crypto: fix missing nullptr check on RSA_new()

ndossche · aduh95 · commit a32a59874898 · 2026-02-28T12:07:01.000+01:00
Not checking this can cause a null deref. Since there is already a null check at the bottom of the function with `NewRSA()`. PR-URL: #61888 Reviewed-By: Anna Henningsen <anna@addaleax.net>
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
@@ -385,6 +385,11 @@ KeyObjectData ImportJWKRsaKey(Environment* env,
   KeyType type = d_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
 
   RSAPointer rsa(RSA_new());
+  if (!rsa) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Unable to create RSA pointer");
+    return {};
+  }
+
   ncrypto::Rsa rsa_view(rsa.get());
 
   ByteSource n = ByteSource::FromEncodedString(env, n_value.As<String>());
@@ -435,7 +440,10 @@ KeyObjectData ImportJWKRsaKey(Environment* env,
   }
 
   auto pkey = EVPKeyPointer::NewRSA(std::move(rsa));
-  if (!pkey) return {};
+  if (!pkey) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Unable to create key pointer");
+    return {};
+  }
 
   return KeyObjectData::CreateAsymmetric(type, std::move(pkey));
 }
