Skip to content

Commit 665d525

Browse files
igus68t8m
igus68
authored and
t8m
committed
Fix potential NULL dereference in OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert()
Check that 'parameter' != NULL before dereferencing in OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(). Fixes CVE-2026-42767 Co-authored-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> MergeDate: Mon Jun 8 20:40:47 2026
1 parent dbb20d9 commit 665d525

1 file changed

Lines changed: 6 additions & 4 deletions

File tree

‎crypto/crmf/crmf_lib.c‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -623,6 +623,7 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(const OSSL_CRMF_ENCRYPTEDVALUE *ecer
623623
EVP_CIPHER *cipher = NULL; /* used cipher */
624624
int cikeysize = 0; /* key size from cipher */
625625
unsigned char *iv = NULL; /* initial vector for symmetric encryption */
626+
int iv_len; /* iv length */
626627
unsigned char *outbuf = NULL; /* decryption output buffer */
627628
const unsigned char *p = NULL; /* needed for decoding ASN1 */
628629
int n, outlen = 0;
@@ -661,11 +662,12 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(const OSSL_CRMF_ENCRYPTEDVALUE *ecer
661662
<= 0)
662663
goto end;
663664

664-
if ((iv = OPENSSL_malloc(EVP_CIPHER_get_iv_length(cipher))) == NULL)
665+
iv_len = EVP_CIPHER_get_iv_length(cipher);
666+
if ((iv = OPENSSL_malloc(iv_len)) == NULL)
665667
goto end;
666-
if (ASN1_TYPE_get_octetstring(ecert->symmAlg->parameter, iv,
667-
EVP_CIPHER_get_iv_length(cipher))
668-
!= EVP_CIPHER_get_iv_length(cipher)) {
668+
if (ecert->symmAlg->parameter == NULL
669+
|| ASN1_TYPE_get_octetstring(ecert->symmAlg->parameter, iv, iv_len)
670+
!= iv_len) {
669671
ERR_raise(ERR_LIB_CRMF, CRMF_R_MALFORMED_IV);
670672
goto end;
671673
}

0 commit comments

Comments
 (0)