CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/08/30 10:52:56
Modified files:
lib/libcrypto/pkcs7: pk7_lib.c
Log message:
PKCS7_stream: don't crash on omitted content
Do not access the PKCS7 content union without checking that it's actually
populated. Add NULL checks and fail. Whether that's the correct thing
to do is dubious, but since this has been broken since the "code" was
written a quarter century ago, clearly nobody ever wanted to do that.
Match OpenSSL behavior which also means more NULL checks than strictly
make sense.
CMS_stream() has very similar code, but it's not problematic in this
particular way because the content isn't OPTIONAL.
Part of a diff from Acts1631
