From 23380829ee38bf67638fa510aebf161b5cc21015 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Wed, 17 Apr 2024 08:24:11 +0000
Subject: Avoid NULL dereference in EVP_PKEY_paramgen()

If EVP_PKEY_new() returns NULL, it would be passed to the paramgen() pmeth
which would typically dereference it. This is identical to a recent change
in keygen().

ok jsing
---
 src/lib/libcrypto/evp/pmeth_gn.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/lib/libcrypto/evp/pmeth_gn.c b/src/lib/libcrypto/evp/pmeth_gn.c
index b8b51ced3d..1c355e594a 100644
--- a/src/lib/libcrypto/evp/pmeth_gn.c
+++ b/src/lib/libcrypto/evp/pmeth_gn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pmeth_gn.c,v 1.18 2024/04/12 09:41:39 tb Exp $ */
+/* $OpenBSD: pmeth_gn.c,v 1.19 2024/04/17 08:24:11 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -87,7 +87,7 @@ EVP_PKEY_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
 {
 	int ret;
 
-	if (!ctx || !ctx->pmeth || !ctx->pmeth->paramgen) {
+	if (ctx == NULL || ctx->pmeth == NULL || ctx->pmeth->paramgen == NULL) {
 		EVPerror(EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 		return -2;
 	}
@@ -97,17 +97,19 @@ EVP_PKEY_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
 		return -1;
 	}
 
-	if (!ppkey)
+	if (ppkey == NULL)
 		return -1;
 
-	if (!*ppkey)
+	if (*ppkey == NULL)
 		*ppkey = EVP_PKEY_new();
+	if (*ppkey == NULL)
+		return -1;
 
-	ret = ctx->pmeth->paramgen(ctx, *ppkey);
-	if (ret <= 0) {
+	if ((ret = ctx->pmeth->paramgen(ctx, *ppkey)) <= 0) {
 		EVP_PKEY_free(*ppkey);
 		*ppkey = NULL;
 	}
+
 	return ret;
 }
 LCRYPTO_ALIAS(EVP_PKEY_paramgen);
-- 
cgit v1.2.3-55-g6feb