Lack of nullptr check in src/crypto/crypto_ec.cc GroupOrderSize #56692

Version

20.18.0

Platform

any

Subsystem

crypto

What steps will reproduce the bug?

In function GroupOrderSize call of BignumPointer::New() can return nullptr pointer (yes its can raise error via ERR_raise).

After this ptr passed to EC_GROUP_get_order

But this function don't expect that second param can be NULL

After nullptr can be dereferenced here:

And in another places

How often does it reproduce? Is there a required condition?

If BignumPointer::New() return pointer that stores nullptr

What is the expected behavior? Why is that the expected behavior?

Check BignumPointer::New() for nullptr

What do you see instead?

Lack of nullptr check

Additional information

Additional information
Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reporter: Burkov Egor (eburkov@rvision.ru).

Organization: R-Vision (support@rvision.ru).