,12 +209,16 @@ ecc_wmnaf_cache_init (void)

   for (j = 0; *p; ++p, ++j)

     {

-      if ((err = _ecc_wmnaf_cache_entry_init (ret + *p - 1, *p)) != 0)

+      gnutls_ecc_curve_cache_entry_t *entry;

+

+      entry = ret + *p - 1;

+      if ((err = _ecc_wmnaf_cache_entry_init (entry, *p)) != 0)

         goto done;

+      if (ecc_wmnaf_cache_last < entry)

+        ecc_wmnaf_cache_last = entry;

     }

-  /* nullify last cache entry id */

-  ret[j].id = GNUTLS_ECC_CURVE_INVALID;

+  /* no need to nullify last cache entry id, done by calloc */

   err = GNUTLS_E_SUCCESS;

@@ -223,7 +229,8 @@ done:

       int i;

       for (i = 0; i < j; ++i)

         {

-          _ecc_wmnaf_cache_entry_free (ret + i);

+          --p;

+          _ecc_wmnaf_cache_entry_free (ret + *p - 1);

         }

       free (ret);

@@ -445,9 +452,11 @@ ecc_mulmod_cached_lookup (mpz_t k, ecc_p

   if (k == NULL || G == NULL || R == NULL || modulus == NULL)

     return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;

-  for (i = 0; (id = ecc_wmnaf_cache[i].id); ++i)

+  for (i = 0; ecc_wmnaf_cache + i <= ecc_wmnaf_cache_last; ++i)

     {

-      if (!(mpz_cmp (G->x, ecc_wmnaf_cache[i].pos[0]->x)) &&

+      id = ecc_wmnaf_cache[i].id;

+      if (id &&

+          !(mpz_cmp (G->x, ecc_wmnaf_cache[i].pos[0]->x)) &&

           !(mpz_cmp (G->y, ecc_wmnaf_cache[i].pos[0]->y)))

         {

           break;

diff -up gnutls-3.1.11/tests/mini-xssl.c.suiteb gnutls-3.1.11/tests/mini-xssl.c

--- gnutls-3.1.11/tests/mini-xssl.c.suiteb	2013-05-10 10:10:27.000000000 +0200

+++ gnutls-3.1.11/tests/mini-xssl.c	2013-05-23 11:58:22.670298910 +0200

@@ -27,7 +27,8 @@

 #include <stdio.h>

 #include <stdlib.h>

-#if defined(_WIN32)

+/* uses unsupported curves */

+#if 1

 int main()

 {

diff -up gnutls-3.1.11/tests/pkcs12_simple.c.suiteb gnutls-3.1.11/tests/pkcs12_simple.c

--- gnutls-3.1.11/tests/pkcs12_simple.c.suiteb	2013-05-10 10:10:27.000000000 +0200

+++ gnutls-3.1.11/tests/pkcs12_simple.c	2013-05-23 11:57:59.776799848 +0200

@@ -50,6 +50,9 @@ doit (void)

   gnutls_x509_privkey_t pkey;

   int ret;

+  /* uses unsupported curves */

+  exit(77);

+

   ret = global_init ();

   if (ret < 0)

     fail ("global_init failed %d\n", ret);