fix: add NULL check before EVP_PKEY_check() in _new_key_from_parameters()

[toddr-bot]

What

Add missing NULL check on test_ctx before calling EVP_PKEY_check() in _new_key_from_parameters().

Why

EVP_PKEY_CTX_new_from_pkey() can return NULL on allocation failure. Without a guard, EVP_PKEY_check(NULL) is undefined behavior — potential segfault. The check_key() function at line 892 already handles this correctly via CHECK_OPEN_SSL(pctx); this applies the same pattern using THROW.

How

Single-line addition: THROW(test_ctx != NULL) between allocation and use. THROW sets the error flag and jumps to the err: cleanup label, consistent with the rest of the function.

Testing

Full test suite passes (318 tests, 10 files).

🤖 Generated with Claude Code

---

Quality Report

Changes: 1 file changed, 1 insertion(+)

Code scan: clean

Tests: passed (OK)

Branch hygiene: clean

Generated by Kōan post-mission quality pipeline

[Koan-Bot]

PR Review — fix: add NULL check before EVP_PKEY_check() in _new_key_from_parameters()

Clean, minimal fix. Adding THROW(test_ctx != NULL) before EVP_PKEY_check(test_ctx) prevents undefined behavior (potential segfault) if EVP_PKEY_CTX_new_from_pkey() returns NULL on allocation failure. The THROW macro (line 89) sets error = 1 and jumps to err: cleanup, which is consistent with the surrounding code. The EVP_PKEY_CTX_free(test_ctx) call on the next line is skipped on the error path, which is fine since test_ctx is NULL in that case (and EVP_PKEY_CTX_free(NULL) is a no-op anyway). Merge-ready.

---

---

Checklist

• No NULL dereference on allocation failure
• Cleanup on error path correct
• Consistent with existing patterns (THROW macro usage)

---

Summary

Clean, minimal fix. Adding THROW(test_ctx != NULL) before EVP_PKEY_check(test_ctx) prevents undefined behavior (potential segfault) if EVP_PKEY_CTX_new_from_pkey() returns NULL on allocation failure. The THROW macro (line 89) sets error = 1 and jumps to err: cleanup, which is consistent with the surrounding code. The EVP_PKEY_CTX_free(test_ctx) call on the next line is skipped on the error path, which is fine since test_ctx is NULL in that case (and EVP_PKEY_CTX_free(NULL) is a no-op anyway). Merge-ready.

---

Automated review by Kōan

[timlegge]

@toddr-bot rebase

[toddr-bot]

❌ Permission denied. Only users with write access can trigger bot commands.

[atoomic]

@toddr-bot rebase

[timlegge]

I think this can be closed. It looks to be taken care of already

[toddr-bot]

Rebase: fix: add NULL check before EVP_PKEY_check() in _new_key_from_parameters()

Branch koan.toddr.bot/fix-test-ctx-null-deref rebased onto main and force-pushed.

Review feedback was analyzed and applied.

Actions

• Resolved merge conflicts (4 round(s))
• Rebased koan.toddr.bot/fix-test-ctx-null-deref onto upstream/main
• Force-pushed koan.toddr.bot/fix-test-ctx-null-deref to origin
• CI passed

CI

CI passed.

---

Automated by Kōan