From 2aa2beb06cc25c1f8accdc3d87b946205becfd86 Mon Sep 17 00:00:00 2001 From: Todd Short Date: Mon, 4 Feb 2019 16:04:11 -0500 Subject: [PATCH] Fix d2i_PublicKey() for EC keys o2i_ECPublicKey() requires an EC_KEY structure filled with an EC_GROUP. o2i_ECPublicKey() is called by d2i_PublicKey(). In order to fulfill the o2i_ECPublicKey()'s requirement, d2i_PublicKey() needs to be called with an EVP_PKEY with an EC_KEY containing an EC_GROUP. However, the call to EVP_PKEY_set_type() frees any existing key structure inside the EVP_PKEY, thus freeing the EC_KEY with the EC_GROUP that o2i_ECPublicKey() needs. This means you can't d2i_PublicKey() for an EC key... The fix is to check to see if the type is already set appropriately, and if so, not call EVP_PKEY_set_type(). Reviewed-by: Paul Yang Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/8168) --- crypto/asn1/d2i_pu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/asn1/d2i_pu.c b/crypto/asn1/d2i_pu.c index 73093a6133..8876878fd0 100644 --- a/crypto/asn1/d2i_pu.c +++ b/crypto/asn1/d2i_pu.c @@ -32,7 +32,7 @@ EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp, } else ret = *a; - if (!EVP_PKEY_set_type(ret, type)) { + if (type != EVP_PKEY_id(ret) && !EVP_PKEY_set_type(ret, type)) { ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_EVP_LIB); goto err; } -- 2.34.1