diff options
| author | Daniel Kubec <[email protected]> | 2026-10-01 19:58:12 +0200 |
|---|---|---|
| committer | Eugene Syromiatnikov <[email protected]> | 2026-10-24 11:42:53 +0200 |
| commit | 0e2a7f23387cf7b7cd22832c1f5bdc1200683d6e (patch) | |
| tree | e67c7775e89b18f97a0478dc812ae96be4378d64 | |
| parent | Migrate test_gcm_reinit from evp_extra_test.c to evp_aead_test.c (diff) | |
| download | openssl-0e2a7f23387cf7b7cd22832c1f5bdc1200683d6e.tar.gz openssl-0e2a7f23387cf7b7cd22832c1f5bdc1200683d6e.zip | |
apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()
The issuer and the serialNumber are independently OPTIONAL
in a CertTemplate. A component absent from the request cannot confirm
a match with the reference cert, and ASN1_INTEGER_cmp() does not accept
NULL, so require each component the reference cert has to be present
in the request and to be equal.
Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests"
References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()"
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Merge-date: Sat Oct 24 09:44:19 2026
Merged-from: https://github.com/openssl/openssl/pull/33071
| -rw-r--r-- | apps/lib/cmp_mock_srv.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/apps/lib/cmp_mock_srv.c b/apps/lib/cmp_mock_srv.c index c538c04d287..e8a289f3134 100644 --- a/apps/lib/cmp_mock_srv.c +++ b/apps/lib/cmp_mock_srv.c @@ -274,8 +274,11 @@ static int refcert_cmp(const X509 *refcert, return 1; ref_issuer = X509_get_issuer_name(refcert); ref_serial = X509_get0_serialNumber(refcert); - return (ref_issuer == NULL || X509_NAME_cmp(issuer, ref_issuer) == 0) - && (ref_serial == NULL || ASN1_INTEGER_cmp(serial, ref_serial) == 0); + if (ref_issuer != NULL + && (issuer == NULL || X509_NAME_cmp(issuer, ref_issuer) != 0)) + return 0; + return ref_serial == NULL + || (serial != NULL && ASN1_INTEGER_cmp(serial, ref_serial) == 0); } /* reset the state that belongs to a transaction */ |