Skip to content

Commit d3a901e

Browse files
n13lt8m
authored andcommitted
Fix NULL Dereference When Delta CRL Lacks CRL Number Extension
Fixes CVE-2026-28388 Co-authored-by: Igor Morgenstern <igor.morgenstern@aisle.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Mon Apr 6 19:27:16 2026 (cherry picked from commit d6ad859)
1 parent 8ffb5d4 commit d3a901e

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

‎crypto/x509/x509_vfy.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1308,6 +1308,8 @@ static int check_delta_base(X509_CRL *delta, X509_CRL *base)
13081308
if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
13091309
return 0;
13101310
/* Delta CRL number must exceed full CRL number */
1311+
if (delta->crl_number == NULL)
1312+
return 0;
13111313
return ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0;
13121314
}
13131315

0 commit comments

Comments
 (0)