From e0137ca92b4abf65acde15b255ae58d7e76af22f Mon Sep 17 00:00:00 2001 From: Nicola Tuveri Date: Mon, 29 Jun 2020 00:53:46 +0300 Subject: [EC][ASN1] Detect missing OID when serializing EC parameters and keys The following built-in curves do not have an assigned OID: - Oakley-EC2N-3 - Oakley-EC2N-4 In general we shouldn't assume that an OID is always available. This commit detects such cases, raises an error and returns appropriate return values so that the condition can be detected and correctly handled by the callers, when serializing EC parameters or EC keys with the default `ec_param_enc:named_curve`. Fixes #12306 Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/12313) --- crypto/ec/ec_ameth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'crypto/ec/ec_ameth.c') diff --git a/crypto/ec/ec_ameth.c b/crypto/ec/ec_ameth.c index 761f697850..8a33b3232c 100644 --- a/crypto/ec/ec_ameth.c +++ b/crypto/ec/ec_ameth.c @@ -43,7 +43,14 @@ static int eckey_param2type(int *pptype, void **ppval, const EC_KEY *ec_key) && (nid = EC_GROUP_get_curve_name(group))) /* we have a 'named curve' => just set the OID */ { - *ppval = OBJ_nid2obj(nid); + ASN1_OBJECT *asn1obj = OBJ_nid2obj(nid); + + if (asn1obj == NULL || OBJ_length(asn1obj) == 0) { + ASN1_OBJECT_free(asn1obj); + ECerr(EC_F_ECKEY_PARAM2TYPE, EC_R_MISSING_OID); + return 0; + } + *ppval = asn1obj; *pptype = V_ASN1_OBJECT; } else { /* explicit parameters */ -- cgit v1.2.3