[openssl/openssl] ce6057: DH: harden empty fromdata

  Branch: refs/heads/openssl-3.0
  Home:   https://github.com/openssl/openssl
  Commit: ce605796d347715e5d2380d93b3d728488d68216
      https://github.com/openssl/openssl/commit/ce605796d347715e5d2380d93b3d728488d68216
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-07-23 (Thu, 23 Jul 2026)

  Changed paths:
    M crypto/dh/dh_check.c
    M test/endecode_test.c

  Log Message:
  -----------
  DH: harden empty fromdata

EVP_PKEY_fromdata for DH/DHX accepts an empty array and yields a
DH with NULL params.p / params.g.  Several DH check entry points
(DH_check, DH_check_params, DH_check_pub_key) then read
dh->params.p / .g via BN_num_bits or BN_is_odd before any NULL
check.  Add defensive guards at the top of each that report
failure via *ret without dereferencing NULL; the existing
return-1-with-flags contract is preserved.

A new test_fromdata in endecode_test drives every supported
keymgmt with an empty OSSL_PARAM[] for both EVP_PKEY_PUBLIC_KEY
and EVP_PKEY_KEYPAIR selections, and tests that any returned key
is sufficiently well behaved.

Add a parameterised dup sweep to test/endecode_test.c covering
every supported public-key algorithm in three shapes: full
keypair, public-only, and embryonic (parameters-only).

While here, stop endecode_test from silently passing when key
generation fails: setup_tests() now returns its accumulated
status, MAKE_*KEYS no longer short-circuits, and each
ADD_TEST_SUITE is now conditional on keygen success.  Guard the
explicit-EC-curve tests with OPENSSL_NO_EC_EXPLICIT_CURVES.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
MergeDate: Thu Jul 23 08:35:26 2026
(Merged from https://github.com/openssl/openssl/pull/31280)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.0/9976cf-ce6057%40github.com.