Don't attempt to up-ref an EVP_CIPHER if it is NULL
authorMatt Caswell <matt@openssl.org>
Fri, 27 Mar 2020 16:05:36 +0000 (16:05 +0000)
committerMatt Caswell <matt@openssl.org>
Mon, 30 Mar 2020 13:46:54 +0000 (14:46 +0100)
EVP_CIPHERs in the ssl_cipher_methods table can be NULL if
they are not available. We shouldn't attempt to up-ref a
cipher if it is NULL.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11426)

ssl/ssl_ciph.c

index 23d156a..745afae 100644 (file)
@@ -457,7 +457,10 @@ int ssl_cipher_get_evp_cipher(SSL_CTX *ctx, const SSL_CIPHER *sslc,
             if (*enc == NULL)
                 return 0;
         } else {
-            if (!ssl_evp_cipher_up_ref(ctx->ssl_cipher_methods[i]))
+            const EVP_CIPHER *cipher = ctx->ssl_cipher_methods[i];
+
+            if (cipher == NULL
+                    || !ssl_evp_cipher_up_ref(cipher))
                 return 0;
             *enc = ctx->ssl_cipher_methods[i];
         }