From b926f9deb3dc79d00f0a989370e95867516a3a17 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Mon, 8 Apr 2019 11:22:37 +0100 Subject: [PATCH] Fix crash in X509_STORE_CTX_get_by_subject If using a custom X509_LOOKUP_METHOD then calls to X509_STORE_CTX_get_by_subject may crash due to an incorrectly initialised X509_OBJECT being passed to the callback get_by_subject function. Fixes #8673 Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/8698) --- crypto/x509/x509_lu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c index fa8153d3bc..e994633f25 100644 --- a/crypto/x509/x509_lu.c +++ b/crypto/x509/x509_lu.c @@ -297,6 +297,9 @@ int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type, if (ctx == NULL) return 0; + stmp.type = X509_LU_NONE; + stmp.data.ptr = NULL; + CRYPTO_THREAD_write_lock(ctx->lock); tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name); CRYPTO_THREAD_unlock(ctx->lock);