From a257de2688d6ed88ec29fe7e8a5cc867c3a790f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kai=20L=C3=BCke?= Date: Tue, 11 Aug 2026 00:10:06 +0900 Subject: [PATCH] pkcs7: Correct error handling for pkcs7_extract_signers The lack of error handling for sym_i2d_X509_NAME/sym_i2d_ASN1_INTEGER means that we get a NULL iovec that will cause an assertion failure later. The use of regular free for OpenSSL is probably okay but since the allocator can differ, one should use OPENSSL_free. Add error handling and do an explicit copy instead of ownership transfer between possibly different allocators. --- src/shared/pkcs7-util.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/src/shared/pkcs7-util.c b/src/shared/pkcs7-util.c index 4d22d90421..36a46cf9ab 100644 --- a/src/shared/pkcs7-util.c +++ b/src/shared/pkcs7-util.c @@ -2,6 +2,7 @@ #include "alloc-util.h" #include "crypto-util.h" +#include "iovec-util.h" #include "pkcs7-util.h" #include "log.h" @@ -72,13 +73,19 @@ int pkcs7_extract_signers( return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get signer information."); _cleanup_(signer_done) Signer signer = {}; + _cleanup_(OPENSSL_freep) void *issuer = NULL, *serial = NULL; - _cleanup_free_ unsigned char *p = NULL; - int len = sym_i2d_X509_NAME(si->issuer_and_serial->issuer, &p); - signer.issuer = IOVEC_MAKE(TAKE_PTR(p), len); + int len = sym_i2d_X509_NAME(si->issuer_and_serial->issuer, (unsigned char**) &issuer); + if (len < 0) + return log_openssl_errors(LOG_DEBUG, "Failed to convert issuer name to DER format"); + if (!iovec_memdup(&IOVEC_MAKE(issuer, len), &signer.issuer)) + return log_oom_debug(); - len = sym_i2d_ASN1_INTEGER(si->issuer_and_serial->serial, &p); - signer.serial = IOVEC_MAKE(TAKE_PTR(p), len); + len = sym_i2d_ASN1_INTEGER(si->issuer_and_serial->serial, (unsigned char**) &serial); + if (len < 0) + return log_openssl_errors(LOG_DEBUG, "Failed to convert serial number to DER format"); + if (!iovec_memdup(&IOVEC_MAKE(serial, len), &signer.serial)) + return log_oom_debug(); signers[n_signers++] = TAKE_STRUCT(signer); }