From: Alexey Fofanov <avoget@gmail.com>
Date: Wed, 18 Oct 2023 11:23:22 +0000 (+0300)
Subject: set_client_ciphersuite(): Fix for potential UB if session->cipher is NULL
X-Git-Tag: openssl-3.3.0-alpha1~629
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9890cc42daff5e2d0cad01ac4bf78c391f599a6e;p=thirdparty%2Fopenssl.git

set_client_ciphersuite(): Fix for potential UB if session->cipher is NULL

This currently cannot happen without an application overriding
the session with some bogus data so this is an ossl_assert()
check.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22418)
---

diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c
index cbf5a57bebf..3b3c51e41c1 100644
--- a/ssl/statem/statem_clnt.c
+++ b/ssl/statem/statem_clnt.c
@@ -1427,6 +1427,10 @@ static int set_client_ciphersuite(SSL_CONNECTION *s,
         if (SSL_CONNECTION_IS_TLS13(s)) {
             const EVP_MD *md = ssl_md(sctx, c->algorithm2);
 
+            if (!ossl_assert(s->session->cipher != NULL)) {
+                SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
+                return 0;
+            }
             /*
              * In TLSv1.3 it is valid for the server to select a different
              * ciphersuite as long as the hash is the same.