From: Tomas Mraz <tomas@openssl.org>
Date: Wed, 12 Nov 2025 15:59:46 +0000 (+0100)
Subject: Add negative test for PKCS12_SAFEBAG_get0_bag*() functions
X-Git-Tag: 3.0-PRE-CLANG-FORMAT-WEBKIT~32
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=08c620ec4bb5f0e66d3584e7bd8ff180d3f43837;p=thirdparty%2Fopenssl.git

Add negative test for PKCS12_SAFEBAG_get0_bag*() functions

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29128)

(cherry picked from commit 930a9502d15aabde8c774ebf45834c2c135047c0)
---

diff --git a/test/helpers/pkcs12.c b/test/helpers/pkcs12.c
index a87683dc950..95cad4d9a8b 100644
--- a/test/helpers/pkcs12.c
+++ b/test/helpers/pkcs12.c
@@ -565,6 +565,11 @@ void check_certbag(PKCS12_BUILDER *pb, const unsigned char *bytes, int len,
         pb->success = 0;
         goto err;
     }
+    if (!TEST_ptr_null(PKCS12_SAFEBAG_get0_bag_obj(bag))) {
+        pb->success = 0;
+        goto err;
+    }
+
     ref_x509 = load_cert_asn1(bytes, len);
     if (!TEST_false(X509_cmp(x509, ref_x509)))
         pb->success = 0;
@@ -626,6 +631,10 @@ void check_keybag(PKCS12_BUILDER *pb, const unsigned char *bytes, int len,
         pb->success = 0;
         goto err;
     }
+    if (!TEST_ptr_null(PKCS12_SAFEBAG_get0_bag_type(bag))) {
+        pb->success = 0;
+        goto err;
+    }
 
     /* PKEY compare returns 1 for match */
     ref_pkey = load_pkey_asn1(bytes, len);