Fix EC_GROUP_new_from_ecparameters to check the base length

Check that there's at least one byte in params->base before trying to read it. CVE-2021-3712 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
openssl · Aug 24, 2021 · 94d23fc · 94d23fc · ayang05 · Dec 25, 2021
1 parent 2d0e5d4
commit 94d23fc
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c
@@ -761,7 +761,10 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params)
         ret->seed_len = params->curve->seed->length;
     }
 
-    if (!params->order || !params->base || !params->base->data) {
+    if (params->order == NULL
+            || params->base == NULL
+            || params->base->data == NULL
+            || params->base->length == 0) {
         ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, EC_R_ASN1_ERROR);
         goto err;
     }