openssl: Don't allocate salt if PRF/hash is unknown

This can happen if e.g. AES-XCBC is selected.

Fixes: 2dbeecfc029b ("openssl: Fix testing KDF_PRF in the constructor with OpenSSL 3.5.1")

diff --git a/src/libstrongswan/plugins/openssl/openssl_kdf.c b/src/libstrongswan/plugins/openssl/openssl_kdf.c
index e1b67c920dd4ea027eda09678d05ec21bc18b2c9..4611a38824e92e6c72a53f97694c6a0fec608e79 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_kdf.c
+++ b/src/libstrongswan/plugins/openssl/openssl_kdf.c
@@ -203,7 +203,7 @@ kdf_t *openssl_kdf_create(key_derivation_function_t algo, va_list args)
 
        /* also generate a salt (as if none was provided, i.e. zeroes of hash length)
         * as OpenSSL 3.5.1+ won't accept NULL anymore */
-       if (algo == KDF_PRF)
+       if (algo == KDF_PRF && this->hasher)
        {
                this->salt = chunk_copy_pad(chunk_alloc(get_length(this)),
                                                                        chunk_empty, 0);