[yosuke-wolfssl]

Problem

_ecc_projective_add_point doubles instead of adding when the two operands have equal stored x and z and P->y == p - Q->y. That input is P = -Q, whose sum is the point at infinity, so the function returns 2P.

Fix (wolfcrypt/src/ecc.c)

• _ecc_projective_add_point doubles only when x, y and z are all equal. P = -Q now goes through the general formula and returns z = 0, which ecc_map turns into (0, 0, 1). The unused p - Q->y computation is removed, and the doc comment states the z = 0 form of infinity.
• ecc_projective_add_point_safe drops nInf. Its existing z == 0 branch now handles A = -B for both equal and different z, and still sets the infinity flag.

The SP math sp_ecc_proj_add_point_* path compares U/S values instead and is unaffected.

Closes f-16891 and f-16382.

Tests

• test_wolfSSL_EC_POINT: EC_POINT_add(P, -P) in both orders is at infinity.
• test_wolfSSL_EC_POINT: EC_POINT_mul(1*G + 1*(-G)) is at infinity. This reaches _safe with A = -B and equal z through ecc_mul2add, and covers the nInf removal.
• test_ecc_fault_whitebox.c: comments updated for the new path. No change to test vectors.

Verification

• --enable-opensslextra, --disable-eccshamir, --disable-harden, --enable-all: test_wolfSSL_EC_POINT and testwolfcrypt pass.
• GCC with -Werror (Ubuntu 24.04): clean build, tests pass.
• Negative controls: with the old comparison restored, both new checks fail; with the original code (comparison plus nInf), only the EC_POINT_add check fails.
• Whitebox smoke: test_ecc_whitebox and test_ecc_fault_whitebox pass.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[yosuke-wolfssl]

@claude review

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m4

• FLASH: .text -128 B (-0.1%, 207,088 B / 262,144 B, total: 79% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text -128 B (-0.1%, 179,731 B / 262,144 B, total: 69% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text -128 B (-0.1%, 194,200 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text -128 B (-0.0%, 793,436 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text -128 B (-0.1%, 220,756 B / 262,144 B, total: 84% used)

gcc-arm-cortex-m4-pq

• FLASH: .text -128 B (-0.0%, 308,944 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text -128 B (-0.1%, 246,434 B / 262,144 B, total: 94% used)

gcc-arm-cortex-m7

• FLASH: .text -128 B (-0.1%, 207,088 B / 262,144 B, total: 79% used)

gcc-arm-cortex-m7-pq

• FLASH: .text -128 B (-0.0%, 309,840 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text -128 B (-0.1%, 246,434 B / 262,144 B, total: 94% used)

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +160 B (+0.1%, 282,608 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11921

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: tests/unit-mcdc/test_ecc_fault_whitebox.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[claude]

Code review found no issues

No high-confidence issues detected in this change.