Commit 370b880290 for openssl.org

commit 370b8802901014b3d55412b13950d1b53410af07
Author: Nicky Mouha <nicky@mouha.be>
Date:   Sun Nov 8 20:41:31 2026 -0500

    crypto/cmp/cmp_asn.c: dereference keySpec after NULL check in OSSL_CMP_ITAV_get1_certReqTemplate() cleanup path

    So far, keySpec is never NULL when the code dereferences it in the err:
    bailout, but it guards against potential future mistakes.

    Complements: 6a3579e190fd "CMP: add support for requesting cert template using genm/genp"
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Tue Nov 10 16:06:24 2026
    Merged-from: https://github.com/openssl/openssl/pull/33609

diff --git a/crypto/cmp/cmp_asn.c b/crypto/cmp/cmp_asn.c
index 740e4466a1..f088ed9baa 100644
--- a/crypto/cmp/cmp_asn.c
+++ b/crypto/cmp/cmp_asn.c
@@ -462,9 +462,10 @@ int OSSL_CMP_ITAV_get1_certReqTemplate(const OSSL_CMP_ITAV *itav,
 err:
     OSSL_CRMF_CERTTEMPLATE_free(*certTemplate);
     *certTemplate = NULL;
-    sk_OSSL_CMP_ATAV_pop_free(*keySpec, OSSL_CMP_ATAV_free);
-    if (keySpec != NULL)
+    if (keySpec != NULL) {
+        sk_OSSL_CMP_ATAV_pop_free(*keySpec, OSSL_CMP_ATAV_free);
         *keySpec = NULL;
+    }
     return 0;
 }