From 50295c9c4ce890b44f7f308b83dbcb6107190c51 Mon Sep 17 00:00:00 2001
From: Joshua Rogers <MegaManSec@users.noreply.github.com>
Date: Sat, 11 Oct 2025 20:25:46 +0800
Subject: [PATCH] asn_mime: Harden multi_split() against pushing NULL if a
 section is empty
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28881)
---
 crypto/asn1/asn_mime.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/crypto/asn1/asn_mime.c b/crypto/asn1/asn_mime.c
index c9bdfd98c84..f3511fedd7d 100644
--- a/crypto/asn1/asn_mime.c
+++ b/crypto/asn1/asn_mime.c
@@ -669,6 +669,12 @@ static int multi_split(BIO *bio, int flags, const char *bound, STACK_OF(BIO) **r
             first = 1;
             part++;
         } else if (state == 2) {
+            if (bpart == NULL) {
+                bpart = BIO_new(BIO_s_mem());
+                if (bpart == NULL)
+                    return 0;
+                BIO_set_mem_eof_return(bpart, 0);
+            }
             if (!sk_BIO_push(parts, bpart)) {
                 BIO_free(bpart);
                 return 0;
-- 
2.47.3