Fix zero-length MSI signature blob handling

NEWS.md

@@ -12,6 +12,7 @@
 - fixed out-of-bounds read when printing an empty PKCS#7 message digest
 - fixed heap out-of-bounds reads when parsing malformed APPX ZIP64 extra fields
 - fixed heap out-of-bounds reads when verifying malformed PKCS#7 signature attributes
+- fixed undefined behavior when copying an empty MSI signature blob
 
 ### 2.14 (2026.07.20)
 

msi.c

@@ -1745,13 +1745,21 @@ static uint32_t stream_read(MSI_FILE *msi, MSI_ENTRY *entry, u_char *p_msi, uint
     if (is_root && !memcmp(entry->name, digital_signature, sizeof digital_signature)) {
         /* DigitalSignature */
         inlen = len_msi;
-        *indata = OPENSSL_malloc((size_t)inlen);
-        memcpy(*indata, p_msi, (size_t)inlen);
+        if (inlen > 0) {
+            *indata = OPENSSL_malloc((size_t)inlen);
+            memcpy(*indata, p_msi, (size_t)inlen);
+        } else {
+            *indata = NULL;
+        }
     } else if (is_root && !memcmp(entry->name, digital_signature_ex, sizeof digital_signature_ex)) {
         /* MsiDigitalSignatureEx */
         inlen = len_msiex;
-        *indata = OPENSSL_malloc((size_t)inlen);
-        memcpy(*indata, p_msiex, (size_t)inlen);
+        if (inlen > 0) {
+            *indata = OPENSSL_malloc((size_t)inlen);
+            memcpy(*indata, p_msiex, (size_t)inlen);
+        } else {
+            *indata = NULL;
+        }
     } else if (inlen != 0) {
         *indata = (char *)OPENSSL_malloc(inlen);
         if (!msi_file_read(msi, entry, 0, *indata, inlen)) {