BUG/MINOR: ssl: Fix potential NULL-deref in "dump ssl cert" with AWS-LC

In some corner cases we could have a public certificate with no private
key stored in a crt-store. In such a case, when trying to dump the
contents of the store entry via the "dump ssl cert" CLI command, the
'PEM_write_bio_PrivateKey' was always called without checking for a NULL
pointer.
This poses no problems with OpenSSL libraries which already check the
pointer but on some other libs, AWS-LC for instance, the NULL pointer is
dereferenced without check.
The only other use of this function is in acme code where the function
can never be called with a NULL 'key' pointer.

This patch can be backported up to 3.2.

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 5d1bd86abfc77fff82061eeb9ca0a910ced152b1..3f808ee63f3f76ea79c96dd7a43c3b0ba8ee4c41 100644 (file)
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -2663,17 +2663,23 @@ static int cli_io_handler_dump_cert(struct appctx *appctx)
                if (BIO_reset(bio) == -1)
                        goto end_no_putchk;
 
-               if (!PEM_write_bio_PrivateKey(bio, ckchs->data->key, NULL, NULL, 0, 0, NULL))
-                       goto end_no_putchk;
-
-               write = BIO_read(bio, out->area, out->size-1);
-               if (write == 0)
-                       goto end_no_putchk;
-               out->area[write] = '\0';
-               out->data = write;
-
-               if (applet_putchk(appctx, out) == -1)
-                       goto end_no_putchk;
+               /* In some specific cases we miht end up with only a
+                * certificate but no private key (for JWT token validation for
+                * instance).
+                */
+               if (ckchs->data->key) {
+                       if (!PEM_write_bio_PrivateKey(bio, ckchs->data->key, NULL, NULL, 0, 0, NULL))
+                               goto end_no_putchk;
+
+                       write = BIO_read(bio, out->area, out->size-1);
+                       if (write == 0)
+                               goto end_no_putchk;
+                       out->area[write] = '\0';
+                       out->data = write;
+
+                       if (applet_putchk(appctx, out) == -1)
+                               goto end_no_putchk;
+               }
 
                index++;