diff options
| author | Matt Caswell <matt@openssl.org> | 2021-08-19 12:24:17 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2021-08-24 13:19:00 +0100 |
| commit | 94d23fcff9b2a7a8368dfe52214d5c2569882c11 (patch) | |
| tree | 33a68840087a53dc026075e17c231eb59030405f /crypto/ec | |
| parent | 2d0e5d4a4a5d4332325b5e5cea492fad2be633e1 (diff) | |
Fix EC_GROUP_new_from_ecparameters to check the base length
Check that there's at least one byte in params->base before trying to
read it.
CVE-2021-3712
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Diffstat (limited to 'crypto/ec')
| -rw-r--r-- | crypto/ec/ec_asn1.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c index 7b7c75ce84..e497a25909 100644 --- a/crypto/ec/ec_asn1.c +++ b/crypto/ec/ec_asn1.c @@ -761,7 +761,10 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params) ret->seed_len = params->curve->seed->length; } - if (!params->order || !params->base || !params->base->data) { + if (params->order == NULL + || params->base == NULL + || params->base->data == NULL + || params->base->length == 0) { ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, EC_R_ASN1_ERROR); goto err; } |