BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2

On OpenSSL 1.0.2, X509_CRL_get_issuer() is a raw macro expanding to
(x)->crl->issuer instead of an opaque accessor function, so gcc's
inliner sees straight through to the dereference in
ssl_ctx_hash_store(). It cannot prove that the X509_CRL returned by
X509_OBJECT_get0_X509_CRL() is non-NULL, and flags it under
-Wnull-dereference, which "make ERR=1" turns into a hard error:

    x509.h:605:45: error: potential null pointer dereference [-Werror=null-dereference]

Add an explicit NULL check on crl before using it, the same way
ssl_ctx_hash_X509() already guards against a NULL certificate a few
lines above. This only affects builds against OpenSSL 1.0.2, where the
macro form is used; newer OpenSSL versions hide the access behind a
real function and never triggered the warning.

This must be backported in every stable branches along with the sid_ctx
fixes.

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index e898a9f227edbd7d012cfbe496145bd66b8fa569..92cc4d1a6ac2b9b5fa5c40dfefc3ead76962443e 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4721,6 +4721,9 @@ static int ssl_ctx_hash_store(EVP_MD_CTX *mdctx, SSL_CTX *ctx)
                        ASN1_INTEGER *crl_number;
                        int crl_number_len;
 
+                       if (!crl)
+                               goto out;
+
                        if (X509_NAME_digest(X509_CRL_get_issuer(crl), EVP_sha256(), digest, &digest_len) != 1)
                                goto out;
                        if (EVP_DigestUpdate(mdctx, digest, digest_len) != 1)