From a506178d116d9a5c0d075ea99701f0af140f2655 Mon Sep 17 00:00:00 2001 From: ndossche Date: Mon, 10 Aug 2026 20:49:41 +0200 Subject: [PATCH] crypto: fix missing error checks on ASN1_STRING_to_UTF8() This function returns a negative error code on error. When it does so, the `value_str` pointer will remain uninitialized and cause a crash later on when it is freed by OPENSSL_free(). Even if it wouldn't crash there, it still fails to signal the error and an empty string may be propagated to the callers. The check also mirrors the other one in the same file. Signed-off-by: ndossche --- deps/ncrypto/ncrypto.cc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc index d731e823b39d..0d516a3edf55 100644 --- a/deps/ncrypto/ncrypto.cc +++ b/deps/ncrypto/ncrypto.cc @@ -6983,6 +6983,9 @@ std::pair X509Name::Iterator::operator*() const { unsigned char* value_str; int value_str_size = ASN1_STRING_to_UTF8(&value_str, value); + if (value_str_size < 0) [[unlikely]] { + return {{}, {}}; + } std::string out(reinterpret_cast(value_str), value_str_size); OPENSSL_free(value_str); // free after copy