From 97de6145851922a33f7afd9c308adfc1b2e5732b Mon Sep 17 00:00:00 2001 From: Bernd Edlinger Date: Sat, 21 May 2022 08:03:14 +0200 Subject: [PATCH] Fix undefined behaviour in EC_GROUP_new_from_ecparameters This happens for instance with fuzz/corpora/asn1/65cf44e85614c62f10cf3b7a7184c26293a19e4a and causes the OPENSSL_malloc below to choke on the zero length allocation request. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/18365) --- crypto/ec/ec_asn1.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c index 6323131a22b..60550c75395 100644 --- a/crypto/ec/ec_asn1.c +++ b/crypto/ec/ec_asn1.c @@ -687,6 +687,16 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params) /* extract seed (optional) */ if (params->curve->seed != NULL) { + /* + * This happens for instance with + * fuzz/corpora/asn1/65cf44e85614c62f10cf3b7a7184c26293a19e4a + * and causes the OPENSSL_malloc below to choke on the + * zero length allocation request. + */ + if (params->curve->seed->length == 0) { + ERR_raise(ERR_LIB_EC, EC_R_ASN1_ERROR); + goto err; + } OPENSSL_free(ret->seed); if ((ret->seed = OPENSSL_malloc(params->curve->seed->length)) == NULL) { ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); -- 2.47.2