From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Mon, 5 Oct 2026 13:37:36 +0000 (+0200)
Subject: BUG/MINOR: ssl: Fix potential NULL-deref in "dump ssl cert" with AWS-LC
X-Git-Tag: v3.5-dev9~173
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=19a5382e0022b3e79baef4194961997acb251a96;p=haproxy.git

BUG/MINOR: ssl: Fix potential NULL-deref in "dump ssl cert" with AWS-LC

In some corner cases we could have a public certificate with no private
key stored in a crt-store. In such a case, when trying to dump the
contents of the store entry via the "dump ssl cert" CLI command, the
'PEM_write_bio_PrivateKey' was always called without checking for a NULL
pointer.
This poses no problems with OpenSSL libraries which already check the
pointer but on some other libs, AWS-LC for instance, the NULL pointer is
dereferenced without check.
The only other use of this function is in acme code where the function
can never be called with a NULL 'key' pointer.

This patch can be backported up to 3.2.
---

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 5d1bd86ab..3f808ee63 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -2663,17 +2663,23 @@ static int cli_io_handler_dump_cert(struct appctx *appctx)
 		if (BIO_reset(bio) == -1)
 			goto end_no_putchk;
 
-		if (!PEM_write_bio_PrivateKey(bio, ckchs->data->key, NULL, NULL, 0, 0, NULL))
-			goto end_no_putchk;
-
-		write = BIO_read(bio, out->area, out->size-1);
-		if (write == 0)
-			goto end_no_putchk;
-		out->area[write] = '\0';
-		out->data = write;
-
-		if (applet_putchk(appctx, out) == -1)
-			goto end_no_putchk;
+		/* In some specific cases we miht end up with only a
+		 * certificate but no private key (for JWT token validation for
+		 * instance).
+		 */
+		if (ckchs->data->key) {
+			if (!PEM_write_bio_PrivateKey(bio, ckchs->data->key, NULL, NULL, 0, 0, NULL))
+				goto end_no_putchk;
+
+			write = BIO_read(bio, out->area, out->size-1);
+			if (write == 0)
+				goto end_no_putchk;
+			out->area[write] = '\0';
+			out->data = write;
+
+			if (applet_putchk(appctx, out) == -1)
+				goto end_no_putchk;
+		}
 
 		index++;