crypto: fix potential null pointer dereference when BIO_meth_new() fails

ndossche · aduh95 · commit 3337b095dba0 · 2026-02-28T12:06:58.000+01:00
This function can return null, which will make the calls to BIO_meth_set_* trigger a null deref. Even after fixing this, there is an issue with the `BIOPointer::New(GetMethod())` call in `NodeBIO::New` because the `New` method cannot handle a null pointer despite other code already guarding for this (e.g. the `NodeBIO::New` function already checks `bio`). This patch solves the issues by adding more null checks. PR-URL: #61788 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
@@ -1470,6 +1470,7 @@ BIOPointer BIOPointer::NewSecMem() {
 }
 
 BIOPointer BIOPointer::New(const BIO_METHOD* method) {
+  if (method == nullptr) return {};
   return BIOPointer(BIO_new(method));
 }
 
diff --git a/src/crypto/crypto_bio.cc b/src/crypto/crypto_bio.cc
@@ -226,6 +226,7 @@ const BIO_METHOD* NodeBIO::GetMethod() {
   // Static initialization ensures that this is safe to use concurrently.
   static const BIO_METHOD* method = [&]() {
     BIO_METHOD* method = BIO_meth_new(BIO_TYPE_MEM, "node.js SSL buffer");
+    CHECK_NOT_NULL(method);
     BIO_meth_set_write(method, Write);
     BIO_meth_set_read(method, Read);
     BIO_meth_set_puts(method, Puts);

Original file line number	Diff line number	Diff line change
`@@ -1470,6 +1470,7 @@ BIOPointer BIOPointer::NewSecMem() {`
`1470`	`1470`	`}`
`1471`	`1471`
`1472`	`1472`	`BIOPointer BIOPointer::New(const BIO_METHOD* method) {`
	`1473`	`+ if (method == nullptr) return {};`
`1473`	`1474`	`return BIOPointer(BIO_new(method));`
`1474`	`1475`	`}`
`1475`	`1476`