Skip to content

Commit a17cc8d

Browse files
n13ljogme
n13l
authored and
jogme
committed
Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg
ossl_cmp_calc_protection() only checked whether the protectionAlg parameter (ppval) was NULL before treating it as a PBMParameter ASN1_STRING. X509_ALGOR_get0() does not validate the ASN.1 type of the parameter against what the caller expects. For id-PasswordBasedMAC, a crafted message can encode the parameter as a BOOLEAN instead of the expected PBMParameter SEQUENCE. Because the ASN1_TYPE value union overlays the boolean int on the pointer field, ppval comes back as a bogus non-NULL pointer (e.g. 0xff). Fixes CVE-2026-63076 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Sat Aug 22 06:10:53 2026
1 parent 7f48cc3 commit a17cc8d

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

‎crypto/cmp/cmp_protect.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
5959
ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
6060
return NULL;
6161
}
62-
if (ppval == NULL) {
62+
if (pptype != V_ASN1_SEQUENCE || ppval == NULL) {
6363
ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
6464
return NULL;
6565
}

0 commit comments

Comments
 (0)