#12 seg fault when decoding NULL-SHA

[Alex Beck]

Ideally I would like ssldump to display handshake and
application data text when using NULL-SHA, without
possession of the server's private key. It seems I must
supply the private key currently. When decoding ie with
options -Ad with the private key and NULL-SHA
selected, I experience the seg fault below. Note using
openssl 0.9.7b and compiled on solaris.

Program received signal SIGSEGV, Segmentation fault.
0x34e50 in ssl_decode_rec_data (ssl=0x12e3e8,
d=0x12d798, ct=22, version=769,
in=0x12f6cd "\024", inl=36,
out=0x130d78 "xyz.......com:5061",
outl=0xffbee7c4) at ./ssl/ssl_rec.c:166
166 EVP_Cipher(d->evp,out,in,inl);
(gdb) where
#0 0x34e50 in ssl_decode_rec_data (ssl=0x12e3e8,
d=0x12d798, ct=22,
version=769, in=0x12f6cd "\024", inl=36,
out=0x130d78 "xyz.....com:5061", outl=0xffbee7c4)
at ./ssl/ssl_rec.c:166
#1 0x35fe0 in ssl_decode_record (ssl=0x12e3e8,
dec=0x12ed98, direction=1,
ct=22, version=769, d=0xffbee858)
at ./ssl/ssldecode.c:359
#2 0x39460 in ssl_expand_record (ssl=0x12e3e8,
q=0xffbeea08, direction=1,
data=0x12f6c8 "\026\003\001", len=41)
at ./ssl/sslprint.c:262
#3 0x349b4 in print_ssl_record (obj=0x12e3e8,
direction=1, q=0xffbeea08,
data=0x12f6c8 "\026\003\001", len=41)
at ./ssl/ssl_analyze.c:572
#4 0x34694 in data_ssl_analyzer (_obj=0x12e3e8,
seg=0xffbeea08, direction=1)
at ./ssl/ssl_analyze.c:506
#5 0x30ae4 in process_data_segment (conn=0x12e390,
handler=0x109944,
p=0xffbeeb40, stream=0x12e3a8, direction=1)
at ./base/tcppack.c:351
#6 0x30328 in process_tcp_packet (handler=0x109944,
ctx=0x12d288,
p=0xffbeeb40) at ./base/tcppack.c:152
#7 0x2e600 in network_process_packet
(handler=0x121650, timestamp=0xffbeec60,
data=0x123228 "E", length=46)
at ./base/network.c:141
#8 0x2ed74 in pcap_cb (ptr=0x121650 "",
hdr=0xffbeec60, data=0x123228 "E")
at ./base/pcap-snoop.c:162
#9 0xd21b0 in pcap_read ()
#10 0xd2de4 in pcap_loop ()
#11 0x2f3e4 in main (argc=3, argv=0xffbeef3c)
at ./base/pcap-snoop.c:329