Commit 5337f03d34 for openssl.org

commit 5337f03d3458679e4d7ebf9ff43a7b4d6f747fad
Author: Neil Horman <nhorman@openssl.org>
Date:   Fri Oct 23 16:02:08 2026 -0400

    ssl/ssl_lib.c: add error checking to X509_up_ref in ssl_ctx_add_handshake_cert()

    Coverity caught a missing return code check
    in ssl_ctx_add_handshake_cert().

    Pretty easy to fix, if the X509_up_ref() call fails, just return
    the cert without caching it for a single use.

    Resolves: https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1703889
    Fixes: 54dacb1710cf "Cache decoded certs on client in CTX to avoid multiple asn1 parsing"
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Bob Beck <beck@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Tue Oct 27 17:25:26 2026
    Merged-from: https://github.com/openssl/openssl/pull/33366

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 36f506dfe5..e855867181 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -4922,7 +4922,16 @@ X509 *ssl_ctx_add_handshake_cert(SSL_CTX *sctx, X509 *cert,
      */
     memcpy(tmp->sha1_hash, sha1_hash, SHA_DIGEST_LENGTH);
     tmp->cert = cert;
-    X509_up_ref(cert);
+    if (!X509_up_ref(cert)) {
+        /*
+         * We didn't take a ref, so we can't cache this cert, but we still
+         * own the initial ref, so we can just return it for a single use
+         * Note: We use OPENSSL_free here instead of free_hs_cache_ent, as the
+         * latter drops the ref on the cert, which we don't want
+         */
+        OPENSSL_free(tmp);
+        return cert;
+    }

     if (!CRYPTO_THREAD_write_lock(sctx->lock)) {
         free_hs_cache_ent(tmp);