From 425087a13e903f70b7f86dc6cbfd0893fb2ef79a Mon Sep 17 00:00:00 2001
From: tb <>
Date: Fri, 24 Apr 2026 15:10:20 +0000
Subject: Simplify PKCS7_get_issuer_and_serial()

The i variable is unused. Likewise for the first assignment to ri.
Instead of an incomplete check that idx is in range, which still
results in a NULL deref if idx < 0, check if ri is not NULL before
accessing, as sk_value() checks the index correctly.

ok jsing kenjiro
---
 src/lib/libcrypto/pkcs7/pk7_doit.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

(limited to 'src')

diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index e39d960780..2e0b0a4f2a 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_doit.c,v 1.61 2025/07/27 07:06:41 tb Exp $ */
+/* $OpenBSD: pk7_doit.c,v 1.62 2026/04/24 15:10:20 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1101,20 +1101,17 @@ PKCS7_get_issuer_and_serial(PKCS7 *p7, int idx)
 {
 	STACK_OF(PKCS7_RECIP_INFO) *rsk;
 	PKCS7_RECIP_INFO *ri;
-	int i;
 
-	i = OBJ_obj2nid(p7->type);
-	if (i != NID_pkcs7_signedAndEnveloped)
+	if (OBJ_obj2nid(p7->type) != NID_pkcs7_signedAndEnveloped)
 		return NULL;
+
 	if (p7->d.signed_and_enveloped == NULL)
 		return NULL;
-	rsk = p7->d.signed_and_enveloped->recipientinfo;
-	if (rsk == NULL)
+	if ((rsk = p7->d.signed_and_enveloped->recipientinfo) == NULL)
 		return NULL;
-	ri = sk_PKCS7_RECIP_INFO_value(rsk, 0);
-	if (sk_PKCS7_RECIP_INFO_num(rsk) <= idx)
+	if ((ri = sk_PKCS7_RECIP_INFO_value(rsk, idx)) == NULL)
 		return NULL;
-	ri = sk_PKCS7_RECIP_INFO_value(rsk, idx);
+
 	return ri->issuer_and_serial;
 }
 LCRYPTO_ALIAS(PKCS7_get_issuer_and_serial);
-- 
cgit v1.2.3-55-g6feb