x509_addr: do not call memcmp() on NULL

If the minimum length is 0, either a->data or b->data could be NULL, so
do not call memcmp() and let the length comparison decide. Doing it this
way preserves the RFC 3779, section 2.2.3.3 semantics and avoids the UB.

A valid IPAddressFamily has an addressFamily element of 2 or 3 octets:
2 octets for the AFI and 1 octet for the optional SAFI. The check as
it is written compares the AFIs and, if they're equal, lets absent SAFI
be smaller than any other SAFI. So IPv4 (0x0001) sorts before IPv4
unicast (0x000101) and that in turn sorts before IPv6 (0x0002).

Found by beck while breaking OpenSSL

ok kenjiro

1 files changed, 5 insertions, 5 deletions

diff --git a/src/lib/libcrypto/x509/x509_addr.c b/src/lib/libcrypto/x509/x509_addr.c
index ef2f7e0889..c48a0ab118 100644
--- a/src/lib/libcrypto/x509/x509_addr.c
+++ b/src/lib/libcrypto/x509/x509_addr.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: x509_addr.c,v 1.95 2026/04/26 17:58:58 tb Exp $ */
+/*      $OpenBSD: x509_addr.c,v 1.96 2026/05/18 04:24:01 tb Exp $ */
 /*
  * Contributed to the OpenSSL Project by the American Registry for
  * Internet Numbers ("ARIN").
@@ -504,10 +504,10 @@ IPAddressFamily_cmp(const IPAddressFamily *const *a_,
         const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
         int len, cmp;
 
-        len = MINIMUM(a->length, b->length);
-
-        if ((cmp = memcmp(a->data, b->data, len)) != 0)
-                return cmp;
+        if ((len = MINIMUM(a->length, b->length)) != 0) {
+                if ((cmp = memcmp(a->data, b->data, len)) != 0)
+                        return cmp;
+        }
 
         return a->length - b->length;
 }