From fc4e557ecb6406e421d452ce620d14fedecc4368 Mon Sep 17 00:00:00 2001 From: Trust-Worthy Date: Tue, 29 Sep 2026 18:06:16 -0400 Subject: AES-OCB: reject a NULL input to update EVP_EncryptUpdate() with a NULL input buffer and a nonzero length read from the NULL pointer in CRYPTO_ocb128_aad(), a NULL-pointer dereference detected by ASan. Reject the call instead. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Paul Dale Reviewed-by: Neil Horman Merge-date: Wed Oct 21 16:59:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33157 --- providers/implementations/ciphers/cipher_aes_ocb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/providers/implementations/ciphers/cipher_aes_ocb.c b/providers/implementations/ciphers/cipher_aes_ocb.c index 433e0265980..bb7231dd8a4 100644 --- a/providers/implementations/ciphers/cipher_aes_ocb.c +++ b/providers/implementations/ciphers/cipher_aes_ocb.c @@ -251,6 +251,11 @@ static int aes_ocb_block_update(void *vctx, unsigned char *out, size_t *outl, return 1; } + if (in == NULL) { + ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_NULL_PARAMETER); + return 0; + } + /* Are we dealing with AAD or normal data here? */ if (out == NULL) { buf = ctx->aad_buf; -- cgit