From 9890cc42daff5e2d0cad01ac4bf78c391f599a6e Mon Sep 17 00:00:00 2001 From: Alexey Fofanov Date: Wed, 18 Oct 2023 14:23:22 +0300 Subject: [PATCH] set_client_ciphersuite(): Fix for potential UB if session->cipher is NULL This currently cannot happen without an application overriding the session with some bogus data so this is an ossl_assert() check. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/22418) --- ssl/statem/statem_clnt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c index cbf5a57bebf..3b3c51e41c1 100644 --- a/ssl/statem/statem_clnt.c +++ b/ssl/statem/statem_clnt.c @@ -1427,6 +1427,10 @@ static int set_client_ciphersuite(SSL_CONNECTION *s, if (SSL_CONNECTION_IS_TLS13(s)) { const EVP_MD *md = ssl_md(sctx, c->algorithm2); + if (!ossl_assert(s->session->cipher != NULL)) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); + return 0; + } /* * In TLSv1.3 it is valid for the server to select a different * ciphersuite as long as the hash is the same. -- 2.47.2