Commit bee6ce2776 for strongswan.org

commit bee6ce27761e1f38958be36ebe6688ef963c3d22
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Fri Jun 19 11:57:48 2026 +0200

    x509: Avoid NULL-pointer dereference if issuerName is missing in attribute certificate

    If neither authoritiyKeyIdentifier nor issuerName are encoded in an
    attribute certificate, the validation in `acert_validator.c:verify()`
    will cause a NULL-pointer dereference via `issued_by()` (the lookup
    with NULL identity will enumerate all trusted certificates).

    Fixes: 26930a8c3e42 ("certificate factory can load certs from file")
    Fixes: CVE-2026-78130

diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
index 32f94c2896..a610d93aec 100644
--- a/src/libstrongswan/plugins/x509/x509_ac.c
+++ b/src/libstrongswan/plugins/x509/x509_ac.c
@@ -898,7 +898,11 @@ METHOD(certificate_t, has_issuer, id_match_t,
 	{
 		return ID_MATCH_PERFECT;
 	}
-	return this->issuerName->matches(this->issuerName, issuer);
+	if (this->issuerName)
+	{
+		return this->issuerName->matches(this->issuerName, issuer);
+	}
+	return ID_MATCH_NONE;
 }

 METHOD(certificate_t, issued_by, bool,
@@ -935,7 +939,8 @@ METHOD(certificate_t, issued_by, bool,
 	}
 	else
 	{
-		if (!this->issuerName->equals(this->issuerName,
+		if (!this->issuerName ||
+			!this->issuerName->equals(this->issuerName,
 									  issuer->get_subject(issuer)))
 		{
 			goto out;