Commit 0e2a7f2338 for openssl.org

commit 0e2a7f23387cf7b7cd22832c1f5bdc1200683d6e
Author: Daniel Kubec <kubec@openssl.foundation>
Date:   Thu Oct 1 19:58:12 2026 +0200

    apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()

    The issuer and the serialNumber are independently OPTIONAL
    in a CertTemplate.  A component absent from the request cannot confirm
    a match with the reference cert, and ASN1_INTEGER_cmp() does not accept
    NULL, so require each component the reference cert has to be present
    in the request and to be equal.

    Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests"
    References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()"
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Sat Oct 24 09:44:19 2026
    Merged-from: https://github.com/openssl/openssl/pull/33071

diff --git a/apps/lib/cmp_mock_srv.c b/apps/lib/cmp_mock_srv.c
index c538c04d28..e8a289f313 100644
--- a/apps/lib/cmp_mock_srv.c
+++ b/apps/lib/cmp_mock_srv.c
@@ -274,8 +274,11 @@ static int refcert_cmp(const X509 *refcert,
         return 1;
     ref_issuer = X509_get_issuer_name(refcert);
     ref_serial = X509_get0_serialNumber(refcert);
-    return (ref_issuer == NULL || X509_NAME_cmp(issuer, ref_issuer) == 0)
-        && (ref_serial == NULL || ASN1_INTEGER_cmp(serial, ref_serial) == 0);
+    if (ref_issuer != NULL
+        && (issuer == NULL || X509_NAME_cmp(issuer, ref_issuer) != 0))
+        return 0;
+    return ref_serial == NULL
+        || (serial != NULL && ASN1_INTEGER_cmp(serial, ref_serial) == 0);
 }

 /* reset the state that belongs to a transaction */