Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL
What the developer wrote
Authored by Sebastian Falbesoner
Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL
What changed, and why it matters
This commit adds safety checks to several Bitcoin libsecp256k1 functions that accept arrays of pointers. Previously, if a caller passed an array containing a NULL (empty) pointer, the code might read from or process an invalid memory location, potentially causing a crash or unpredictable behavior. The new checks reject such inputs cleanly before any processing begins. It is a defensive hardening fix rather than a confirmed exploitable vulnerability.
Treat as a defensive hardening improvement. Users should upgrade to a release containing this commit if they call the affected MuSig or pubkey-sort APIs with untrusted or programmatically constructed pointer arrays. No immediate emergency response is warranted absent evidence of active exploitation.
Security signals we found
NULL pointer dereference hardening
Input validation added to public API functions
MuSig module array-of-pointers checks
EC pubkey sort array-of-pointers check
Evidence from the diff
The patch adds per-element ARG_CHECK loops in secp256k1_musig_pubkey_agg, secp256k1_musig_nonce_agg, secp256k1_musig_partial_sig_agg, and secp256k1_ec_pubkey_sort to verify that each pointer inside the caller-supplied pointer array is non-NULL. Without these checks, downstream code dereferences array elements (e.g., in pubkey aggregation, nonce summation, sorting comparator) and could trigger a NULL pointer dereference. ARG_CHECK typically sets the library’s default error callback, which aborts the process by default, so the practical effect is converting a possible crash into a controlled failure.
Changed components
src/modules/musig/keyagg_impl.hsrc/modules/musig/session_impl.hsrc/secp256k1.cInspect captured patch +16 / −0
diff --git a/src/modules/musig/keyagg_impl.h b/src/modules/musig/keyagg_impl.h
index 87869a4..e412a27 100644
--- a/src/modules/musig/keyagg_impl.h
+++ b/src/modules/musig/keyagg_impl.h
@@ -177,6 +177,9 @@ int secp256k1_musig_pubkey_agg(const secp256k1_context* ctx, secp256k1_xonly_pub
}
ARG_CHECK(pubkeys != NULL);
ARG_CHECK(n_pubkeys > 0);
+ for (i = 0; i < n_pubkeys; i++) {
+ ARG_CHECK(pubkeys[i] != NULL);
+ }
ecmult_data.ctx = ctx;
ecmult_data.pks = pubkeys;
diff --git a/src/modules/musig/session_impl.h b/src/modules/musig/session_impl.h
index 6a80a27..4a245ad 100644
--- a/src/modules/musig/session_impl.h
+++ b/src/modules/musig/session_impl.h
@@ -521,10 +521,15 @@ static int secp256k1_musig_sum_pubnonces(const secp256k1_context* ctx, secp256k1
int secp256k1_musig_nonce_agg(const secp256k1_context* ctx, secp256k1_musig_aggnonce *aggnonce, const secp256k1_musig_pubnonce * const* pubnonces, size_t n_pubnonces) {
secp256k1_gej aggnonce_ptsj[2];
secp256k1_ge aggnonce_pts[2];
+ size_t i;
+
VERIFY_CHECK(ctx != NULL);
ARG_CHECK(aggnonce != NULL);
ARG_CHECK(pubnonces != NULL);
ARG_CHECK(n_pubnonces > 0);
+ for (i = 0; i < n_pubnonces; i++) {
+ ARG_CHECK(pubnonces[i] != NULL);
+ }
if (!secp256k1_musig_sum_pubnonces(ctx, aggnonce_ptsj, pubnonces, n_pubnonces)) {
return 0;
@@ -782,6 +787,9 @@ int secp256k1_musig_partial_sig_agg(const secp256k1_context* ctx, unsigned char
ARG_CHECK(session != NULL);
ARG_CHECK(partial_sigs != NULL);
ARG_CHECK(n_sigs > 0);
+ for (i = 0; i < n_sigs; i++) {
+ ARG_CHECK(partial_sigs[i] != NULL);
+ }
if (!secp256k1_musig_session_load(ctx, &session_i, session)) {
return 0;
diff --git a/src/secp256k1.c b/src/secp256k1.c
index c2d3fcb..bce06d3 100644
--- a/src/secp256k1.c
+++ b/src/secp256k1.c
@@ -325,8 +325,13 @@ static int secp256k1_ec_pubkey_sort_cmp(const void* pk1, const void* pk2, void *
}
int secp256k1_ec_pubkey_sort(const secp256k1_context* ctx, const secp256k1_pubkey **pubkeys, size_t n_pubkeys) {
+ size_t i;
+
VERIFY_CHECK(ctx != NULL);
ARG_CHECK(pubkeys != NULL);
+ for (i = 0; i < n_pubkeys; i++) {
+ ARG_CHECK(pubkeys[i] != NULL);
+ }
/* Suppress wrong warning (fixed in MSVC 19.33) */
#if defined(_MSC_VER) && (_MSC_VER < 1933)
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.