1 files changed, 44 insertions, 19 deletions

diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index 7982d23f06..30b2cf95b8 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.123 2025/03/24 13:07:04 jsing Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.131 2025/12/26 18:49:13 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -68,12 +68,12 @@
 
 #include <openssl/bn.h>
 #include <openssl/ec.h>
-#include <openssl/err.h>
 #include <openssl/objects.h>
 #include <openssl/opensslv.h>
 
 #include "bn_local.h"
 #include "ec_local.h"
+#include "err_local.h"
 
 EC_GROUP *
 EC_GROUP_new(const EC_METHOD *meth)
@@ -165,6 +165,10 @@ EC_GROUP_copy(EC_GROUP *dst, const EC_GROUP *src)
 
         dst->a_is_minus3 = src->a_is_minus3;
 
+        memcpy(&dst->fm, &src->fm, sizeof(src->fm));
+        memcpy(&dst->fe_a, &src->fe_a, sizeof(src->fe_a));
+        memcpy(&dst->fe_b, &src->fe_b, sizeof(src->fe_b));
+
         BN_MONT_CTX_free(dst->mont_ctx);
         dst->mont_ctx = NULL;
         if (src->mont_ctx != NULL) {
@@ -788,6 +792,16 @@ EC_GROUP_cmp(const EC_GROUP *group1, const EC_GROUP *group2, BN_CTX *ctx_in)
 }
 LCRYPTO_ALIAS(EC_GROUP_cmp);
 
+int
+ec_group_and_point_compatible(const EC_GROUP *group, const EC_POINT *point)
+{
+        if (group->meth != point->meth)
+                return 0;
+        if (group->nid == NID_undef || point->nid == NID_undef)
+                return 1;
+        return group->nid == point->nid;
+}
+
 EC_POINT *
 EC_POINT_new(const EC_GROUP *group)
 {
@@ -811,6 +825,7 @@ EC_POINT_new(const EC_GROUP *group)
                 goto err;
 
         point->meth = group->meth;
+        point->nid = group->nid;
 
         return point;
 
@@ -852,6 +867,8 @@ EC_POINT_copy(EC_POINT *dst, const EC_POINT *src)
         if (dst == src)
                 return 1;
 
+        dst->nid = src->nid;
+
         if (!bn_copy(dst->X, src->X))
                 return 0;
         if (!bn_copy(dst->Y, src->Y))
@@ -860,6 +877,10 @@ EC_POINT_copy(EC_POINT *dst, const EC_POINT *src)
                 return 0;
         dst->Z_is_one = src->Z_is_one;
 
+        memcpy(&dst->fe_x, &src->fe_x, sizeof(dst->fe_x));
+        memcpy(&dst->fe_y, &src->fe_y, sizeof(dst->fe_y));
+        memcpy(&dst->fe_z, &src->fe_z, sizeof(dst->fe_z));
+
         return 1;
 }
 LCRYPTO_ALIAS(EC_POINT_copy);
@@ -890,15 +911,11 @@ LCRYPTO_ALIAS(EC_POINT_dup);
 int
 EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
 {
-        if (group->meth != point->meth) {
+        if (!ec_group_and_point_compatible(group, point)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
         }
-
-        BN_zero(point->Z);
-        point->Z_is_one = 0;
-
-        return 1;
+        return group->meth->point_set_to_infinity(group, point);
 }
 LCRYPTO_ALIAS(EC_POINT_set_to_infinity);
 
@@ -918,7 +935,7 @@ EC_POINT_set_affine_coordinates(const EC_GROUP *group, EC_POINT *point,
                 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 goto err;
         }
-        if (group->meth != point->meth) {
+        if (!ec_group_and_point_compatible(group, point)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 goto err;
         }
@@ -969,7 +986,7 @@ EC_POINT_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
                 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 goto err;
         }
-        if (group->meth != point->meth) {
+        if (!ec_group_and_point_compatible(group, point)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 goto err;
         }
@@ -1119,8 +1136,9 @@ EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
                 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 goto err;
         }
-        if (group->meth != r->meth || group->meth != a->meth ||
-            group->meth != b->meth) {
+        if (!ec_group_and_point_compatible(group, r) ||
+            !ec_group_and_point_compatible(group, a) ||
+            !ec_group_and_point_compatible(group, b)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 goto err;
         }
@@ -1150,7 +1168,8 @@ EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
                 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 goto err;
         }
-        if (group->meth != r->meth || r->meth != a->meth) {
+        if (!ec_group_and_point_compatible(group, r) ||
+            !ec_group_and_point_compatible(group, a)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 goto err;
         }
@@ -1179,7 +1198,7 @@ EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx_in)
                 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 goto err;
         }
-        if (group->meth != a->meth) {
+        if (!ec_group_and_point_compatible(group, a)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 goto err;
         }
@@ -1196,12 +1215,11 @@ LCRYPTO_ALIAS(EC_POINT_invert);
 int
 EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
 {
-        if (group->meth != point->meth) {
+        if (!ec_group_and_point_compatible(group, point)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
         }
-
-        return BN_is_zero(point->Z);
+        return group->meth->point_is_at_infinity(group, point);
 }
 LCRYPTO_ALIAS(EC_POINT_is_at_infinity);
 
@@ -1221,7 +1239,7 @@ EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
                 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 goto err;
         }
-        if (group->meth != point->meth) {
+        if (!ec_group_and_point_compatible(group, point)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 goto err;
         }
@@ -1251,7 +1269,8 @@ EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
                 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 goto err;
         }
-        if (group->meth != a->meth || a->meth != b->meth) {
+        if (!ec_group_and_point_compatible(group, a) ||
+            !ec_group_and_point_compatible(group, b)) {
                 ECerror(EC_R_INCOMPATIBLE_OBJECTS);
                 goto err;
         }
@@ -1324,6 +1343,12 @@ EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
                 goto err;
         }
 
+        if (!ec_group_and_point_compatible(group, r) ||
+            (point != NULL && !ec_group_and_point_compatible(group, point))) {
+                ECerror(EC_R_INCOMPATIBLE_OBJECTS);
+                goto err;
+        }
+
         if (g_scalar != NULL && point == NULL && p_scalar == NULL) {
                 /*
                  * In this case we want to compute g_scalar * GeneratorPoint: