From 806a409df7cf2b07a39b3876fd36099579df126a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?John=20H=C3=B6gberg?= <john@erlang.org>
Date: Wed, 18 Jul 2018 10:23:51 +0200
Subject: crypto: Fix crash in compute_key(ecdh, ...) on badarg

When term2point was passed a non-binary argument, `my_ecpoint`
would be left uninitialized and the cleanup code would free a
garbage pointer.
---
 lib/crypto/c_src/crypto.c        |  2 +-
 lib/crypto/test/crypto_SUITE.erl | 17 ++++++++++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

(limited to 'lib/crypto')

diff --git a/lib/crypto/c_src/crypto.c b/lib/crypto/c_src/crypto.c
index 94a207cba6..6e855939f7 100644
--- a/lib/crypto/c_src/crypto.c
+++ b/lib/crypto/c_src/crypto.c
@@ -3757,7 +3757,7 @@ static ERL_NIF_TERM ecdh_compute_key_nif(ErlNifEnv* env, int argc, const ERL_NIF
     int i;
     EC_GROUP *group;
     const BIGNUM *priv_key;
-    EC_POINT *my_ecpoint;
+    EC_POINT *my_ecpoint = NULL;
     EC_KEY *other_ecdh = NULL;
 
     if (!get_ec_key(env, argv[1], argv[2], atom_undefined, &key))
diff --git a/lib/crypto/test/crypto_SUITE.erl b/lib/crypto/test/crypto_SUITE.erl
index 6dab459df6..c07e937737 100644
--- a/lib/crypto/test/crypto_SUITE.erl
+++ b/lib/crypto/test/crypto_SUITE.erl
@@ -31,6 +31,7 @@ suite() -> [{ct_hooks,[ts_install_cth]}].
 
 all() ->
     [app,
+     {group, api_errors},
      appup,
      {group, fips},
      {group, non_fips},
@@ -169,7 +170,8 @@ groups() ->
      {no_aes_ige256, [], [no_support, no_block]},
      {no_chacha20_poly1305, [], [no_support, no_aead]},
      {no_rc2_cbc, [], [no_support, no_block]},
-     {no_rc4, [], [no_support, no_stream]}
+     {no_rc4, [], [no_support, no_stream]},
+     {api_errors, [], [api_errors_ecdh]}
     ].
 
 %%-------------------------------------------------------------------
@@ -237,6 +239,8 @@ init_per_group(non_fips, Config) ->
         _NotEnabled ->
             NonFIPSConfig
     end;
+init_per_group(api_errors, Config) ->
+    Config;
 init_per_group(GroupName, Config) ->
     case atom_to_list(GroupName) of
         "no_" ++ TypeStr ->
@@ -2491,3 +2495,14 @@ parse_rsp_cmac(Type, Key0, Msg0, Mlen0, Tlen, MAC0, Next, Acc) ->
         I ->
             parse_rsp(Type, Next, [{Type, Key, Msg, I, MAC}|Acc])
     end.
+
+api_errors_ecdh(Config) when is_list(Config) ->
+    %% Check that we don't segfault when fed garbage.
+    Test = fun(Others, Curve) ->
+                   {_Pub, Priv} = crypto:generate_key(ecdh, Curve),
+                   crypto:compute_key(ecdh, Others, Priv, Curve)
+           end,
+    Others = [gurka, 0, <<0>>],
+    Curves = [gaffel, 0, sect571r1],
+    [_= (catch Test(O, C)) || O <- Others, C <- Curves],
+    ok.
-- 
cgit v1.2.3