[openssl/openssl] 74b1b8: x509: keep RFC 3779 stacks hole-free after a faile...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 74b1b8909e765e98c962a04b9fa73874b376ac0a
      https://github.com/openssl/openssl/commit/74b1b8909e765e98c962a04b9fa73874b376ac0a
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-27 (Mon, 27 Jul 2026)

  Changed paths:
    M crypto/x509/v3_addr.c
    M crypto/x509/v3_asid.c
    M test/v3ext.c

  Log Message:
  -----------
  x509: keep RFC 3779 stacks hole-free after a failed canonize

ASIdentifierChoice_canonize and IPAddressOrRanges_canonize left NULL
slots in the live stack when a merge succeeded before a later failure
(overlap, inverted range, or OOM).  The NULLs were closed up only on
the success path, so a failed X509v3_asid_canonize() /
X509v3_addr_canonize() left the object poisonable: a retry of either
function dereferences a NULL in the sort comparator during the re-sort,
the i2r extension printers dereference the hole when printing (both in
all builds), and on the asid side is_canonical trips extract_min_max's
ossl_assert(aor != NULL), an abort in debug builds.

This is a regression introduced by e59165a1e3 ("crypto/x509: replace
O(N^2) RFC 3779 canonicalisation merge with linear sweep"): the
previous delete-per-merge loop kept the stack hole-free at every step,
so a failed canonize always left the object sorted, partially merged
and structurally valid.

Run the compaction pass unconditionally, whether the sweep succeeded
or failed, restoring that contract: the stack is always left partially
canonicalized but hole-free, safe to inspect, print, encode, free, or
retry.  In v3_addr.c this also routes the bare return-0 error paths
through the done: cleanup label.

New tests cover the crash vectors (is_canonical then retry) on both
the asid and addr sides.  The existing *_error_midsweep tests are
strengthened with the same inspect/retry assertions.

Fixes #31856

Assisted-by: ZCode:GLM-5.2

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
MergeDate: Mon Jul 27 07:59:21 2026
(Merged from https://github.com/openssl/openssl/pull/31857)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/0b65b1-74b1b8%40github.com.