File openssl-CVE-2026-22796.patch of Package openssl-1_0_0.42417

From 572844beca95068394c916626a6d3a490f831a49 Mon Sep 17 00:00:00 2001
From: Bob Beck <beck@openssl.org>
Date: Wed, 7 Jan 2026 11:29:48 -0700
Subject: [PATCH] Ensure ASN1 types are checked before use.

Some of these were fixed by LibreSSL in commit https://github.com/openbsd/src/commit/aa1f637d454961d22117b4353f98253e984b3ba8
this fix includes the other fixes in that commit, as well as fixes for others found by a scan
for a similar unvalidated access paradigm in the tree.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29582)
---
 apps/s_client.c          |  3 ++-
 crypto/pkcs12/p12_kiss.c | 10 ++++++++--
 crypto/pkcs7/pk7_doit.c  |  2 ++
 3 files changed, 12 insertions(+), 3 deletions(-)

Index: openssl-1.0.2p/crypto/pkcs12/p12_kiss.c
===================================================================
--- openssl-1.0.2p.orig/crypto/pkcs12/p12_kiss.c
+++ openssl-1.0.2p/crypto/pkcs12/p12_kiss.c
@@ -237,11 +237,17 @@ static int parse_bag(PKCS12_SAFEBAG *bag
     ASN1_BMPSTRING *fname = NULL;
     ASN1_OCTET_STRING *lkid = NULL;
 
-    if ((attrib = PKCS12_get_attr(bag, NID_friendlyName)))
+    if ((attrib = PKCS12_get_attr(bag, NID_friendlyName))) {
+        if (attrib->type != V_ASN1_BMPSTRING)
+            return 0;
         fname = attrib->value.bmpstring;
+    }
 
-    if ((attrib = PKCS12_get_attr(bag, NID_localKeyID)))
+    if ((attrib = PKCS12_get_attr(bag, NID_localKeyID))) {
+        if (attrib->type != V_ASN1_OCTET_STRING)
+            return 0;
         lkid = attrib->value.octet_string;
+    }
 
     switch (M_PKCS12_bag_type(bag)) {
     case NID_keyBag:
Index: openssl-1.0.2p/crypto/pkcs7/pk7_doit.c
===================================================================
--- openssl-1.0.2p.orig/crypto/pkcs7/pk7_doit.c
+++ openssl-1.0.2p/crypto/pkcs7/pk7_doit.c
@@ -1208,6 +1208,8 @@ ASN1_OCTET_STRING *PKCS7_digest_from_att
     ASN1_TYPE *astype;
     if (!(astype = get_attribute(sk, NID_pkcs9_messageDigest)))
         return NULL;
+    if (astype->type != V_ASN1_OCTET_STRING)
+        return NULL;
     return astype->value.octet_string;
 }