Commit a61d8a1f1a for openssl.org

commit a61d8a1f1aa90044637c51b1313bf2405597a37c
Author: Norbert Pocs <norbertp@openssl.org>
Date:   Thu Aug 27 13:58:20 2026 +0200

    Guard comparision when values are NULL

    Fixes: CVE-2026-75805

    Signed-off-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Richard Levitte <levitte@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Tue Sep 29 11:00:49 2026

diff --git a/crypto/cmp/cmp_client.c b/crypto/cmp/cmp_client.c
index ba855858c7..ec09bcd4e3 100644
--- a/crypto/cmp/cmp_client.c
+++ b/crypto/cmp/cmp_client.c
@@ -996,16 +996,23 @@ int OSSL_CMP_exec_RR_ses(OSSL_CMP_CTX *ctx)
             ret = 0;
             goto err;
         }
-        if (X509_NAME_cmp(issuer, OSSL_CRMF_CERTID_get0_issuer(cid)) != 0) {
+        /*
+         * The issuer and serial number are absent if the certificate to be
+         * revoked was given as a PKCS#10 CSR, in which case there is nothing
+         * to check the CertId of the response against.
+         */
+        if (issuer != NULL
+            && X509_NAME_cmp(issuer, OSSL_CRMF_CERTID_get0_issuer(cid)) != 0) {
 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
             ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_CERTID_IN_RP);
             ret = 0;
             goto err;
 #endif
         }
-        if (ASN1_INTEGER_cmp(serial,
-                OSSL_CRMF_CERTID_get0_serialNumber(cid))
-            != 0) {
+        if (serial != NULL
+            && ASN1_INTEGER_cmp(serial,
+                   OSSL_CRMF_CERTID_get0_serialNumber(cid))
+                != 0) {
 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
             ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_SERIAL_IN_RP);
             ret = 0;