Commit 293b55de0c for openssl.org

commit 293b55de0c434a99d0e744d0521170ca280606a9
Author: Daniel Kubec <kubec@openssl.org>
Date:   Fri Jan 9 14:33:24 2026 +0100

    ossl_quic_get_cipher_by_char(): Add a NULL guard before dereferencing SSL_CIPHER

    Fixes CVE-2025-15468

    Reviewed-by: Saša Nedvědický <sashan@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.org>
    MergeDate: Mon Jan 26 19:36:04 2026

diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
index 04004980db..70e0744aef 100644
--- a/ssl/quic/quic_impl.c
+++ b/ssl/quic/quic_impl.c
@@ -5236,6 +5236,8 @@ const SSL_CIPHER *ossl_quic_get_cipher_by_char(const unsigned char *p)
 {
     const SSL_CIPHER *ciph = ssl3_get_cipher_by_char(p);

+    if (ciph == NULL)
+        return NULL;
     if ((ciph->algorithm2 & SSL_QUIC) == 0)
         return NULL;