crypto: add NULL check for SSL_new() result in SSLPointer::New

[Jah-yee]

Good day

This PR addresses a potential NULL pointer dereference identified by static analysis (Svace) in the OpenSSL allocation functions.

Problem

In deps/ncrypto/ncrypto.cc, the SSLPointer::New() function calls SSL_new() and passes its result directly to the SSLPointer constructor without checking if the allocation failed:

return SSLPointer(SSL_new(ctx.get()));

If OpenSSL fails to allocate an SSL structure (e.g., under memory pressure), SSL_new() returns NULL, which would then be stored in the SSLPointer and potentially dereferenced later, causing a segmentation fault.

Solution

Added an explicit NULL check after SSL_new(), consistent with the pattern already used by CipherCtxPointer::New() in the same file:

SSL* ssl = SSL_new(ctx.get());
if (ssl == nullptr) return {};
return SSLPointer(ssl);

Testing

The change follows the established pattern in the codebase and does not alter any existing behavior for the success case. Callers of SSLPointer::New() already check the returned value (e.g., if (!ssl)), so they will properly handle the NULL case after this fix.

Related Issue

Fixes #62774

Thank you for your attention. If there are any issues or suggestions, please leave a comment and I will address them promptly.

Warmly,
RoomWithOutRoof

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/security-wg