[PATCH] OpenSSL: Skip NULL results when loading keys/certs from a provider store

[Jouni Malinen]

On Wed, Jul 22, 2026 at 12:42:44PM +0200, Josephine Pfeiffer wrote:
> provider_load_key() and provider_load_cert() iterate an OSSL_STORE with
> 
> 	while (!OSSL_STORE_eof(store)) {
> 		info = OSSL_STORE_load(store);
> 		if (OSSL_STORE_INFO_get_type(info) == ...)
> 
> OSSL_STORE_load() can return NULL for an individual object without the
> store having reached EOF, for example when a PKCS#11 provider enumerates
> an object it cannot return. OSSL_STORE_INFO_get_type(NULL) then
> dereferences a NULL pointer and crashes.
> 
> This was hit with a PKCS#11 token accessed through pkcs11-provider: loading
> the EAP-TLS client private key aborted wpa_supplicant with a SIGSEGV in
> OSSL_STORE_INFO_get_type() called from eap_peer_tls_ssl_init(). A softhsm2
> token in the same code path did not trigger it because it never returned a
> NULL mid-enumeration.
> 
> Skip NULL results instead of dereferencing them, and stop the loop on a
> hard store error so a loader that returns NULL without advancing cannot
> spin forever.

Thanks, applied.
 
-- 
Jouni Malinen                                            PGP id EFC895FA