Commit fc4e557ecb for openssl.org

commit fc4e557ecb6406e421d452ce620d14fedecc4368
Author: Trust-Worthy <jondeveloper0@gmail.com>
Date:   Tue Sep 29 18:06:16 2026 -0400

    AES-OCB: reject a NULL input to update

    EVP_EncryptUpdate() with a NULL input buffer and a nonzero length read
    from the NULL pointer in CRYPTO_ocb128_aad(), a NULL-pointer dereference
    detected by ASan. Reject the call instead.

    Assisted-by: Claude:claude-opus-5-5
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Merge-date: Wed Oct 21 16:59:57 2026
    Merged-from: https://github.com/openssl/openssl/pull/33157

diff --git a/providers/implementations/ciphers/cipher_aes_ocb.c b/providers/implementations/ciphers/cipher_aes_ocb.c
index 433e026598..bb7231dd8a 100644
--- a/providers/implementations/ciphers/cipher_aes_ocb.c
+++ b/providers/implementations/ciphers/cipher_aes_ocb.c
@@ -251,6 +251,11 @@ static int aes_ocb_block_update(void *vctx, unsigned char *out, size_t *outl,
         return 1;
     }

+    if (in == NULL) {
+        ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
     /* Are we dealing with AAD or normal data here? */
     if (out == NULL) {
         buf = ctx->aad_buf;