From: Arne Schwabe Date: Thu, 30 Oct 2025 19:29:57 +0000 (+0100) Subject: Ensure that get_sigtype always return non-NULL X-Git-Tag: v2.7_rc1~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9fa32e66c9ec66ca05704f8e8b2fd9db7c711c50;p=thirdparty%2Fopenvpn.git Ensure that get_sigtype always return non-NULL There is a theoretical possibility that OpenSSL returns an NID that OBJ_nid2sn cannot resolve and thus the function return NULL. This is however extremely unlikely. But we still cover this case now to make linters/code checker happy and avoid similar false positives in the future. Reported-by: Joshua Rogers Found-by: ZeroPath (https://zeropath.com/) Change-Id: I70e221ff5d9752fec17bad18fd41dcf188ae8fbc Signed-off-by: Arne Schwabe Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1325 Message-Id: <20251030193003.348-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34060.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index d99714170..a4a686310 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -2408,7 +2408,17 @@ get_sigtype(int nid) return "(error getting name)"; default: - return OBJ_nid2sn(nid); + { + const char *type = OBJ_nid2sn(nid); + if (!type) + { + /* This is unlikely to ever happen as OpenSSL is unlikely to + * return an NID it cannot resolve itself but we silence + * linter/code checkers here */ + type = "(error getting name, OBJ_nid2sn failed)"; + } + return type; + } } } #endif /* ifndef LIBRESSL_VERSION_NUMBER */