Commit a857515a09 for openssl.org

commit a857515a0984d869d761a9db194b06e8e8be303f
Author: Greensi7 <adam.tabak04@gmail.com>
Date:   Sun Aug 16 23:41:28 2026 +0200

    Fix bugs in OSSL_STORE_attach

    Unify error handling in OSSL_STORE_attach with OSSL_STORE_open_ex.

    If setting loader params fails loader_ctx is closed but not set to NULL.
    Which leads to successful return with invalid object.
    Fixed by setting loader_ctx to NULL triggering error return path.

    If allocation OSSL_STORE_CTX fails after the loader context creation
    close the loader context and release the fetched loader.
    This covers both OSSL_STORE_CTX allocation failure and UI method setup failure.

    Found by : store fuzzer (MFAIL-test)

    Assisted-by: ChatGPT:gpt-5.6

    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    MergeDate: Tue Sep 15 14:20:01 2026
    (Merged from https://github.com/openssl/openssl/pull/32413)

diff --git a/crypto/store/store_lib.c b/crypto/store/store_lib.c
index 23d229b59e..902dd3cf6d 100644
--- a/crypto/store/store_lib.c
+++ b/crypto/store/store_lib.c
@@ -1092,6 +1092,7 @@ OSSL_STORE_CTX *OSSL_STORE_attach(BIO *bp, const char *scheme,
         } else if (!loader_set_params(fetched_loader, loader_ctx,
                        params, propq)) {
             (void)fetched_loader->p_close(loader_ctx);
+            loader_ctx = NULL;
             OSSL_STORE_LOADER_free(fetched_loader);
             fetched_loader = NULL;
         }
@@ -1100,20 +1101,16 @@ OSSL_STORE_CTX *OSSL_STORE_attach(BIO *bp, const char *scheme,
     }

     if (loader_ctx == NULL) {
-        ERR_clear_last_mark();
-        return NULL;
+        goto err;
     }

     if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
-        ERR_clear_last_mark();
-        return NULL;
+        goto err;
     }

     if (ui_method != NULL
         && !ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data)) {
-        ERR_clear_last_mark();
-        OPENSSL_free(ctx);
-        return NULL;
+        goto err;
     }

     ctx->fetched_loader = fetched_loader;
@@ -1130,4 +1127,28 @@ OSSL_STORE_CTX *OSSL_STORE_attach(BIO *bp, const char *scheme,
     ERR_pop_to_mark();

     return ctx;
+
+err:
+    ERR_clear_last_mark();
+    if (loader_ctx != NULL) {
+        /*
+         * Temporary structure so OSSL_STORE_close() can work even when
+         * |ctx| couldn't be allocated or initialized properly.
+         */
+        OSSL_STORE_CTX tmpctx = {
+            NULL,
+        };
+
+        tmpctx.fetched_loader = fetched_loader;
+        tmpctx.loader = loader;
+        tmpctx.loader_ctx = loader_ctx;
+
+        /* We return NULL regardless of an error while closing. */
+        (void)ossl_store_close_it(&tmpctx);
+        fetched_loader = NULL;
+    }
+
+    OSSL_STORE_LOADER_free(fetched_loader);
+    OPENSSL_free(ctx);
+    return NULL;
 }