From aea2d74bdce61c8aaa942cf03fb1ca9761e9f3a8 Mon Sep 17 00:00:00 2001 From: yuanjungong Date: Thu, 7 Apr 2022 12:35:59 +0800 Subject: [PATCH] Crypto/evp: Fix null pointer dereference Check the return value of EVP_KDF_fetch to avoid a potential null pointer dereference. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/18062) (cherry picked from commit 5f1424c6bdca8ddb9d5d88a78a1d738be19c4ea8) --- crypto/evp/p5_crpt2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/evp/p5_crpt2.c b/crypto/evp/p5_crpt2.c index 7088875fe1..4c82241f37 100644 --- a/crypto/evp/p5_crpt2.c +++ b/crypto/evp/p5_crpt2.c @@ -42,6 +42,8 @@ int ossl_pkcs5_pbkdf2_hmac_ex(const char *pass, int passlen, salt = (unsigned char *)empty; kdf = EVP_KDF_fetch(libctx, OSSL_KDF_NAME_PBKDF2, propq); + if (kdf == NULL) + return 0; kctx = EVP_KDF_CTX_new(kdf); EVP_KDF_free(kdf); if (kctx == NULL) -- 2.34.1