From d7c7caa370ad1fff1cd222e2499a77ea792c8a0e Mon Sep 17 00:00:00 2001 From: Steffan Karger Date: Sat, 6 Dec 2025 21:58:16 +0100 Subject: [PATCH] mbedtls: gracefully exit if certificate file is NULL Instead of crashing because we feed a NULL pointer to strlen(), gracefully exit with an error message. While at it, improve the error message a bit. Change-Id: I0d592d9d0c7ead296869f933c206c5d55e6cbed1 Reported-By: Joshua Rogers Found-by: ZeroPath (https://zeropath.com/) Signed-off-by: Steffan Karger Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1419 Message-Id: <20251206205829.27254-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34864.html Signed-off-by: Gert Doering --- src/openvpn/ssl_mbedtls.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index 83fca7852..3440319cc 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -466,10 +466,14 @@ tls_ctx_load_cert_file(struct tls_root_ctx *ctx, const char *cert_file, bool cer if (cert_inline) { + if (!cert_file) + { + msg(M_FATAL, "Cannot load inline certificate: NULL"); + } if (!mbed_ok(mbedtls_x509_crt_parse(ctx->crt_chain, (const unsigned char *)cert_file, strlen(cert_file) + 1))) { - msg(M_FATAL, "Cannot load inline certificate file"); + msg(M_FATAL, "Cannot load inline certificate"); } } else -- 2.47.3