1 files changed, 21 insertions, 13 deletions

diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index 315a8130cf..36f42ecc05 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.121 2025/03/09 15:42:19 tb Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.126 2025/08/02 15:47:27 jsing Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -68,12 +68,12 @@
 
 #include <openssl/bn.h>
 #include <openssl/ec.h>
-#include <openssl/err.h>
 #include <openssl/objects.h>
 #include <openssl/opensslv.h>
 
 #include "bn_local.h"
 #include "ec_local.h"
+#include "err_local.h"
 
 EC_GROUP *
 EC_GROUP_new(const EC_METHOD *meth)
@@ -165,6 +165,10 @@ EC_GROUP_copy(EC_GROUP *dst, const EC_GROUP *src)
 
         dst->a_is_minus3 = src->a_is_minus3;
 
+        memcpy(&dst->fm, &src->fm, sizeof(src->fm));
+        memcpy(&dst->fe_a, &src->fe_a, sizeof(src->fe_a));
+        memcpy(&dst->fe_b, &src->fe_b, sizeof(src->fe_b));
+
         BN_MONT_CTX_free(dst->mont_ctx);
         dst->mont_ctx = NULL;
         if (src->mont_ctx != NULL) {
@@ -860,6 +864,10 @@ EC_POINT_copy(EC_POINT *dst, const EC_POINT *src)
                 return 0;
         dst->Z_is_one = src->Z_is_one;
 
+        memcpy(&dst->fe_x, &src->fe_x, sizeof(dst->fe_x));
+        memcpy(&dst->fe_y, &src->fe_y, sizeof(dst->fe_y));
+        memcpy(&dst->fe_z, &src->fe_z, sizeof(dst->fe_z));
+
         return 1;
 }
 LCRYPTO_ALIAS(EC_POINT_copy);
@@ -894,11 +902,7 @@ EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
         }
-
-        BN_zero(point->Z);
-        point->Z_is_one = 0;
-
-        return 1;
+        return point->meth->point_set_to_infinity(group, point);
 }
 LCRYPTO_ALIAS(EC_POINT_set_to_infinity);
 
@@ -1200,8 +1204,7 @@ EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
         }
-
-        return BN_is_zero(point->Z);
+        return point->meth->point_is_at_infinity(group, point);
 }
 LCRYPTO_ALIAS(EC_POINT_is_at_infinity);
 
@@ -1319,6 +1322,11 @@ EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
                 goto err;
         }
 
+        if (g_scalar != NULL && group->generator == NULL) {
+                ECerror(EC_R_UNDEFINED_GENERATOR);
+                goto err;
+        }
+
         if (g_scalar != NULL && point == NULL && p_scalar == NULL) {
                 /*
                  * In this case we want to compute g_scalar * GeneratorPoint:
@@ -1328,8 +1336,8 @@ EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
                  * secret. This is why we ignore if BN_FLG_CONSTTIME is actually
                  * set and we always call the constant time version.
                  */
-                ret = group->meth->mul_single_ct(group, r, g_scalar,
-                    group->generator, ctx);
+                ret = group->meth->mul_single_ct(group, r,
+                    g_scalar, group->generator, ctx);
         } else if (g_scalar == NULL && point != NULL && p_scalar != NULL) {
                 /*
                  * In this case we want to compute p_scalar * GenericPoint:
@@ -1347,8 +1355,8 @@ EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
                  * this codepath is reached most prominently by ECDSA signature
                  * verification. So we call the non-ct version.
                  */
-                ret = group->meth->mul_double_nonct(group, r, g_scalar,
-                    p_scalar, point, ctx);
+                ret = group->meth->mul_double_nonct(group, r,
+                    g_scalar, group->generator, p_scalar, point, ctx);
         } else {
                 /* Anything else is an error. */
                 ECerror(ERR_R_EC_LIB);