Null Pointer Dereference in Crypto_Check_Anti_Replay()

[spicydll]

I noticed some code that could allow for a null pointer to be dereferenced in src/src_main/crypto.c

int32_t Crypto_Check_Anti_Replay(SecurityAssociation_t *sa_ptr, uint8_t *arsn, uint8_t *iv)
{
    int32_t status = CRYPTO_LIB_SUCCESS;
    int8_t IV_VALID = -1;
    int8_t ARSN_VALID = -1;

    // Check for NULL pointers
    if (arsn == NULL && sa_ptr->arsn_len > 0)
    {
        return CRYPTO_LIB_ERR_NULL_ARSN;
    }
    if (iv == NULL && sa_ptr->shivf_len > 0 && crypto_config->cryptography_type != CRYPTOGRAPHY_TYPE_KMCCRYPTO)
    {
        return CRYPTO_LIB_ERR_NULL_IV;
    }
    if (sa_ptr == NULL)
    {
        return CRYPTO_LIB_ERR_NULL_SA;
    }
    // rest of Crypto_Check_Ani_Replay() ...

Notice how sa_ptr is derefenced in both of the first two if statements (sa_ptr->arsn_len and sa_ptr->shivf_len). The sa_ptr is checked only after these first two dereferences. Therefore, a null pointer dereference can occur which can cause a crash.

These if statements should be reordered as follows to fix the issue:

int32_t Crypto_Check_Anti_Replay(SecurityAssociation_t *sa_ptr, uint8_t *arsn, uint8_t *iv)
{
    int32_t status = CRYPTO_LIB_SUCCESS;
    int8_t IV_VALID = -1;
    int8_t ARSN_VALID = -1;

    // Check for NULL pointers
    if (sa_ptr == NULL)
    {
        return CRYPTO_LIB_ERR_NULL_SA;
    }
    if (arsn == NULL && sa_ptr->arsn_len > 0)
    {
        return CRYPTO_LIB_ERR_NULL_ARSN;
    }
    if (iv == NULL && sa_ptr->shivf_len > 0 && crypto_config->cryptography_type != CRYPTOGRAPHY_TYPE_KMCCRYPTO)
    {
        return CRYPTO_LIB_ERR_NULL_IV;
    }
    // rest of Crypto_Check_Ani_Replay() ...

[rjbrown2]

This modification is valid.