PKCS7_stream: don't crash on omitted content

Do not access the PKCS7 content union without checking that it's actually
populated. Add NULL checks and fail. Whether that's the correct thing
to do is dubious, but since this has been broken since the "code" was
written a quarter century ago, clearly nobody ever wanted to do that.
Match OpenSSL behavior which also means more NULL checks than strictly
make sense.

CMS_stream() has very similar code, but it's not problematic in this
particular way because the content isn't OPTIONAL.

Part of a diff from Acts1631

1 files changed, 15 insertions, 1 deletions

diff --git a/src/lib/libcrypto/pkcs7/pk7_lib.c b/src/lib/libcrypto/pkcs7/pk7_lib.c
index 8712a2ecc1..9ade3df552 100644
--- a/src/lib/libcrypto/pkcs7/pk7_lib.c
+++ b/src/lib/libcrypto/pkcs7/pk7_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_lib.c,v 1.31 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: pk7_lib.c,v 1.32 2026/08/30 16:52:56 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -650,6 +650,11 @@ PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
                 break;
 
         case NID_pkcs7_signedAndEnveloped:
+                if (p7->d.signed_and_enveloped == NULL ||
+                    p7->d.signed_and_enveloped->enc_data == NULL) {
+                        PKCS7error(PKCS7_R_NO_CONTENT);
+                        break;
+                }
                 os = p7->d.signed_and_enveloped->enc_data->enc_data;
                 if (os == NULL) {
                         os = ASN1_OCTET_STRING_new();
@@ -658,6 +663,11 @@ PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
                 break;
 
         case NID_pkcs7_enveloped:
+                if (p7->d.enveloped == NULL ||
+                    p7->d.enveloped->enc_data == NULL) {
+                        PKCS7error(PKCS7_R_NO_CONTENT);
+                        break;
+                }
                 os = p7->d.enveloped->enc_data->enc_data;
                 if (os == NULL) {
                         os = ASN1_OCTET_STRING_new();
@@ -666,6 +676,10 @@ PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
                 break;
 
         case NID_pkcs7_signed:
+                if (p7->d.sign == NULL || p7->d.sign->contents == NULL) {
+                        PKCS7error(PKCS7_R_NO_CONTENT);
+                        break;
+                }
                 os = p7->d.sign->contents->d.data;
                 break;