diff -up openssl-1.0.1e/crypto/bn/bn.h.bn-hex openssl-1.0.1e/crypto/bn/bn.h
--- openssl-1.0.1e/crypto/bn/bn.h.bn-hex	2016-02-24 14:23:33.020233047 +0100
+++ openssl-1.0.1e/crypto/bn/bn.h	2016-02-24 14:23:06.078615397 +0100
@@ -129,6 +129,7 @@
 #ifndef OPENSSL_NO_FP_API
 #include <stdio.h> /* FILE */
 #endif
+#include <limits.h>
 #include <openssl/ossl_typ.h>
 #include <openssl/crypto.h>
 
@@ -640,7 +641,8 @@ const BIGNUM *BN_get0_nist_prime_521(voi
 
 /* library internal functions */
 
-#define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->dmax)?\
+#define bn_expand(a,bits) (bits > (INT_MAX - BN_BITS2 + 1)?\
+	NULL:(((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->dmax)?\
 	(a):bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2))
 #define bn_wexpand(a,words) (((words) <= (a)->dmax)?(a):bn_expand2((a),(words)))
 BIGNUM *bn_expand2(BIGNUM *a, int words);
diff -up openssl-1.0.1e/crypto/bn/bn_print.c.bn-hex openssl-1.0.1e/crypto/bn/bn_print.c
--- openssl-1.0.1e/crypto/bn/bn_print.c.bn-hex	2013-02-11 16:26:04.000000000 +0100
+++ openssl-1.0.1e/crypto/bn/bn_print.c	2016-02-24 14:15:21.215948376 +0100
@@ -58,6 +58,7 @@
 
 #include <stdio.h>
 #include <ctype.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/buffer.h>
 #include "bn_lcl.h"
@@ -180,8 +181,10 @@ int BN_hex2bn(BIGNUM **bn, const char *a
 
 	if (*a == '-') { neg=1; a++; }
 
-	for (i=0; isxdigit((unsigned char) a[i]); i++)
+	for (i=0; i <= (INT_MAX/4) && isxdigit((unsigned char) a[i]); i++)
 		;
+	if (i > INT_MAX/4)
+		goto err;
 
 	num=i+neg;
 	if (bn == NULL) return(num);
@@ -197,7 +200,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a
 		BN_zero(ret);
 		}
 
-	/* i is the number of hex digests; */
+	/* i is the number of hex digits */
 	if (bn_expand(ret,i*4) == NULL) goto err;
 
 	j=i; /* least significant 'hex' */
@@ -246,8 +249,10 @@ int BN_dec2bn(BIGNUM **bn, const char *a
 	if ((a == NULL) || (*a == '\0')) return(0);
 	if (*a == '-') { neg=1; a++; }
 
-	for (i=0; isdigit((unsigned char) a[i]); i++)
+	for (i=0; i <= (INT_MAX/4) && isdigit((unsigned char) a[i]); i++)
 		;
+	if (i > INT_MAX/4)
+		goto err;
 
 	num=i+neg;
 	if (bn == NULL) return(num);
@@ -264,7 +269,7 @@ int BN_dec2bn(BIGNUM **bn, const char *a
 		BN_zero(ret);
 		}
 
-	/* i is the number of digests, a bit of an over expand; */
+	/* i is the number of digits, a bit of an over expand */
 	if (bn_expand(ret,i*4) == NULL) goto err;
 
 	j=BN_DEC_NUM-(i%BN_DEC_NUM);