File openssl-0009-cms_RecipientInfo_ktri_decrypt.patch of Package openssl-3

Description: Fix CWE-476 (NULL Pointer Dereference) in cms_RecipientInfo_ktri_decrypt
Issue: Similar to the encryption path, 'ec' is retrieved via ossl_cms_get0_env_enc_content (which can return NULL) and then dereferenced to access contentEncryptionAlgorithm.

Index: openssl-3.6.0/crypto/cms/cms_env.c
===================================================================
--- openssl-3.6.0.orig/crypto/cms/cms_env.c
+++ openssl-3.6.0/crypto/cms/cms_env.c
@@ -610,6 +610,8 @@ static int cms_RecipientInfo_ktri_decryp
     const char *propq = ossl_cms_ctx_get0_propq(ctx);
 
     ec = ossl_cms_get0_env_enc_content(cms);
+    if (ec == NULL)
+        return 0;
 
     if (ktri->pkey == NULL) {
         ERR_raise(ERR_LIB_CMS, CMS_R_NO_PRIVATE_KEY);