From 86274f5de08afeab13243f1eae722ea8269708e7 Mon Sep 17 00:00:00 2001
From: Sam Chang <sam.chang@me.com>
Date: Sat, 22 Aug 2026 02:15:40 +0800
Subject: [PATCH] x509.name.new: guard against non-table array elements (nil
 deref crash)

x509.name.new{ "CN=x" } (array of strings) passed the luaL_checktable +
rawlen>0 checks in openssl_xname_new, then openssl_new_xname ran lua_next
on the string element, treating it as a table -> luaH_next dereferenced a
NULL array pointer and crashed the whole process (pcall cannot catch a
segfault).

Check each array element with lua_istable before iterating it, and return
nil+error instead of crashing.
---
 src/xname.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/xname.c b/src/xname.c
index 376ff83c..08a52d25 100644
--- a/src/xname.c
+++ b/src/xname.c
@@ -25,6 +25,12 @@ openssl_new_xname(lua_State *L, int idx, int utf8)
 
   for (i = 0, n = lua_rawlen(L, idx), ret = 1; i < n && ret == 1; i++) {
     lua_rawgeti(L, idx, i + 1);
+    if (!lua_istable(L, -1)) {
+      /* guard: non-table array element (e.g. {"CN=x"}) would make lua_next
+       * treat a string as a table and crash the process (nil deref). */
+      ret = 0;
+      break;
+    }
     lua_pushnil(L);
 
     while (lua_next(L, -2) != 0) {