Address some review comments

2 files changed, 16 insertions, 4 deletions

diff --git a/src/lib/pubkey/ec_group/ec_group.cpp b/src/lib/pubkey/ec_group/ec_group.cpp
index 67d63ee65..ca007b584 100644
--- a/src/lib/pubkey/ec_group/ec_group.cpp
+++ b/src/lib/pubkey/ec_group/ec_group.cpp
@@ -64,7 +64,7 @@ class EC_Group_Data final
                  this->g_y() == g_y);
          }
 
-      bool match(EC_Group_Data& other) const
+      bool match(const EC_Group_Data& other) const
          {
          return match(other.p(), other.a(), other.b(),
                       other.g_x(), other.g_y(),
@@ -263,8 +263,20 @@ class EC_Group_Data_Map final
             const OID oid_from_store = EC_Group::EC_group_identity_from_order(order);
             if(oid_from_store.has_value())
                {
-               std::shared_ptr<EC_Group_Data> data = EC_Group::EC_group_info(oid);
-               if(data == nullptr || new_group->match(*data))
+               std::shared_ptr<EC_Group_Data> data = EC_Group::EC_group_info(oid_from_store);
+
+               /*
+               If EC_group_identity_from_order returned an OID then looking up that OID
+               must always return a result.
+               */
+               BOTAN_ASSERT_NOMSG(data != nullptr);
+
+               /*
+               It is possible (if unlikely) that someone is registering another group
+               that happens to have an order equal to that of a well known group -
+               so verify all values before assigning the OID.
+               */
+               if(new_group->match(*data))
                   {
                   new_group->set_oid(oid_from_store);
                   }
diff --git a/src/tests/test_ec_group.cpp b/src/tests/test_ec_group.cpp
index 0757254c1..81541cfd5 100644
--- a/src/tests/test_ec_group.cpp
+++ b/src/tests/test_ec_group.cpp
@@ -762,7 +762,7 @@ Test::Result test_ec_group_duplicate_orders()
 
    // We can now get it by OID:
    Botan::EC_Group hc_group(oid);
-   result.confirm("Group has correct OID", reg_group.get_curve_oid() == oid);
+   result.confirm("Group has correct OID", hc_group.get_curve_oid() == oid);
 
    // Existing secp160r1 unmodified:
    const Botan::OID secp160r1("1.3.132.0.8");