fix: d2i_ECPrivateKey derives public key when absent from DER (ZD-21732)

[MarkAtwood]

Summary

RFC 5915 makes the publicKey [1] field optional in ECPrivateKey DER
encoding. When a caller imports a private-only DER (produced by OpenSSL,
mbedTLS, an HSM, or any other implementation that omits the field),
wc_EccPrivateKeyDecode sets type = ECC_PRIVATEKEY_ONLY and leaves
pubkey uninitialised. Every downstream operation — ECDSA sign, ECDH,
key export — then runs against uninitialised memory, producing wrong
output or a crash.

Fix: after wc_EccPrivateKeyDecode succeeds, check for
ECC_PRIVATEKEY_ONLY and call wc_ecc_make_pub(key, NULL) to derive
and cache the public point before SetECKeyExternal runs. This matches
OpenSSL's d2i_ECPrivateKey behaviour.

Relation to existing work

This is the root-cause fix for the same bug addressed at the symptom
level in #9987 ("evp: fix EVP_PKEY_cmp for EC keys after DER
deserialization"). That PR fixed EVP_PKEY_cmp specifically by deriving
the public key at comparison time; this PR fixes the import function
itself so all downstream operations work correctly without per-callsite
workarounds. Supersedes #9987.

Also reported as Zendesk support ticket #21732.

Test

New test test_d2i_ECPrivateKey_no_pubkey in tests/api/test_ossl_ec.c:

• Input: hardcoded RFC 5915 private-only P-256 DER (no publicKey field),
  test vector generated by pyca/cryptography and cross-checked with OpenSSL
• Checks EC_KEY_check_key passes (public point on curve, priv/pub consistent)
• Exports public key via i2o_ECPublicKey and byte-compares against
  oracle-computed expected value — independent of the code under test
• Exercises ECDSA sign + verify with the derived key

Full ./wolfcrypt/test/testwolfcrypt and ./tests/unit.test pass.

[Copilot]

Pull request overview

Fixes EC private-key import from RFC 5915 DER when the optional publicKey [1] field is omitted, aligning d2i_ECPrivateKey behavior with OpenSSL by deriving the public point after decode so downstream operations don’t operate on an unset/invalid public key.

Changes:

• Derive and cache the EC public key inside wolfSSL_d2i_ECPrivateKey when the decoded key is ECC_PRIVATEKEY_ONLY.
• Add a new OpenSSL-API test that imports a private-only RFC 5915 EC key and validates derived public key + ECDSA sign/verify.
• Register the new test in the ossl_ec test declarations.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/pk_ec.c	Derives the public point during d2i_ECPrivateKey import when absent in DER.
tests/api/test_ossl_ec.c	Adds coverage for importing private-only RFC 5915 EC keys and validating derived pubkey behavior.
tests/api/test_ossl_ec.h	Registers the new test in the ossl_ec test group.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10362

Scan targets checked: wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[dgarske]

Please see colpilot reviews. Also you have a note about this superseding #9987 So please make it clear which should be closed or needs to come first?

[MarkAtwood]

@dgarske Re: #9987 — the two PRs fix different bugs in the same area:

• evp: fix EVP_PKEY_cmp for EC keys after DER deserialization #9987 fixes EVP_PKEY_cmp returning "not equal" for identical EC keys after DER round-trip (missing public point export in the comparison path).
• fix: d2i_ECPrivateKey derives public key when absent from DER (ZD-21732) #10362 fixes d2i_ECPrivateKey not deriving the public point when the RFC 5915 DER omits the optional publicKey field, which causes downstream operations (sign, ECDH, export) to use uninitialised memory.

They're independent fixes — neither supersedes the other. Both should land. #10362 happens to make #9987's reproducer less likely to trigger (because the public point is now derived at import time), but #9987 fixes a separate comparison bug.

Copilot feedback addressed in ac0d692 — added #ifdef HAVE_ECC_MAKE_PUB guard so builds without it keep the historical import behaviour.

[MarkAtwood]

retest this please