File openssl-0008-cms_RecipientInfo_ktri_encrypt.patch of Package openssl-3

Description: Fix CWE-476 (NULL Pointer Dereference) in cms_RecipientInfo_ktri_encrypt
Issue: The function ossl_cms_get0_env_enc_content can return NULL. The result 'ec' is assigned and subsequently used in EVP_PKEY_encrypt (accessing ec->key) without a validity check.

Index: openssl-3.6.0/crypto/cms/cms_env.c
===================================================================
--- openssl-3.6.0.orig/crypto/cms/cms_env.c
+++ openssl-3.6.0/crypto/cms/cms_env.c
@@ -550,6 +550,8 @@ static int cms_RecipientInfo_ktri_encryp
     }
     ktri = ri->d.ktri;
     ec = ossl_cms_get0_env_enc_content(cms);
+    if (ec == NULL)
+        return 0;
 
     pctx = ktri->pctx;