[openssl/openssl] 4cef48: Guard against NULL data in empty ASN1_STRINGs

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 4cef487f2a5615e59d919e6fd4094a02038950ff
      https://github.com/openssl/openssl/commit/4cef487f2a5615e59d919e6fd4094a02038950ff
  Author: Norbert Pocs <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M crypto/asn1/a_strex.c
    M crypto/ocsp/v3_ocsp.c
    M crypto/x509/x_name.c

  Log Message:
  -----------
  Guard against NULL data in empty ASN1_STRINGs

Since 28179061bf a zero-length ASN1_STRING has data == NULL in
fuzzing builds instead of a 1-byte allocation. Several call sites
did pointer arithmetic or memcpy on the data pointer before any
length check, which is undefined behaviour for NULL even with a
zero offset and aborts the fuzz targets under UBSan:

- asn1_string_canon: skip canonicalisation of empty values
- do_buf, do_hex_dump: return early on an empty buffer
- i2d_ocsp_nonce: skip the memcpy for an empty nonce

The loops at these sites were already no-ops for zero length, so
there is no behaviour change outside sanitizer builds.

Assisted-By: Claude:claude-fable-5

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Tue Jul 21 12:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31998)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/63afe6-4cef48%40github.com.