From 8bb94b7a3d27460eb52d28debd9344cbb83a1108 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Mon, 18 May 2026 04:24:01 +0000
Subject: x509_addr: do not call memcmp() on NULL

If the minimum length is 0, either a->data or b->data could be NULL, so
do not call memcmp() and let the length comparison decide. Doing it this
way preserves the RFC 3779, section 2.2.3.3 semantics and avoids the UB.

A valid IPAddressFamily has an addressFamily element of 2 or 3 octets:
2 octets for the AFI and 1 octet for the optional SAFI. The check as
it is written compares the AFIs and, if they're equal, lets absent SAFI
be smaller than any other SAFI. So IPv4 (0x0001) sorts before IPv4
unicast (0x000101) and that in turn sorts before IPv6 (0x0002).

Found by beck while breaking OpenSSL

ok kenjiro
---
 src/lib/libcrypto/x509/x509_addr.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'src/lib/libcrypto')

diff --git a/src/lib/libcrypto/x509/x509_addr.c b/src/lib/libcrypto/x509/x509_addr.c
index ef2f7e0889..c48a0ab118 100644
--- a/src/lib/libcrypto/x509/x509_addr.c
+++ b/src/lib/libcrypto/x509/x509_addr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: x509_addr.c,v 1.95 2026/04/26 17:58:58 tb Exp $ */
+/*	$OpenBSD: x509_addr.c,v 1.96 2026/05/18 04:24:01 tb Exp $ */
 /*
  * Contributed to the OpenSSL Project by the American Registry for
  * Internet Numbers ("ARIN").
@@ -504,10 +504,10 @@ IPAddressFamily_cmp(const IPAddressFamily *const *a_,
 	const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
 	int len, cmp;
 
-	len = MINIMUM(a->length, b->length);
-
-	if ((cmp = memcmp(a->data, b->data, len)) != 0)
-		return cmp;
+	if ((len = MINIMUM(a->length, b->length)) != 0) {
+		if ((cmp = memcmp(a->data, b->data, len)) != 0)
+			return cmp;
+	}
 
 	return a->length - b->length;
 }
-- 
cgit v1.2.3-55-g6feb