From 6d3e84e84fe2e86c9c78a13521ba94dc1aff34e5 Mon Sep 17 00:00:00 2001 From: Norbert Pocs Date: Thu, 27 Aug 2026 13:58:20 +0200 Subject: [PATCH] Guard comparision when values are NULL Fixes: CVE-2026-75805 Signed-off-by: Norbert Pocs Reviewed-by: Daniel Kubec Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 11:05:24 2026 --- crypto/cmp/cmp_client.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/crypto/cmp/cmp_client.c b/crypto/cmp/cmp_client.c index 3e74e9ab55..dd97beed45 100644 --- a/crypto/cmp/cmp_client.c +++ b/crypto/cmp/cmp_client.c @@ -986,16 +986,23 @@ int OSSL_CMP_exec_RR_ses(OSSL_CMP_CTX *ctx) ret = 0; goto err; } - if (X509_NAME_cmp(issuer, OSSL_CRMF_CERTID_get0_issuer(cid)) != 0) { + /* + * The issuer and serial number are absent if the certificate to be + * revoked was given as a PKCS#10 CSR, in which case there is nothing + * to check the CertId of the response against. + */ + if (issuer != NULL + && X509_NAME_cmp(issuer, OSSL_CRMF_CERTID_get0_issuer(cid)) != 0) { #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_CERTID_IN_RP); ret = 0; goto err; #endif } - if (ASN1_INTEGER_cmp(serial, - OSSL_CRMF_CERTID_get0_serialNumber(cid)) - != 0) { + if (serial != NULL + && ASN1_INTEGER_cmp(serial, + OSSL_CRMF_CERTID_get0_serialNumber(cid)) + != 0) { #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_SERIAL_IN_RP); ret = 0; -- 2.55.0