fix potential null pointer dereference in cms_main function in apps/cms.c #26941

[glorious064]

Checklist

How the Null Pointer Derefrence Happens:
in the cms_main function in the apps/cms.c file
At lines 1013-1015, the following code snippet is present:
pctx = CMS_RecipientInfo_get0_pkey_ctx(ri); if (kparam != NULL) { if (!cms_set_pkey_param(pctx, kparam->param))

The assignment pctx = CMS_RecipientInfo_get0_pkey_ctx(ri); suggests that pctx might be NULL. However, in the subsequent call chain:
(!cms_set_pkey_param(pctx, kparam->param))
-> pkey_ctrl_string(pctx, keyopt)
-> rv = EVP_PKEY_CTX_ctrl_str(ctx, stmp, vtmp)
-> ret = evp_pkey_ctx_store_cached_data(ctx, -1, -1, -1, name, value, strlen(value) + 1)
-> evp_pkey_ctx_state(ctx)

There are dereference operations involving pctx, which may pose a potential risk if pctx is NULL. So I add a null check:
if (pctx && !cms_set_pkey_param(pctx, kparam->param))

[vdukhovni]

Fine, but please make the suggested change.

[InfoHunter]

Agreed it's trivial.

[InfoHunter]

Wait, I noticed there is one other place that has the same issue: CMS_SignerInfo_get0_pkey_ctx

[InfoHunter]

@glorious064 Would you like to fix that incidentally?

[InfoHunter]

openssl/apps/cms.c

Lines 1137 to 1142 in 516e974

	if (kparam != NULL) {
	EVP_PKEY_CTX *pctx;
	pctx = CMS_SignerInfo_get0_pkey_ctx(si);
	if (!cms_set_pkey_param(pctx, kparam->param))
	goto end;
	}

[glorious064]

@glorious064 Would you like to fix that incidentally?

Sure, should I submit a new pull request?

[openssl-machine]

24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set. Please review the updates and set the label manually.

[InfoHunter]

Sure, should I submit a new pull request?

I don't think so, you can add new commits to this pull request.

[InfoHunter]

And you need to write a CLA: trivial line in the commit message.

[glorious064]

Ok, thanks for your advice.

…

----------Reply to Message---------- On Wed, Apr 2, 2025 20:58 PM Paul ***@***.***> wrote: And you need to write a CLA: trivial line in the commit message. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: ***@***.***> InfoHunter left a comment (openssl/openssl#27044) And you need to write a CLA: trivial line in the commit message. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: ***@***.***>

[glorious064]

And you need to write a CLA: trivial line in the commit message.

I have submitted a new commit. Please review it. The message includes CLA: trivial as requested.