From: Tomas Mraz <tomas@openssl.org>
Date: Wed, 12 Nov 2025 15:59:46 +0000 (+0100)
Subject: Add negative test for PKCS12_SAFEBAG_get0_bag*() functions
X-Git-Tag: 3.6-PRE-CLANG-FORMAT-WEBKIT~59
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3d698de7e663ff0b4a11e41f7c076b09aa2c4f16;p=thirdparty%2Fopenssl.git

Add negative test for PKCS12_SAFEBAG_get0_bag*() functions

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29128)

(cherry picked from commit 930a9502d15aabde8c774ebf45834c2c135047c0)
---

diff --git a/test/helpers/pkcs12.c b/test/helpers/pkcs12.c
index d2433672381..d8737558b74 100644
--- a/test/helpers/pkcs12.c
+++ b/test/helpers/pkcs12.c
@@ -573,6 +573,11 @@ void check_certbag(PKCS12_BUILDER *pb, const unsigned char *bytes, int len,
         pb->success = 0;
         goto err;
     }
+    if (!TEST_ptr_null(PKCS12_SAFEBAG_get0_bag_obj(bag))) {
+        pb->success = 0;
+        goto err;
+    }
+
     ref_x509 = load_cert_asn1(bytes, len);
     if (!TEST_false(X509_cmp(x509, ref_x509)))
         pb->success = 0;
@@ -635,6 +640,10 @@ void check_keybag(PKCS12_BUILDER *pb, const unsigned char *bytes, int len,
         pb->success = 0;
         goto err;
     }
+    if (!TEST_ptr_null(PKCS12_SAFEBAG_get0_bag_type(bag))) {
+        pb->success = 0;
+        goto err;
+    }
 
     /* PKEY compare returns 1 for match */
     ref_pkey = load_pkey_asn1(bytes, len);