Commit a957a4bfc0 for openssl.org

commit a957a4bfc0b9691b20c9036b6ecc110f89f8d15c
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Wed Nov 4 19:36:16 2026 +0100

    crypto/ec/ec_key.c: Reject invalid group order during key generation

    An EC group with order 1 provides no valid private key value.  Passing
    this empty range to BN_priv_rand_range_ex() causes key generation
    to loop indefinitely.

    Reject the invalid effective order in the EC key-generation path,
    preserving EC_GROUP_set_generator() compatibility.  Add a regression
    test covering this boundary.

    Fixes: CVE-2026-107496
    Resolves: https://github.com/openssl/openssl/issues/33497
    Assisted-by: Codex:gpt-5.6-cyber
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Sat Nov  7 15:58:07 2026
    Merged-from: https://github.com/openssl/openssl/pull/33554

diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index d8640a4bca..6e53f245a8 100644
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -276,6 +276,11 @@ static int ec_generate_key(EC_KEY *eckey, int pairwise_test)
             goto err;
     }

+    if (BN_cmp(order, BN_value_one()) <= 0) {
+        ERR_raise(ERR_LIB_EC, EC_R_INVALID_GROUP_ORDER);
+        goto err;
+    }
+
     do
         if (!BN_priv_rand_range_ex(priv_key, order, 0, ctx))
             goto err;
diff --git a/test/ectest.c b/test/ectest.c
index beafd50099..8a138602ca 100644
--- a/test/ectest.c
+++ b/test/ectest.c
@@ -2379,6 +2379,38 @@ err:
     return ret;
 }

+static int keygen_invalid_order_test(void)
+{
+    int ret = 0;
+    EC_GROUP *group = NULL;
+    EC_POINT *generator = NULL;
+    EC_KEY *key = NULL;
+    BIGNUM *order = NULL;
+
+    if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1))
+        || !TEST_ptr(generator = EC_POINT_dup(
+                         EC_GROUP_get0_generator(group), group))
+        || !TEST_ptr(order = BN_new())
+        || !TEST_true(BN_one(order))
+        || !TEST_true(EC_GROUP_set_generator(group, generator, order,
+            BN_value_one()))
+        || !TEST_ptr(key = EC_KEY_new())
+        || !TEST_true(EC_KEY_set_group(key, group))
+        || !TEST_false(EC_KEY_generate_key(key))
+        || !TEST_int_eq(ERR_GET_REASON(ERR_peek_last_error()),
+            EC_R_INVALID_GROUP_ORDER))
+        goto err;
+
+    ret = 1;
+err:
+    ERR_clear_error();
+    BN_free(order);
+    EC_KEY_free(key);
+    EC_POINT_free(generator);
+    EC_GROUP_free(group);
+    return ret;
+}
+
 /*
  * Helper for ec_point_hex2point_test
  *
@@ -3203,6 +3235,7 @@ int setup_tests(void)
     ADD_ALL_TESTS(check_named_curve_test, (int)crv_len);
     ADD_ALL_TESTS(check_named_curve_lookup_test, (int)crv_len);
     ADD_ALL_TESTS(check_ec_key_field_public_range_test, (int)crv_len);
+    ADD_TEST(keygen_invalid_order_test);
     ADD_ALL_TESTS(check_named_curve_from_ecparameters, (int)crv_len);
     ADD_ALL_TESTS(ec_point_hex2point_test, (int)crv_len);
     ADD_ALL_TESTS(custom_generator_test, (int)crv_len);