Commit 05103ee62c for openssl.org
commit 05103ee62c17dfe7de61af2ec91130527643678a
Author: Neil Horman <nhorman@openssl.org>
Date: Tue Aug 11 07:59:18 2026 -0400
Test EVP_PKEY_get_size for zero return
The test_rsasve_degenerate_ciphertext calls EVP_PKEY_get_size and uses
that returned value as an array index (offset by -1), but fails to check
if the returned size is greater than zero (which can be returned in an
error case), leading to an array index underflow.
Ensure that the returned value is greater than zero
Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1699973
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Aug 13 11:54:49 2026
(Merged from https://github.com/openssl/openssl/pull/32309)
diff --git a/test/evp_extra_test.c b/test/evp_extra_test.c
index 177eef4b18..e810c65612 100644
--- a/test/evp_extra_test.c
+++ b/test/evp_extra_test.c
@@ -8920,6 +8920,8 @@ static int test_rsasve_degenerate_ciphertext(int idx)
goto err;
ctlen = secretlen = (size_t)EVP_PKEY_get_size(rsakey);
+ if (!TEST_size_t_gt(ctlen, 0))
+ goto err;
if (!TEST_ptr(ct = OPENSSL_zalloc(ctlen))
|| !TEST_ptr(secret = OPENSSL_malloc(secretlen)))
goto err;