Commit 87fe17d722 for openssl.org

commit 87fe17d72264c850bac0f477b18cd33be65aca43
Author: Hila Lee <hilalee.or@gmail.com>
Date:   Mon Jul 20 09:37:03 2026 +0300

    pkcs7: fix four more NULL contents dereferences

    PR #30351[1] added NULL-contents guards in PKCS7_dataFinal,
    PKCS7_stream, and PKCS7_ctrl (OP_GET_DETACHED_SIGNATURE), but missed
    four sibling sites with the same crash signature:

      - PKCS7_dataInit, NID_pkcs7_signed   (pk7_doit.c)
      - PKCS7_dataInit, NID_pkcs7_digest   (pk7_doit.c)
      - PKCS7_dataDecode, NID_pkcs7_signed (pk7_doit.c)
      - PKCS7_ctrl OP_SET_DETACHED_SIGNATURE (pk7_lib.c, the case adjacent
        to the one fixed at OP_GET_DETACHED_SIGNATURE)

    All four pass p7->d.<sign|digest>->contents (which may be NULL)
    to PKCS7_get_octet_string(), which calls PKCS7_type_is_data on a NULL
    pointer, dereferencing NULL->type.  Add the same guard pattern
    PR #30351[1] used.

    [1] https://github.com/openssl/openssl/pull/30351

    Reviewed-by: Richard Levitte <levitte@openssl.foundation>
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Fri Nov 13 05:51:51 2026
    Merged-from: https://github.com/openssl/openssl/pull/31391

diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 3799dec1da..c46d9e2348 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -263,6 +263,10 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
     switch (i) {
     case NID_pkcs7_signed:
         md_sk = p7->d.sign->md_algs;
+        if (p7->d.sign->contents == NULL) {
+            ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT);
+            goto err;
+        }
         os = pkcs7_get1_data(p7->d.sign->contents,
             (p7->state & PKCS7_STATE_STREAMING) != 0);
         break;
@@ -287,6 +291,10 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
         break;
     case NID_pkcs7_digest:
         xa = p7->d.digest->md;
+        if (p7->d.digest->contents == NULL) {
+            ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT);
+            goto err;
+        }
         os = pkcs7_get1_data(p7->d.digest->contents,
             (p7->state & PKCS7_STATE_STREAMING) != 0);
         break;
@@ -470,6 +478,10 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
          * data_body is NULL if that structure has no (=detached) content
          * or if the contentType is wrong (i.e., not "data").
          */
+        if (p7->d.sign->contents == NULL) {
+            ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT);
+            goto err;
+        }
         data_body = PKCS7_get_octet_string(p7->d.sign->contents);
         if (!PKCS7_is_detached(p7) && data_body == NULL) {
             ERR_raise(ERR_LIB_PKCS7, PKCS7_R_INVALID_SIGNED_DATA_TYPE);
diff --git a/crypto/pkcs7/pk7_lib.c b/crypto/pkcs7/pk7_lib.c
index 7e085309a6..b1ac74df3c 100644
--- a/crypto/pkcs7/pk7_lib.c
+++ b/crypto/pkcs7/pk7_lib.c
@@ -28,7 +28,7 @@ long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg)
     /* NOTE(emilia): does not support detached digested data. */
     case PKCS7_OP_SET_DETACHED_SIGNATURE:
         if (nid == NID_pkcs7_signed) {
-            if (p7->d.sign == NULL) {
+            if (p7->d.sign == NULL || p7->d.sign->contents == NULL) {
                 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT);
                 ret = 0;
                 break;