Commit 8b9f7ea07b for openssl.org

commit 8b9f7ea07bf16e6d40b8f965dd4fe61654ea0760
Author: Hila Lee <hilalee.or@gmail.com>
Date:   Mon Jul 20 09:37:03 2026 +0300

    test/pkcs7_test: add NULL contents regression test

    Exercise the four sites guarded in the preceding commit using
    the public API PKCS7_set_content(p7, NULL) to reach the NULL state,
    then asserts each function returns the expected failure (NULL pointer
    return or zero return) instead of dereferencing NULL.

    Covers:
      PKCS7_dataInit   NID_pkcs7_signed
      PKCS7_dataInit   NID_pkcs7_digest
      PKCS7_dataDecode NID_pkcs7_signed
      PKCS7_set_detached -> PKCS7_ctrl PKCS7_OP_SET_DETACHED_SIGNATURE

    The test does not depend on EC and runs unconditionally.

    Reviewed-by: Richard Levitte <levitte@openssl.foundation>
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Fri Nov 13 05:51:53 2026
    Merged-from: https://github.com/openssl/openssl/pull/31391

diff --git a/test/pkcs7_test.c b/test/pkcs7_test.c
index ea0f2fa5e3..120cffbe8a 100644
--- a/test/pkcs7_test.c
+++ b/test/pkcs7_test.c
@@ -551,6 +551,58 @@ static int pkcs7_stream_non_data_test(void)
     return ret;
 }

+/*
+ * Regression test for the NULL p7->d.<sign|digest>->contents handling fixed
+ * by PR #30351 and this commit. PKCS7_set_content(p7, NULL) is a public API
+ * that legitimately produces this state; the affected functions used to
+ * dereference NULL via PKCS7_get_octet_string -> PKCS7_type_is_data. They
+ * must now return cleanly with PKCS7_R_NO_CONTENT.
+ */
+static int pkcs7_null_contents_test(void)
+{
+    PKCS7 *p7 = NULL;
+    int ret = 0;
+
+    /* PKCS7_dataInit, NID_pkcs7_signed */
+    if (!TEST_ptr(p7 = PKCS7_new())
+        || !TEST_true(PKCS7_set_type(p7, NID_pkcs7_signed))
+        || !TEST_true(PKCS7_set_content(p7, NULL))
+        || !TEST_ptr_null(PKCS7_dataInit(p7, NULL)))
+        goto end;
+    PKCS7_free(p7);
+    p7 = NULL;
+
+    /* PKCS7_dataInit, NID_pkcs7_digest */
+    if (!TEST_ptr(p7 = PKCS7_new())
+        || !TEST_true(PKCS7_set_type(p7, NID_pkcs7_digest))
+        || !TEST_true(PKCS7_set_content(p7, NULL))
+        || !TEST_ptr_null(PKCS7_dataInit(p7, NULL)))
+        goto end;
+    PKCS7_free(p7);
+    p7 = NULL;
+
+    /* PKCS7_dataDecode, NID_pkcs7_signed */
+    if (!TEST_ptr(p7 = PKCS7_new())
+        || !TEST_true(PKCS7_set_type(p7, NID_pkcs7_signed))
+        || !TEST_true(PKCS7_set_content(p7, NULL))
+        || !TEST_ptr_null(PKCS7_dataDecode(p7, NULL, NULL, NULL)))
+        goto end;
+    PKCS7_free(p7);
+    p7 = NULL;
+
+    /* PKCS7_set_detached -> PKCS7_ctrl OP_SET_DETACHED_SIGNATURE */
+    if (!TEST_ptr(p7 = PKCS7_new())
+        || !TEST_true(PKCS7_set_type(p7, NID_pkcs7_signed))
+        || !TEST_true(PKCS7_set_content(p7, NULL))
+        || !TEST_int_eq(PKCS7_set_detached(p7, 1), 0))
+        goto end;
+
+    ret = 1;
+end:
+    PKCS7_free(p7);
+    return ret;
+}
+
 int setup_tests(void)
 {
     const char *certin, *privkeyin;
@@ -584,6 +636,7 @@ int setup_tests(void)
     if (smimecap_cert != NULL && smimecap_privkey != NULL)
         ADD_TEST(test_pkcs7_smimecap);
     ADD_TEST(pkcs7_stream_non_data_test);
+    ADD_TEST(pkcs7_null_contents_test);
     return 1;
 }