From: Loganaden Velvindron <logan@cyberstorm.mu>
Date: Thu, 2 Jul 2026 05:13:45 +0000 (+0400)
Subject: ml_kem: Add a check for shared_secret
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=695eb4bd6488ea017fd35b32f70c7754aa81110a;p=thirdparty%2Fopenssl.git

ml_kem: Add a check for shared_secret

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
MergeDate: Mon Jul 20 11:21:15 2026
(Merged from https://github.com/openssl/openssl/pull/31822)
---

diff --git a/crypto/ml_kem/ml_kem.c b/crypto/ml_kem/ml_kem.c
index 27fa15e2465..89960dc105e 100644
--- a/crypto/ml_kem/ml_kem.c
+++ b/crypto/ml_kem/ml_kem.c
@@ -2032,11 +2032,13 @@ int ossl_ml_kem_decap(uint8_t *shared_secret, size_t slen,
 #endif
 
     /* Need a private key here */
-    if (!ossl_ml_kem_have_prvkey(key))
+    if (!ossl_ml_kem_have_prvkey(key)
+        || shared_secret == NULL
+        || slen < ML_KEM_SHARED_SECRET_BYTES)
         return 0;
     vinfo = key->vinfo;
 
-    if (shared_secret == NULL || slen != ML_KEM_SHARED_SECRET_BYTES
+    if (slen != ML_KEM_SHARED_SECRET_BYTES
         || ctext == NULL || clen != vinfo->ctext_bytes
         || (mdctx = EVP_MD_CTX_new()) == NULL) {
         (void)RAND_bytes_ex(key->libctx, shared_secret,