From: Eugene Syromiatnikov Date: Wed, 25 Mar 2026 11:45:27 +0000 (+0100) Subject: ikev2kdf.c: expand missing secret check in kdf_ikev2kdf_derive() X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=46f75c732be478d7b0172437bbc68cc0d2945639;p=thirdparty%2Fopenssl.git ikev2kdf.c: expand missing secret check in kdf_ikev2kdf_derive() The seemingly impossible (and erroneous) case of (secret == NULL && secret_len != 0) is not accounted for in sanity checks, which provoked Coverity to report potential NULL dereference in ikev2_check_secret_and_pad() afterwards. Placate it by expanding the check to cover that improbable situation and echo the seedkey check from the previous case. Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1690439 Complements: 0dd1c50fc070 "Add IKEV2KDF implementation" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Paul Dale MergeDate: Tue Mar 31 00:33:22 2026 (Merged from https://github.com/openssl/openssl/pull/30566) --- diff --git a/providers/implementations/kdfs/ikev2kdf.c b/providers/implementations/kdfs/ikev2kdf.c index 377a70fb186..538704f2041 100644 --- a/providers/implementations/kdfs/ikev2kdf.c +++ b/providers/implementations/kdfs/ikev2kdf.c @@ -357,7 +357,8 @@ static int kdf_ikev2kdf_derive(void *vctx, unsigned char *key, size_t keylen, return 0; } /* If Child_DH is intended, require secret_len > 0 */ - if (ctx->secret != NULL && ctx->secret_len == 0) { + if ((ctx->secret != NULL && ctx->secret_len == 0) + || (ctx->secret == NULL && ctx->secret_len != 0)) { ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SECRET); return 0; }