Commit 022a99e2b5 for openssl.org

commit 022a99e2b50cccb94b7d3efb7080077c28276272
Author: Daniel Kubec <kubec@openssl.foundation>
Date:   Tue Jul 21 11:19:29 2026 +0200

    Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg

    ossl_cmp_calc_protection() only checked whether the protectionAlg parameter
    (ppval) was NULL before treating it as a PBMParameter ASN1_STRING.

    X509_ALGOR_get0() does not validate the ASN.1 type of the parameter against what
    the caller expects. For id-PasswordBasedMAC, a crafted message can encode the
    parameter as a BOOLEAN instead of the expected PBMParameter SEQUENCE. Because
    the ASN1_TYPE value union overlays the boolean int on the pointer field, ppval
    comes back as a bogus non-NULL pointer (e.g. 0xff).

    Fixes CVE-2026-63076

    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    Merge-date: Sat Aug 22 06:10:03 2026

diff --git a/crypto/cmp/cmp_protect.c b/crypto/cmp/cmp_protect.c
index fa8d128617..f3cec78af5 100644
--- a/crypto/cmp/cmp_protect.c
+++ b/crypto/cmp/cmp_protect.c
@@ -59,7 +59,7 @@ ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
             ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
             return NULL;
         }
-        if (ppval == NULL) {
+        if (pptype != V_ASN1_SEQUENCE || ppval == NULL) {
             ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
             return NULL;
         }