From 95773b1ff398ed29751ee087b625a2243e79138a Mon Sep 17 00:00:00 2001
From: Aleksey Sanin <aleksey@aleksey.com>
Date: Tue, 30 Sep 2025 09:29:08 -0400
Subject: [PATCH] (xmlsec-nss) Ensure public key exists if private key exists

---
 src/nss/pkikeys.c | 40 ++++++++++++++++++++++++++--------------
 1 file changed, 26 insertions(+), 14 deletions(-)

diff --git a/src/nss/pkikeys.c b/src/nss/pkikeys.c
index c14d6491f..b0b5b8371 100644
--- a/src/nss/pkikeys.c
+++ b/src/nss/pkikeys.c
@@ -149,41 +149,53 @@ xmlSecNssPKIKeyDataAdoptKey(xmlSecKeyDataPtr data,
                             SECKEYPublicKey  *pubkey)
 {
     xmlSecNssPKIKeyDataCtxPtr ctx;
+    SECKEYPublicKey *pubkey2 = NULL;
     KeyType pubType = nullKey;
     KeyType priType = nullKey;
 
     xmlSecAssert2(xmlSecKeyDataIsValid(data), -1);
     xmlSecAssert2(xmlSecKeyDataCheckSize(data, xmlSecNssPKIKeyDataSize), -1);
 
-    if(privkey != NULL) {
+    ctx = xmlSecNssPKIKeyDataGetCtx(data);
+    xmlSecAssert2(ctx != NULL, -1);
+
+    /* get public key if needed from private */
+    if ((pubkey == NULL) && (privkey != NULL)) {
+        pubkey2 = SECKEY_ConvertToPublicKey(privkey);
+        if(pubkey2 == NULL) {
+            xmlSecNssError("SECKEY_ConvertToPublicKey", NULL);
+            return(-1);
+        }
+    }
+
+    /* ensure key types match */
+    if (privkey != NULL) {
         priType = SECKEY_GetPrivateKeyType(privkey);
     }
 
-    if(pubkey != NULL) {
+    if (pubkey != NULL) {
         pubType = SECKEY_GetPublicKeyType(pubkey);
     }
-
-    if(priType != nullKey && pubType != nullKey) {
-        if(pubType != priType) {
-            xmlSecNssError3("SECKEY_GetPrivateKeyType/SECKEY_GetPublicKeyType", NULL,
-                "pubType=%u; priType=%u", pubType, priType);
-            return -1;
+    if ((priType != nullKey) && (pubType != nullKey) && (pubType != priType)) {
+        xmlSecNssError3("SECKEY_GetPrivateKeyType/SECKEY_GetPublicKeyType", NULL, "pubType=%u; priType=%u", pubType, priType);
+        if (pubkey2 != NULL) {
+            SECKEY_DestroyPublicKey(pubkey2);
         }
+        return(-1);
     }
 
-    ctx = xmlSecNssPKIKeyDataGetCtx(data);
-    xmlSecAssert2(ctx != NULL, -1);
-
-    if (ctx->privkey) {
+    /* destroy old keys (if needed) and set new ones */
+    if (ctx->privkey != NULL) {
         SECKEY_DestroyPrivateKey(ctx->privkey);
     }
     ctx->privkey = privkey;
 
-    if (ctx->pubkey) {
+    if (ctx->pubkey != NULL) {
         SECKEY_DestroyPublicKey(ctx->pubkey);
     }
-    ctx->pubkey = pubkey;
+    ctx->pubkey = (pubkey != NULL) ? pubkey : pubkey2;
 
+    /* done */
     return(0);
 }