[PATCH] OpenSSL: Skip NULL results when loading keys/certs from a provider store

[Josephine Pfeiffer]

provider_load_key() and provider_load_cert() iterate an OSSL_STORE with

	while (!OSSL_STORE_eof(store)) {
		info = OSSL_STORE_load(store);
		if (OSSL_STORE_INFO_get_type(info) == ...)

OSSL_STORE_load() can return NULL for an individual object without the
store having reached EOF, for example when a PKCS#11 provider enumerates
an object it cannot return. OSSL_STORE_INFO_get_type(NULL) then
dereferences a NULL pointer and crashes.

This was hit with a PKCS#11 token accessed through pkcs11-provider: loading
the EAP-TLS client private key aborted wpa_supplicant with a SIGSEGV in
OSSL_STORE_INFO_get_type() called from eap_peer_tls_ssl_init(). A softhsm2
token in the same code path did not trigger it because it never returned a
NULL mid-enumeration.

Skip NULL results instead of dereferencing them, and stop the loop on a
hard store error so a loader that returns NULL without advancing cannot
spin forever.

Signed-off-by: Josephine Pfeiffer <hi at josie.lol>
---
Reproduced on Fedora Rawhide (wpa_supplicant 2.11, OpenSSL 4.0.1,
pkcs11-provider 1.2.0) doing 802.1X EAP-TLS with the client private key on
a Securosys CloudHSM token: OSSL_STORE_load() returned NULL for one object
mid-enumeration and wpa_supplicant crashed in OSSL_STORE_INFO_get_type(). A
softhsm2 token did not hit it. With this change the same setup loads the key
and completes EAP-TLS.

Confirmed the OSSL_STORE_error() break does not fire on the benign NULL: the
same EAP-TLS test still authenticates with the guard in place, so it only
stops the loop when a loader cannot make progress.

 src/crypto/tls_openssl.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 292017cc4..463f67ee9 100644
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -440,6 +440,11 @@ static EVP_PKEY * provider_load_key(const char *uri)
 
 	while (!OSSL_STORE_eof(store)) {
 		info = OSSL_STORE_load(store);
+		if (!info) {
+			if (OSSL_STORE_error(store))
+				break;
+			continue;
+		}
 		if ((OSSL_STORE_INFO_get_type(info)) == OSSL_STORE_INFO_PKEY)
 			key = OSSL_STORE_INFO_get1_PKEY(info);
 
@@ -481,6 +486,11 @@ static X509 * provider_load_cert(const char *cert_id)
 
 	while (!OSSL_STORE_eof(store)) {
 		info = OSSL_STORE_load(store);
+		if (!info) {
+			if (OSSL_STORE_error(store))
+				break;
+			continue;
+		}
 		if ((OSSL_STORE_INFO_get_type(info)) == OSSL_STORE_INFO_CERT)
 			cert = OSSL_STORE_INFO_get1_CERT(info);
 
-- 
2.54.0