From 2918eb8a6d4b3167f26ac011e87c3a7ecc7dbe56 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 1 Jun 2026 17:51:35 +0200 Subject: [PATCH] openssl: Fix undefined memory access when verifying PKCS#7 containers If the signerInfo or recipientInfo structure doesn't contain issuerAndSerialNumber but instead a subjectKeyIdentifier, then the called functions will leave the passed name and serial numbers unchanged. While openssl_x509_name2id() prevents a NULL-pointer dereference, it tries to DER-encode the object at the passed pointer via i2d_X509_NAME(). Depending on the stack contents, this likely causes a segmentation fault. Fixes: 3c820cdc232a ("Implement PKCS#7 decryption using openssl") Fixes: c61723c69fb5 ("Implement OpenSSL PKCS#7 signed-data parsing and verification") Fixes: CVE-2026-78123 --- src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c index 73611821aadb..9980bf242c12 100644 --- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c @@ -222,8 +222,8 @@ static auth_cfg_t *verify_signature(CMS_SignerInfo *si, auth_cfg_t *auth, *found = NULL; identification_t *issuer, *serial; chunk_t attrs = chunk_empty, sig, attr; - X509_NAME *name; - ASN1_INTEGER *snr; + X509_NAME *name = NULL; + ASN1_INTEGER *snr = NULL; int i; if (CMS_SignerInfo_get0_signer_id(si, NULL, &name, &snr) != 1) @@ -633,8 +633,8 @@ static bool decrypt(private_openssl_pkcs7_t *this, identification_t *serial, *issuer; private_key_t *private; X509_ALGOR *alg; - X509_NAME *name; - ASN1_INTEGER *sn; + X509_NAME *name = NULL; + ASN1_INTEGER *sn = NULL; u_char zero = 0; int oid; -- 2.43.0