Add NULL checks to HKDF and TLS1-PRF EVP_PKEY cleanup functions

Check if ctx->data is NULL before calling freezero(). Also add
HKDF and TLS1-PRF to the EVP_PKEY cleanup regression test, as
they no longer crash with this change.

ok tb@

1 files changed, 4 insertions, 1 deletions

diff --git a/src/lib/libcrypto/kdf/hkdf_evp.c b/src/lib/libcrypto/kdf/hkdf_evp.c
index 90686a56f9..dee6e35d82 100644
--- a/src/lib/libcrypto/kdf/hkdf_evp.c
+++ b/src/lib/libcrypto/kdf/hkdf_evp.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: hkdf_evp.c,v 1.21 2025/05/10 05:54:38 tb Exp $ */
+/*      $OpenBSD: hkdf_evp.c,v 1.22 2025/05/21 03:53:20 kenjiro Exp $ */
 /* ====================================================================
  * Copyright (c) 2016-2018 The OpenSSL Project.  All rights reserved.
  *
@@ -90,6 +90,9 @@ pkey_hkdf_cleanup(EVP_PKEY_CTX *ctx)
 {
         HKDF_PKEY_CTX *kctx = ctx->data;
 
+        if (kctx == NULL)
+                return;
+
         freezero(kctx->salt, kctx->salt_len);
         freezero(kctx->key, kctx->key_len);
         freezero(kctx, sizeof(*kctx));