Commit 71a0acd3a5 for openssl.org

commit 71a0acd3a5c200a0590499bcd660f437e9cf5efb
Author: Bob Beck <beck@openssl.org>
Date:   Tue Aug 11 11:28:43 2026 -0600

    Don't do pointer arithmetic on a NULL pointer in OPENSSL_uni2asc

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Aug 27 13:52:52 2026
    Merged-from: https://github.com/openssl/openssl/pull/32178

diff --git a/crypto/pkcs12/p12_utl.c b/crypto/pkcs12/p12_utl.c
index 3c19f727a1..dd8e969767 100644
--- a/crypto/pkcs12/p12_utl.c
+++ b/crypto/pkcs12/p12_utl.c
@@ -57,11 +57,15 @@ char *OPENSSL_uni2asc(const unsigned char *uni, int unilen)
     /* If no terminating zero allow for one */
     if (!unilen || uni[unilen - 1])
         asclen++;
-    uni++;
     if ((asctmp = OPENSSL_malloc(asclen)) == NULL)
         return NULL;
+    /*
+     * Take the low byte of each big-endian UTF-16 unit. Index from the
+     * caller's pointer rather than incrementing it first, so that a zero
+     * length input does not do pointer arithmetic on a NULL pointer.
+     */
     for (i = 0; i < unilen; i += 2)
-        asctmp[i >> 1] = uni[i];
+        asctmp[i >> 1] = uni[i + 1];
     asctmp[asclen - 1] = 0;
     return asctmp;
 }
diff --git a/test/asn1_internal_test.c b/test/asn1_internal_test.c
index ac2dd9ec8d..c5a9e41a65 100644
--- a/test/asn1_internal_test.c
+++ b/test/asn1_internal_test.c
@@ -591,6 +591,32 @@ static int test_ossl_uni2utf8(void)
     return ok;
 }

+static int test_empty_uni_conversions(void)
+{
+    char *out = NULL;
+    int ok = 0;
+
+    /*
+     * A decoded empty BMPString is a NULL data pointer with a zero length,
+     * which is how an empty PKCS12 friendlyName reaches these functions by
+     * way of ASN1_STRING_get0_data().
+     */
+    if (!TEST_ptr(out = OPENSSL_uni2asc(NULL, 0))
+        || !TEST_str_eq(out, ""))
+        goto err;
+    OPENSSL_free(out);
+    out = NULL;
+
+    if (!TEST_ptr(out = OPENSSL_uni2utf8(NULL, 0))
+        || !TEST_str_eq(out, ""))
+        goto err;
+
+    ok = 1;
+err:
+    OPENSSL_free(out);
+    return ok;
+}
+
 static int test_asn1_string_to_utf8(void)
 {
     static const unsigned char bmp[] = { 0x00, 'A', 0x00, 'B' };
@@ -670,6 +696,7 @@ int setup_tests(void)
     ADD_TEST(test_asn1_time_tm_conversions);
     ADD_TEST(test_mbstring_ncopy);
     ADD_TEST(test_ossl_uni2utf8);
+    ADD_TEST(test_empty_uni_conversions);
     ADD_TEST(test_asn1_string_to_utf8);
     return 1;
 }