Handle BN_CTX at the EC API boundary.

The EC API allows callers to optionally pass in a BN_CTX, which means that
any code needing a BN_CTX has to check if one was provided, allocate one if
not, then free it again. Rather than doing this dance throughout the EC
code, handle the BN_CTX existance at the EC API boundary. This means that
lower level implementation code can simply assume that the BN_CTX is
available.

ok tb@

1 files changed, 17 insertions, 14 deletions

diff --git a/src/lib/libcrypto/ec/ec_check.c b/src/lib/libcrypto/ec/ec_check.c
index 5c6165e129..4e065c739a 100644
--- a/src/lib/libcrypto/ec/ec_check.c
+++ b/src/lib/libcrypto/ec/ec_check.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_check.c,v 1.12 2022/11/26 16:08:52 tb Exp $ */
+/* $OpenBSD: ec_check.c,v 1.13 2023/04/11 18:58:20 jsing Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
  *
@@ -57,21 +57,20 @@
 #include <openssl/err.h>
 
 int
-EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
+EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx_in)
 {
-        int ret = 0;
+        BN_CTX *ctx;
         BIGNUM *order;
-        BN_CTX *new_ctx = NULL;
         EC_POINT *point = NULL;
+        int ret = 0;
+
+        if ((ctx = ctx_in) == NULL)
+                ctx = BN_CTX_new();
+        if (ctx == NULL)
+                goto err;
 
-        if (ctx == NULL) {
-                ctx = new_ctx = BN_CTX_new();
-                if (ctx == NULL) {
-                        ECerror(ERR_R_MALLOC_FAILURE);
-                        goto err;
-                }
-        }
         BN_CTX_start(ctx);
+
         if ((order = BN_CTX_get(ctx)) == NULL)
                 goto err;
 
@@ -104,12 +103,16 @@ EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
                 ECerror(EC_R_INVALID_GROUP_ORDER);
                 goto err;
         }
+
         ret = 1;
 
  err:
-        if (ctx != NULL)
-                BN_CTX_end(ctx);
-        BN_CTX_free(new_ctx);
+        BN_CTX_end(ctx);
+
+        if (ctx != ctx_in)
+                BN_CTX_free(ctx);
+
         EC_POINT_free(point);
+
         return ret;
 }