Commit ec24702d39 for openssl.org

commit ec24702d399ace69848b9346b082466a7dd324c9
Author: Greensi7 <adam.tabak04@gmail.com>
Date:   Thu Sep 3 22:31:22 2026 +0200

    Fix NULL dereference and memory leak in ASN1_item_dup()

    If ASN1_item_d2i_ex() fails asn1_cb() can dereference return
    value of ASN1_item_d2i_ex() which is NULL causing NULL dereference.
    Also if ASN1_item_d2i_ex() succeeds and asn1_cb() fails it causes
    a memory leak.

    Found by: x509_req fuzzer (MFAIL test).
    Assisted-by: ChatGPT:gpt-5.6

    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Bob Beck <beck@openssl.org>
    Merge-date: Tue Sep 15 10:30:31 2026
    Merged-from: https://github.com/openssl/openssl/pull/32691

diff --git a/crypto/asn1/a_dup.c b/crypto/asn1/a_dup.c
index 48f5b3f6a4..5c43ccdd03 100644
--- a/crypto/asn1/a_dup.c
+++ b/crypto/asn1/a_dup.c
@@ -82,10 +82,15 @@ void *ASN1_item_dup(const ASN1_ITEM *it, const void *x)
     p = b;
     ret = ASN1_item_d2i_ex(NULL, &p, i, it, libctx, propq);
     OPENSSL_free(b);
+    if (ret == NULL)
+        return NULL;

     if (asn1_cb != NULL
-        && !asn1_cb(ASN1_OP_DUP_POST, &ret, it, (void *)x))
-        goto auxerr;
+        && !asn1_cb(ASN1_OP_DUP_POST, &ret, it, (void *)x)) {
+        ASN1_item_free(ret, it);
+        ERR_raise_data(ERR_LIB_ASN1, ASN1_R_AUX_ERROR, "Type=%s", it->sname);
+        return NULL;
+    }

     return ret;