From f2348f1f844a54c7a95c32e2354cd29f0860c803 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Thu, 28 Nov 2024 10:10:28 +0100 Subject: [PATCH] Avoid NULL dereference with PKCS7_OP_SET_DETACHED_SIGNATURE We would dereference p7->d.sign pointer which can be NULL. Reported by Han Zheng. Reviewed-by: Matt Caswell Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/26078) --- crypto/pkcs7/pk7_lib.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/crypto/pkcs7/pk7_lib.c b/crypto/pkcs7/pk7_lib.c index 043a8f9ced..d7c5f1afbe 100644 --- a/crypto/pkcs7/pk7_lib.c +++ b/crypto/pkcs7/pk7_lib.c @@ -28,6 +28,11 @@ long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg) /* NOTE(emilia): does not support detached digested data. */ case PKCS7_OP_SET_DETACHED_SIGNATURE: if (nid == NID_pkcs7_signed) { + if (p7->d.sign == NULL) { + ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT); + ret = 0; + break; + } ret = p7->detached = (int)larg; if (ret && PKCS7_type_is_data(p7->d.sign->contents)) { ASN1_OCTET_STRING *os;