]> git.ipfire.org Git - thirdparty/openssl.git/commit
crypto: evp: fix potential null pointer dereference in EVP_DigestSignUpdate in m_sigver.c
authorAnton Moryakov <ant.v.moryakov@gmail.com>
Fri, 25 Jul 2025 12:43:15 +0000 (15:43 +0300)
committerPauli <ppzgs1@gmail.com>
Tue, 29 Jul 2025 22:55:46 +0000 (08:55 +1000)
commitdaa004d48438d67241b58592d43c3214dd3a903f
treeabfc02a00f8171428fa2de3c6e924026831ade5c
parent3c4f009959c4b73b78219da51e49bb564a24ef48
crypto: evp: fix potential null pointer dereference in EVP_DigestSignUpdate in m_sigver.c

Static analysis detected that EVP_DigestSign() could lead to null pointer
dereference in EVP_DigestSignUpdate() when pctx->pmeth is NULL. The issue
occurs in the legacy code path where pmeth is accessed without prior null
check.

This fix adds a proper null check for pctx->pmeth in the legacy section
of EVP_DigestSignUpdate() to prevent the crash when the function is called
through EVP_DigestSign() with improperly initialized context.

The check is placed in EVP_DigestSignUpdate() rather than EVP_DigestSign()
to maintain proper separation of concerns and follow OpenSSL's architectural
patterns where lower-level functions handle their own parameter validation.

Fixes potential crash in signature operations with legacy providers.

CLA: trivial
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28095)
crypto/evp/m_sigver.c