Commit aef4f28225 for openssl.org

commit aef4f282252261e1939386305c9b9729d45ec1c9
Author: Neil Horman <nhorman@openssl.org>
Date:   Thu Nov 12 16:09:25 2026 -0500

    ssl/ssl_lib.c: check return code of X509_up_ref() in ssl_ctx_find_hanshake_cert()

    Missed checking the up ref in this function when it was introduced
    in commit 54dacb1710cf "Cache decoded certs on client in CTX to avoid
    multiple asn1 parsing".  If X509_up_ref() fails, just return NULL
    to indicate that no cert was found.

    Resolves: https://github.com/openssl/openssl/issues/33418
    Fixes: 54dacb1710cf "Cache decoded certs on client in CTX to avoid multiple asn1 parsing"
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Bob Beck <beck@openssl.org>
    Merge-date: Sat Nov 14 04:40:27 2026
    Merged-from: https://github.com/openssl/openssl/pull/33702

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index a1330fa10a..336bd5efe1 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -4965,7 +4965,12 @@ X509 *ssl_ctx_find_handshake_cert(SSL_CTX *sctx, const unsigned char *certbytes,
     for (idx = 0; idx < cache_len; idx++) {
         find = sk_X509_HS_CACHE_ENT_value(sctx->handshake_certs, idx);
         if (!memcmp(find->sha1_hash, sha1_hash, SHA_DIGEST_LENGTH)) {
-            X509_up_ref(find->cert);
+            /*
+             * If for some reason we cant take the reference on the
+             * cert, just don't return one
+             */
+            if (!X509_up_ref(find->cert))
+                break;
             ret = find->cert;
             break;
         }