Description
Version
20.18.0
Platform
any
Subsystem
crypto
What steps will reproduce the bug?
In function GroupOrderSize
call of BignumPointer::New()
can return nullptr pointer (yes its can raise error via ERR_raise
).
Line 939 in bf59539
After this ptr passed to EC_GROUP_get_order
Line 940 in bf59539
But this function don't expect that second param can be NULL
node/deps/openssl/openssl/crypto/ec/ec_lib.c
Line 443 in bf59539
After nullptr can be dereferenced here:
node/deps/openssl/openssl/crypto/bn/bn_lib.c
Line 1062 in bf59539
And in another places
How often does it reproduce? Is there a required condition?
If BignumPointer::New()
return pointer that stores nullptr
What is the expected behavior? Why is that the expected behavior?
Check BignumPointer::New()
for nullptr
What do you see instead?
Lack of nullptr check
Additional information
Additional information
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Reporter: Burkov Egor ([email protected]).
Organization: R-Vision ([email protected]).