Commit 38c7ace6c1 for openssl.org

commit 38c7ace6c17267ca9a5dde25c7f025ba418a0c36
Author: Nikola Pajkovsky <nikolap@openssl.org>
Date:   Tue Jun 30 09:01:20 2026 +0200

    crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_count() in x509_object_dup()

    the return value of X509_OBJECT_up_ref_count() was ignored. If the
    reference count increment fails, x509_object_dup() still returned a
    duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL
    without a reference actually having been taken. Freeing that duplicate
    later drops a reference it never held, leading to a premature free and
    use-after-free of the shared object.

    Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>

    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    MergeDate: Wed Jul  8 18:20:10 2026
    (Merged from https://github.com/openssl/openssl/pull/31811)

diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c
index 01e1969d19..d1f4c1eb40 100644
--- a/crypto/x509/x509_lu.c
+++ b/crypto/x509/x509_lu.c
@@ -741,7 +741,12 @@ static X509_OBJECT *x509_object_dup(const X509_OBJECT *obj)

     ret->type = obj->type;
     ret->data = obj->data;
-    X509_OBJECT_up_ref_count(ret);
+
+    if (!X509_OBJECT_up_ref_count(ret)) {
+        OPENSSL_free(ret);
+        return NULL;
+    }
+
     return ret;
 }