From 89dac98b95c86599d37709d0934572115ecde46b Mon Sep 17 00:00:00 2001 From: Lealem Amedie Date: Mon, 6 Apr 2026 12:28:28 -0600 Subject: [PATCH] fix d2iTryAltDhKey short-circuiting the d2i probe chain When wc_DhKeyDecode() rejected the input, d2iTryAltDhKey() returned 0 after freeing the DH object. d2i_evp_pkey_try() treats any value >= 0 as success, so a non-DH input would stop the probe chain at the DH step and never reach the Falcon, Dilithium, Ed25519, or Ed448 probes that follow. d2i_PUBKEY()/d2i_PrivateKey() consequently returned NULL for any key type past DH in the chain. --- wolfcrypt/src/evp_pk.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/wolfcrypt/src/evp_pk.c b/wolfcrypt/src/evp_pk.c index bf0b3cf6af..51fffc6be8 100644 --- a/wolfcrypt/src/evp_pk.c +++ b/wolfcrypt/src/evp_pk.c @@ -404,24 +404,23 @@ static int d2iTryAltDhKey(WOLFSSL_EVP_PKEY** out, const unsigned char* mem, key = (DhKey*)dhObj->internal; /* Try decoding data as a DH public key. */ if (wc_DhKeyDecode(mem, &keyIdx, key, (word32)memSz) != 0) { - ret = 0; + wolfSSL_DH_free(dhObj); + return WOLFSSL_FATAL_ERROR; } - if (ret == 1) { - /* DH key has data and is external to DH object. */ - elements = ELEMENT_P | ELEMENT_G | ELEMENT_Q | ELEMENT_PUB; - if (priv) { - elements |= ELEMENT_PRV; - } - if (SetDhExternal_ex(dhObj, elements) != WOLFSSL_SUCCESS ) { - ret = 0; - } + /* DH key has data and is external to DH object. */ + elements = ELEMENT_P | ELEMENT_G | ELEMENT_Q | ELEMENT_PUB; + if (priv) { + elements |= ELEMENT_PRV; + } + if (SetDhExternal_ex(dhObj, elements) != WOLFSSL_SUCCESS ) { + ret = 0; } if (ret == 1) { /* Create an EVP PKEY object. */ ret = d2i_make_pkey(out, mem, keyIdx, priv, WC_EVP_PKEY_DH); } if (ret == 1) { - /* Put RSA key object into EVP PKEY object. */ + /* Put DH key object into EVP PKEY object. */ (*out)->ownDh = 1; (*out)->dh = dhObj; }