Commit f9f6047e9c for openssl.org

commit f9f6047e9c0c8011d3c875003d4b03f74e05f295
Author: Bob Beck <beck@openssl.org>
Date:   Thu Aug 13 16:00:15 2026 -0600

    Allow pushing an empty ASN1_UTF8STRING onto a CMP freeText stack

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Aug 27 13:52:53 2026
    Merged-from: https://github.com/openssl/openssl/pull/32178

diff --git a/crypto/cmp/cmp_util.c b/crypto/cmp/cmp_util.c
index d6a24cf73d..769008f46a 100644
--- a/crypto/cmp/cmp_util.c
+++ b/crypto/cmp/cmp_util.c
@@ -224,7 +224,8 @@ int ossl_cmp_sk_ASN1_UTF8STRING_push_str(STACK_OF(ASN1_UTF8STRING) *sk,
 {
     ASN1_UTF8STRING *utf8string;

-    if (!ossl_assert(sk != NULL && text != NULL))
+    /* text == NULL with len == 0 is the canonical empty string and is valid */
+    if (!ossl_assert(sk != NULL && (text != NULL || len == 0)))
         return 0;
     if ((utf8string = ASN1_UTF8STRING_new()) == NULL)
         return 0;
diff --git a/test/cmp_hdr_test.c b/test/cmp_hdr_test.c
index 008ac4319f..f7950902e5 100644
--- a/test/cmp_hdr_test.c
+++ b/test/cmp_hdr_test.c
@@ -279,10 +279,11 @@ static int test_HDR_push0_freeText(void)
 static int execute_HDR_push1_freeText_test(CMP_HDR_TEST_FIXTURE *fixture)
 {
     ASN1_UTF8STRING *text = ASN1_UTF8STRING_new();
+    ASN1_UTF8STRING *empty = ASN1_UTF8STRING_new();
     ASN1_UTF8STRING *pushed_text;
     int res = 0;

-    if (!TEST_ptr(text))
+    if (!TEST_ptr(text) || !TEST_ptr(empty))
         goto err;

     if (!ASN1_STRING_set1_string(text, "A free text"))
@@ -295,9 +296,23 @@ static int execute_HDR_push1_freeText_test(CMP_HDR_TEST_FIXTURE *fixture)
     if (!TEST_int_eq(ASN1_STRING_cmp(text, pushed_text), 0))
         goto err;

+    /*
+     * An empty ASN1_UTF8STRING, as decoded from an empty UTF8String, has
+     * data == NULL and length == 0 and must still push successfully.
+     */
+    if (!TEST_int_eq(ossl_cmp_hdr_push1_freeText(fixture->hdr, empty), 1))
+        goto err;
+
+    if (!TEST_ptr(pushed_text = sk_ASN1_UTF8STRING_value(fixture->hdr->freeText, 1)))
+        goto err;
+
+    if (!TEST_int_eq(pushed_text->length, 0))
+        goto err;
+
     res = 1;
 err:
     ASN1_UTF8STRING_free(text);
+    ASN1_UTF8STRING_free(empty);

     return res;
 }