From: William Lallemand <wlallemand@haproxy.com>
Date: Tue, 25 Aug 2026 10:26:17 +0000 (+0000)
Subject: BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2
X-Git-Tag: v3.5-dev6~78
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=6ab73c3dc1442f8dfcfebc602270c185c5301c09;p=haproxy.git

BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2

On OpenSSL 1.0.2, X509_CRL_get_issuer() is a raw macro expanding to
(x)->crl->issuer instead of an opaque accessor function, so gcc's
inliner sees straight through to the dereference in
ssl_ctx_hash_store(). It cannot prove that the X509_CRL returned by
X509_OBJECT_get0_X509_CRL() is non-NULL, and flags it under
-Wnull-dereference, which "make ERR=1" turns into a hard error:

    x509.h:605:45: error: potential null pointer dereference [-Werror=null-dereference]

Add an explicit NULL check on crl before using it, the same way
ssl_ctx_hash_X509() already guards against a NULL certificate a few
lines above. This only affects builds against OpenSSL 1.0.2, where the
macro form is used; newer OpenSSL versions hide the access behind a
real function and never triggered the warning.

This must be backported in every stable branches along with the sid_ctx
fixes.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index e898a9f22..92cc4d1a6 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4721,6 +4721,9 @@ static int ssl_ctx_hash_store(EVP_MD_CTX *mdctx, SSL_CTX *ctx)
 			ASN1_INTEGER *crl_number;
 			int crl_number_len;
 
+			if (!crl)
+				goto out;
+
 			if (X509_NAME_digest(X509_CRL_get_issuer(crl), EVP_sha256(), digest, &digest_len) != 1)
 				goto out;
 			if (EVP_DigestUpdate(mdctx, digest, digest_len) != 1)