From d26049364205fd7815346cfd70968115e9f427ac Mon Sep 17 00:00:00 2001
From: Daniel Pouzzner <douzzer@wolfssl.com>
Date: Wed, 29 Oct 2025 10:04:24 -0500
Subject: [PATCH] src/internal.c: in HashOutput(), check for null output
 pointer;

examples/pem/pem.c: in main(), add missing check that ret == 0 in _DER_TO_PEM code path.
---
 examples/pem/pem.c | 2 +-
 src/internal.c     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/pem/pem.c b/examples/pem/pem.c
index 946c8944c..246b5934e 100644
--- a/examples/pem/pem.c
+++ b/examples/pem/pem.c
@@ -977,7 +977,7 @@ int main(int argc, char* argv[])
             out_len = der->length;
         }
     }
-    else {
+    else if (ret == 0) {
 #ifdef WOLFSSL_DER_TO_PEM
     #if defined(WOLFSSL_ENCRYPTED_KEYS) && !defined(NO_PWDBASED)
         if (enc_der) {
diff --git a/src/internal.c b/src/internal.c
index e58798203..4cc86047a 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -10470,7 +10470,7 @@ int HashOutput(WOLFSSL* ssl, const byte* output, int sz, int ivSz)
 {
     const byte* adj;
 
-    if (ssl->hsHashes == NULL)
+    if ((ssl->hsHashes == NULL) || (output == NULL))
         return BAD_FUNC_ARG;
 
     adj = output + RECORD_HEADER_SZ + ivSz;