Commit c02973aa85 for openssl.org

commit c02973aa85b973de3f702566f48d31be17e54c7b
Author: Dailey, Alaric <alaricd@pengdows.com>
Date:   Sat Nov 7 06:56:44 2026 -0600

    ssl/t1_lib.c: always initialize sig.ctx in tls1_set_sigalgs_list()

    Always initialize the ctx field in the sig argument for the sig_cb()
    signature algorithm configuration parser callback, including
    when syntax is checked without an SSL_CTX.  This prevents sig_cb()
    from reading an uninitialized pointer while preserving the built-in
    algorithm lookup for syntax-only checks.

    Resolves: https://github.com/openssl/openssl/issues/33563
    Fixes: 4169d58c8557 "Allow provider sigalgs in SignatureAlgorithms conf"
    Assisted-by: ChatGPT:gpt-6
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Tue Nov 10 14:11:01 2026
    Merged-from: https://github.com/openssl/openssl/pull/33593

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 04d8ecb97b..3488d0a475 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -3995,9 +3995,7 @@ int tls1_set_sigalgs_list(SSL_CTX *ctx, CERT *c, const char *str, int client)
 {
     sig_cb_st sig;
     sig.sigalgcnt = 0;
-
-    if (ctx != NULL)
-        sig.ctx = ctx;
+    sig.ctx = ctx;
     if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
         return 0;
     if (sig.sigalgcnt == 0) {
diff --git a/test/sslapitest.c b/test/sslapitest.c
index 5cb06476e6..4d1a032b53 100644
--- a/test/sslapitest.c
+++ b/test/sslapitest.c
@@ -19385,6 +19385,30 @@ err:
     return ret;
 }

+static int test_ssl_conf_sigalgs_without_ctx(void)
+{
+    SSL_CONF_CTX *cctx = NULL;
+    int ret = 0;
+
+    if (!TEST_ptr(cctx = SSL_CONF_CTX_new()))
+        goto err;
+    if (!TEST_uint_eq(SSL_CONF_CTX_set_flags(cctx,
+                          SSL_CONF_FLAG_CMDLINE | SSL_CONF_FLAG_CLIENT),
+            SSL_CONF_FLAG_CMDLINE | SSL_CONF_FLAG_CLIENT))
+        goto err;
+    if (!TEST_int_eq(SSL_CONF_cmd(cctx, "-sigalgs", "RSA+SHA256"), 2)
+        || !TEST_int_eq(SSL_CONF_cmd(cctx, "-client_sigalgs",
+                            "rsa_pss_rsae_sha256"),
+            2))
+        goto err;
+
+    ret = 1;
+
+err:
+    SSL_CONF_CTX_free(cctx);
+    return ret;
+}
+
 /*
  * Test that SSL_CTX_set1_groups() when called with a list where the first
  * entry is unsupported, will send a key_share that uses the next usable entry.
@@ -19915,6 +19939,7 @@ int setup_tests(void)
 #endif
     ADD_ALL_TESTS(test_ssl_set_groups_unsupported_keyshare, 2);
     ADD_TEST(test_ssl_conf_flags);
+    ADD_TEST(test_ssl_conf_sigalgs_without_ctx);
     ADD_ALL_TESTS(test_http_verbs, 3);
 #if !defined(OSSL_NO_USABLE_TLS1_3)
     ADD_TEST(test_grease);