crypto: fix potential null pointer dereference when BIO_meth_new() fails

This function can return null, which will make the calls to BIO_meth_set_* trigger a null deref. Even after fixing this, there is an issue with the `BIOPointer::New(GetMethod())` call in `NodeBIO::New` because the `New` method cannot handle a null pointer despite other code already guarding for this (e.g. the `NodeBIO::New` function already checks `bio`). This patch solves the issues by adding more null checks. PR-URL: #61788 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
nodejs · richardlau · Mar 3, 2026 · Feb 24, 2026 · Feb 22, 2026 · Feb 22, 2026
commit 3337b095dba03e37f0915534dbdb393bb0bcc5f9
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
@@ -1470,6 +1470,7 @@ BIOPointer BIOPointer::NewSecMem() {
 }
 
 BIOPointer BIOPointer::New(const BIO_METHOD* method) {
+  if (method == nullptr) return {};
   return BIOPointer(BIO_new(method));
 }
 

diff --git a/src/crypto/crypto_bio.cc b/src/crypto/crypto_bio.cc
@@ -226,6 +226,7 @@ const BIO_METHOD* NodeBIO::GetMethod() {
   // Static initialization ensures that this is safe to use concurrently.
   static const BIO_METHOD* method = [&]() {
     BIO_METHOD* method = BIO_meth_new(BIO_TYPE_MEM, "node.js SSL buffer");
+    CHECK_NOT_NULL(method);
     BIO_meth_set_write(method, Write);
     BIO_meth_set_read(method, Read);
     BIO_meth_set_puts(method, Puts);
-Original file line number
+Diff line change
@@ Expand Up / @@ -1470,6 +1470,7 @@ BIOPointer BIOPointer::NewSecMem() { @@
     }
     BIOPointer BIOPointer::New(const BIO_METHOD* method) {
+      if (method == nullptr) return {};
       return BIOPointer(BIO_new(method));
     }
@@ Expand Down @@