Commit cb1e161353 for openssl.org

commit cb1e161353deaea65fb0f5484aab06d1d76dc2d0
Author: Greensi7 <adam.tabak04@gmail.com>
Date:   Tue Aug 4 15:26:32 2026 +0200

    Fix NULL dereference in v2i_AUTHORITY_KEYID()

    X509V3_EXT_d2i() may return NULL on malformed input
    or on allocation failure. v2i_AUTHORITY_KEYID() passed
    that NULL to ASN1_STRING_length_ex() causing NULL dereference.

    Found by x509v3 fuzzer. Example fuzzer input:
    ```
    [default]
    subjectKeyIdentifier = DER:05:00
    authorityKeyIdentifier = keyid
    ```

    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
    MergeDate: Fri Aug  7 13:42:59 2026
    (Merged from https://github.com/openssl/openssl/pull/32177)

diff --git a/crypto/x509/v3_akid.c b/crypto/x509/v3_akid.c
index 95b904c757..9ecc22b670 100644
--- a/crypto/x509/v3_akid.c
+++ b/crypto/x509/v3_akid.c
@@ -184,7 +184,10 @@ static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
         i = X509_get_ext_by_NID(issuer_cert, NID_subject_key_identifier, -1);
         if (i >= 0 && (ext = X509_get_ext(issuer_cert, i)) != NULL
             && !(same_issuer && !ss)) {
-            ikeyid = X509V3_EXT_d2i(ext);
+
+            if ((ikeyid = X509V3_EXT_d2i(ext)) == NULL)
+                goto err;
+
             /* Ignore empty keyids in the issuer cert */
             if (ASN1_STRING_length_ex(ikeyid) == 0) {
                 ASN1_OCTET_STRING_free(ikeyid);