ec_pubkey_combine: return early if a public key fails to load #1968

pull fametrano wants to merge 1 commits into bitcoin-core:master from fametrano:ec-pubkey-combine-load changing 2 files +8 −2

fametrano commented at 7:08 AM on October 15, 2026: contributor

When the illegal callback does not abort, secp256k1_ec_pubkey_combine returns 1 even if one of its input public keys is invalid, because it ignores the result of secp256k1_pubkey_load. This PR makes it return 0 in that case. #1919 adds the same check to secp256k1_ecdh.

This is only the minimal check. It does not settle the discussion in #1872 on whether secp256k1_pubkey_load should return void, where _pubkey_combine is named as one of the callers that ignore its result. The new test passes a zeroed public key at each position of the input array and expects the illegal callback to fire and the call to return 0. It fails on master and passes with the change.

ec_pubkey_combine: return early if a public key fails to load

If one of the input public keys is invalid and the illegal callback
does not abort, secp256k1_ec_pubkey_combine ignored the failed
secp256k1_pubkey_load and returned 1. Return 0 instead, as most other
callers of secp256k1_pubkey_load do.

ad087422c2

Yudis-bit commented at 10:55 AM on October 17, 2026: contributor

Tested ACK ad08742 on Windows.
theStack approved
theStack commented at 8:32 AM on October 18, 2026: contributor

ACK ad087422c282edb24bbcff68d5b8bc238aeb4bb7

There is one other missing _pubkey_load return check in the ecdh module, but that one could be justified with constant-time guarantees (in the strict interpretation that we want that even for invalid input key material), so that's something for a different PR like #1919. For the pubkey combination function there seems to be really no good reason to not return early if a pubkey is invalid.
theStack added the label tweak/refactor on Oct 18, 2026

Contributors

Labels

Linked (view graph)

#1872 Use `SECP256K1_WARN_UNUSED_RESULT` internally #1919 ecdh/ellswift/schnorrsig: return early for invalid inputs (consistent handling w.r.t. constant-time)