Commit f8cc08349d for openssl.org

commit f8cc08349d89db6a190cd5da00b3975cfc47cef2
Author: Dmitry Belyavskiy <beldmit@gmail.com>
Date:   Mon Jun 22 15:59:04 2026 +0200

    Fix crash on programmatically added X509 extensions

    Fixes: #23664

    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Simo Sorce <simo@redhat.com>
    MergeDate: Thu Sep 10 19:05:24 2026
    (Merged from https://github.com/openssl/openssl/pull/31636)

diff --git a/crypto/x509/v3_conf.c b/crypto/x509/v3_conf.c
index 6b6f845735..520453a913 100644
--- a/crypto/x509/v3_conf.c
+++ b/crypto/x509/v3_conf.c
@@ -58,7 +58,14 @@ static X509_EXTENSION *X509V3_EXT_nconf_int(CONF *conf, X509V3_CTX *ctx,
 X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, const char *name,
     const char *value)
 {
-    return X509V3_EXT_nconf_int(conf, ctx, NULL, name, value);
+    X509V3_CTX tmpctx;
+
+    if (ctx == NULL) {
+        X509V3_set_ctx(&tmpctx, NULL, NULL, NULL, NULL, 0);
+        X509V3_set_nconf(&tmpctx, conf);
+    }
+
+    return X509V3_EXT_nconf_int(conf, ctx ? ctx : &tmpctx, NULL, name, value);
 }

 X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid,
@@ -66,12 +73,18 @@ X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid,
 {
     int crit;
     int ext_type;
+    X509V3_CTX tmpctx;
+
+    if (ctx == NULL) {
+        X509V3_set_ctx(&tmpctx, NULL, NULL, NULL, NULL, 0);
+        X509V3_set_nconf(&tmpctx, conf);
+    }

     crit = v3_check_critical(&value);
     if ((ext_type = v3_check_generic(&value)))
         return v3_generic_extension(OBJ_nid2sn(ext_nid),
-            value, crit, ext_type, ctx);
-    return do_ext_nconf(conf, ctx, ext_nid, crit, value);
+            value, crit, ext_type, ctx ? ctx : &tmpctx);
+    return do_ext_nconf(conf, ctx ? ctx : &tmpctx, ext_nid, crit, value);
 }

 /* CONF *conf:  Config file    */
@@ -313,6 +326,13 @@ int X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, const char *section,
     STACK_OF(CONF_VALUE) *nval;
     const CONF_VALUE *val;
     int i, akid = -1, skid = -1;
+    X509V3_CTX tmpctx;
+
+    if (ctx == NULL) {
+        X509V3_set_ctx(&tmpctx, NULL, NULL, NULL, NULL, 0);
+        X509V3_set_nconf(&tmpctx, conf);
+        ctx = &tmpctx;
+    }

     if ((nval = NCONF_get_section(conf, section)) == NULL)
         return 0;