There's a slight possibility that a is 0 in BN_sub_word(), and might

therefore have unallocated parts.  Therefore, a check for the 0 case
is needed, resulting with the same thing as when a is negative.

crypto/bn/bn_word.c

@@ -140,7 +140,7 @@ int BN_sub_word(BIGNUM *a, BN_ULONG w)
 	{
 	int i;
 
-	if (a->neg)
+	if (BN_is_zero(a) || a->neg)
 		{
 		a->neg=0;
 		i=BN_add_word(a,w);