int SM2_decrypt(const EC_KEY *key,
                const EVP_MD *digest,
                const uint8_t *ciphertext,
                size_t ciphertext_len, uint8_t *ptext_buf, size_t *ptext_len)
{
    int rc = 0;
    int i;
    BN_CTX *ctx = NULL;
    const EC_GROUP *group = EC_KEY_get0_group(key);
    EC_POINT *C1 = NULL;
    struct SM2_Ciphertext_st *sm2_ctext = NULL;
    BIGNUM *x2 = NULL;
    BIGNUM *y2 = NULL;
    uint8_t *x2y2 = NULL;
    uint8_t *computed_C3 = NULL;
    const size_t field_size = EC_field_size(group);
    const int hash_size = EVP_MD_size(digest);
    uint8_t *msg_mask = NULL;
    const uint8_t *C2 = NULL;
    const uint8_t *C3 = NULL;
    int msg_len = 0;
    EVP_MD_CTX *hash = NULL;
    if (field_size == 0 || hash_size == 0)
       goto done;
    memset(ptext_buf, 0xFF, *ptext_len);
    sm2_ctext = d2i_SM2_Ciphertext(NULL, &ciphertext, ciphertext_len);
    if (sm2_ctext == NULL)
        goto done;
    if (sm2_ctext->C3->length != hash_size)
        goto done;
    C2 = sm2_ctext->C2->data;
    C3 = sm2_ctext->C3->data;
    msg_len = sm2_ctext->C2->length;
    ctx = BN_CTX_new();
    if (ctx == NULL)
       goto done;
    BN_CTX_start(ctx);
    x2 = BN_CTX_get(ctx);
    y2 = BN_CTX_get(ctx);
    if(y2 == NULL)
       goto done;
    msg_mask = OPENSSL_zalloc(msg_len);
    x2y2 = OPENSSL_zalloc(2 * field_size);
    computed_C3 = OPENSSL_zalloc(hash_size);
    if(msg_mask == NULL || x2y2 == NULL || computed_C3 == NULL)
       goto done;
    C1 = EC_POINT_new(group);
    if (C1 == NULL)
        goto done;
    if (EC_POINT_set_affine_coordinates_GFp
        (group, C1, sm2_ctext->C1x, sm2_ctext->C1y, ctx) == 0)
        goto done;
    if (EC_POINT_mul(group, C1, NULL, C1, EC_KEY_get0_private_key(key), ctx) ==
        0)
        goto done;
    if (EC_POINT_get_affine_coordinates_GFp(group, C1, x2, y2, ctx) == 0)
        goto done;
    BN_bn2binpad(x2, x2y2, field_size);
    BN_bn2binpad(y2, x2y2 + field_size, field_size);
    if (ECDH_KDF_X9_62(msg_mask, msg_len, x2y2, 2 * field_size, NULL, 0, digest)
        == 0)
        goto done;
    for (i = 0; i != msg_len; ++i)
        ptext_buf[i] = C2[i] ^ msg_mask[i];
    hash = EVP_MD_CTX_new();
    if (hash == NULL)
       goto done;
    if (EVP_DigestInit(hash, digest) == 0)
        goto done;
    if (EVP_DigestUpdate(hash, x2y2, field_size) == 0)
        goto done;
    if (EVP_DigestUpdate(hash, ptext_buf, msg_len) == 0)
        goto done;
    if (EVP_DigestUpdate(hash, x2y2 + field_size, field_size) == 0)
        goto done;
    if (EVP_DigestFinal(hash, computed_C3, NULL) == 0)
        goto done;
    if (memcmp(computed_C3, C3, hash_size) != 0)
        goto done;
    rc = 1;
    *ptext_len = msg_len;
 done:
    if (rc == 0)
        memset(ptext_buf, 0, *ptext_len);
    OPENSSL_free(msg_mask);
    OPENSSL_free(x2y2);
    OPENSSL_free(computed_C3);
    EC_POINT_free(C1);
    BN_CTX_free(ctx);
    SM2_Ciphertext_free(sm2_ctext);
    EVP_MD_CTX_free(hash);
    return rc;
}
['int SM2_decrypt(const EC_KEY *key,\n                const EVP_MD *digest,\n                const uint8_t *ciphertext,\n                size_t ciphertext_len, uint8_t *ptext_buf, size_t *ptext_len)\n{\n    int rc = 0;\n    int i;\n    BN_CTX *ctx = NULL;\n    const EC_GROUP *group = EC_KEY_get0_group(key);\n    EC_POINT *C1 = NULL;\n    struct SM2_Ciphertext_st *sm2_ctext = NULL;\n    BIGNUM *x2 = NULL;\n    BIGNUM *y2 = NULL;\n    uint8_t *x2y2 = NULL;\n    uint8_t *computed_C3 = NULL;\n    const size_t field_size = EC_field_size(group);\n    const int hash_size = EVP_MD_size(digest);\n    uint8_t *msg_mask = NULL;\n    const uint8_t *C2 = NULL;\n    const uint8_t *C3 = NULL;\n    int msg_len = 0;\n    EVP_MD_CTX *hash = NULL;\n    if (field_size == 0 || hash_size == 0)\n       goto done;\n    memset(ptext_buf, 0xFF, *ptext_len);\n    sm2_ctext = d2i_SM2_Ciphertext(NULL, &ciphertext, ciphertext_len);\n    if (sm2_ctext == NULL)\n        goto done;\n    if (sm2_ctext->C3->length != hash_size)\n        goto done;\n    C2 = sm2_ctext->C2->data;\n    C3 = sm2_ctext->C3->data;\n    msg_len = sm2_ctext->C2->length;\n    ctx = BN_CTX_new();\n    if (ctx == NULL)\n       goto done;\n    BN_CTX_start(ctx);\n    x2 = BN_CTX_get(ctx);\n    y2 = BN_CTX_get(ctx);\n    if(y2 == NULL)\n       goto done;\n    msg_mask = OPENSSL_zalloc(msg_len);\n    x2y2 = OPENSSL_zalloc(2 * field_size);\n    computed_C3 = OPENSSL_zalloc(hash_size);\n    if(msg_mask == NULL || x2y2 == NULL || computed_C3 == NULL)\n       goto done;\n    C1 = EC_POINT_new(group);\n    if (C1 == NULL)\n        goto done;\n    if (EC_POINT_set_affine_coordinates_GFp\n        (group, C1, sm2_ctext->C1x, sm2_ctext->C1y, ctx) == 0)\n        goto done;\n    if (EC_POINT_mul(group, C1, NULL, C1, EC_KEY_get0_private_key(key), ctx) ==\n        0)\n        goto done;\n    if (EC_POINT_get_affine_coordinates_GFp(group, C1, x2, y2, ctx) == 0)\n        goto done;\n    BN_bn2binpad(x2, x2y2, field_size);\n    BN_bn2binpad(y2, x2y2 + field_size, field_size);\n    if (ECDH_KDF_X9_62(msg_mask, msg_len, x2y2, 2 * field_size, NULL, 0, digest)\n        == 0)\n        goto done;\n    for (i = 0; i != msg_len; ++i)\n        ptext_buf[i] = C2[i] ^ msg_mask[i];\n    hash = EVP_MD_CTX_new();\n    if (hash == NULL)\n       goto done;\n    if (EVP_DigestInit(hash, digest) == 0)\n        goto done;\n    if (EVP_DigestUpdate(hash, x2y2, field_size) == 0)\n        goto done;\n    if (EVP_DigestUpdate(hash, ptext_buf, msg_len) == 0)\n        goto done;\n    if (EVP_DigestUpdate(hash, x2y2 + field_size, field_size) == 0)\n        goto done;\n    if (EVP_DigestFinal(hash, computed_C3, NULL) == 0)\n        goto done;\n    if (memcmp(computed_C3, C3, hash_size) != 0)\n        goto done;\n    rc = 1;\n    *ptext_len = msg_len;\n done:\n    if (rc == 0)\n        memset(ptext_buf, 0, *ptext_len);\n    OPENSSL_free(msg_mask);\n    OPENSSL_free(x2y2);\n    OPENSSL_free(computed_C3);\n    EC_POINT_free(C1);\n    BN_CTX_free(ctx);\n    SM2_Ciphertext_free(sm2_ctext);\n    EVP_MD_CTX_free(hash);\n    return rc;\n}', 'const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)\n{\n    return key->group;\n}', 'static size_t EC_field_size(const EC_GROUP *group)\n{\n    BIGNUM *p = BN_new();\n    BIGNUM *a = BN_new();\n    BIGNUM *b = BN_new();\n    size_t field_size = 0;\n    if (p == NULL || a == NULL || b == NULL)\n       goto done;\n    EC_GROUP_get_curve_GFp(group, p, a, b, NULL);\n    field_size = (BN_num_bits(p) + 7) / 8;\n done:\n    BN_free(p);\n    BN_free(a);\n    BN_free(b);\n    return field_size;\n}', 'int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,\n                           BIGNUM *b, BN_CTX *ctx)\n{\n    if (group->meth->group_get_curve == 0) {\n        ECerr(EC_F_EC_GROUP_GET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    return group->meth->group_get_curve(group, p, a, b, ctx);\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'int BN_is_zero(const BIGNUM *a)\n{\n    return a->top == 0;\n}', 'int EVP_MD_size(const EVP_MD *md)\n{\n    if (!md) {\n        EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);\n        return -1;\n    }\n    return md->md_size;\n}', 'void CRYPTO_free(void *str, const char *file, int line)\n{\n    INCREMENT(free_count);\n    if (free_impl != NULL && free_impl != &CRYPTO_free) {\n        free_impl(str, file, line);\n        return;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_free(str, 0, file, line);\n        free(str);\n        CRYPTO_mem_debug_free(str, 1, file, line);\n    } else {\n        free(str);\n    }\n#else\n    free(str);\n#endif\n}', 'void EC_POINT_free(EC_POINT *point)\n{\n    if (!point)\n        return;\n    if (point->meth->point_finish != 0)\n        point->meth->point_finish(point);\n    OPENSSL_free(point);\n}', 'void BN_CTX_free(BN_CTX *ctx)\n{\n#ifdef BN_CTX_DEBUG\n    {\n        BN_POOL_ITEM *pool = ctx->pool.head;\n        fprintf(stderr, "BN_CTX_free, stack-size=%d, pool-bignums=%d\\n",\n                ctx->stack.size, ctx->pool.size);\n        fprintf(stderr, "dmaxs: ");\n        while (pool) {\n            unsigned loop = 0;\n            while (loop < BN_CTX_POOL_SIZE)\n                fprintf(stderr, "%02x ", pool->vals[loop++].dmax);\n            pool = pool->next;\n        }\n        fprintf(stderr, "\\n");\n    }\n#endif\n    BN_STACK_finish(&ctx->stack);\n    BN_POOL_finish(&ctx->pool);\n    OPENSSL_free(ctx);\n}', 'static void BN_STACK_finish(BN_STACK *st)\n{\n    OPENSSL_free(st->indexes);\n    st->indexes = NULL;\n}', 'static void BN_POOL_finish(BN_POOL *p)\n{\n    unsigned int loop;\n    BIGNUM *bn;\n    while (p->head) {\n        for (loop = 0, bn = p->head->vals; loop++ < BN_CTX_POOL_SIZE; bn++)\n            if (bn->d)\n                BN_clear_free(bn);\n        p->current = p->head->next;\n        OPENSSL_free(p->head);\n        p->head = p->current;\n    }\n}']