Temporarily disable gost-engine tests in ci

We need to temporarily disable this as we have a build break in CI:
https://github.com/openssl/openssl/actions/runs/14192630435

Its occuring because gost-engine depends on libprov, which requires a
minimum version cmake-3.0.  The update of github runners to cmake-4.0
causes a bail out as cmake 4.0 no longers supports cmake 3.0 syntax.

Libprov is fixed now, but gost-engine needs to update its libprov
submodule, and then we need to update the gost-engine submodule.  Until
thats done (which may take days), we should disable the gost-engine
external tests

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27234)

(cherry picked from commit db9771b5a056d939b6112cdc099fbf4f86d184ee)

Link SSL_get_negotiated_group() and SSL_get0_group_name() in the docs

If you are intereseted in one you might be interested in the other.

Fixes #27137

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27210)

(cherry picked from commit 9eb21877f5704595a89cd550b1a639df86229b09)

statem: always save sigalgs during PHA

We use the same extension-parsing function on server and client
for convenience, but while the server might worry about tracking
what was previously received and not overwriting it, on the client
receiving a request for post-handshake authentication, we always
want to use the values from the current extension (and should
always have a new session object that we are free to mutate).

It is somewhat unclear whether the server also needs the check
for a resumed connection; it appears to have been added back in
2015 in commit 062178678f5374b09f00d70796f6e692e8775aca as part
of a broad pass to handle extensions on resumption, but without
specific documentation of each extension's handling.

Fixes: #10370
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24651)

(cherry picked from commit ddd99d52d30e2fdae08f9684947cba45ce53898b)

Fix cpp comment in windows build

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27188)

(cherry picked from commit b8860598d2f7eab14fcf63c22579d879615465c8)

Fix Strict c issue in aes_gcm for armv8

Reported by David Makepeace

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27203)

(cherry picked from commit 0a78595eac55cc9ec9d2046c704404ec52752b8c)

Fix c++ comment in ec code.

This is a 9 month old change, so I am not sure why it is only causing a
compile issue now.

Reported by David Makepeace

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27186)

(cherry picked from commit ea77608920e88812a5278be351e3ebbfdb81d992)

Fix probing the registry for configuration

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26566)

(cherry picked from commit 908e0f37288b76132c166364c75cbac9f46deb9f)

crypto: windows: use LPCTSTR for the temp registry buffer

mingw-w64 only defines LPCTCH when UNICODE isn't defined
crypto/defaults.c: In function 'get_windows_regdirs':
crypto/defaults.c:72:5: error: unknown type name 'LPCTCH'; did you mean 'LPTCH'?
   72 |     LPCTCH tempstr = NULL;
      |     ^~~~~~
      |     LPTCH

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26566)

(cherry picked from commit 0e38f78dca2ececcce4d0179b7d111452e7878ea)

crypto: fix preprocessor concatenation

String litteral don't need the '##' operator, which causes build
failures:
crypto/defaults.c:kepi:23: error: pasting ""SOFTWARE\\WOW6432Node\\OpenSSL"" and ""-"" does not give a valid preprocessing token

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26566)

(cherry picked from commit ed3876adb1f0beb5fac8d564337ab949f227c563)

Update FIPS-README.md to reflect latest versions

With our new FIPS provider certification, lets update the FIPS-README to
reflect our latest release and fips validated versions

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27178)

(cherry picked from commit 50316c18a0468bb0191904d7615955c9b47f061f)

apps/lib/apps.c: Add a check for OPENSSL_strdup()

Add a check for the return value of OPENSSL_strdup() to guarantee the success of allocation, similar to the other call sites.

Fixes: c7d5ea2670 ("Prepare to detect index changes in OCSP responder.")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27172)

(cherry picked from commit 930c645e6b74a09398f6345b2d265c38ff035afe)

provider-compatibility.yml: Update the branches

Fixes regression from 725f55e23

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27177)

(cherry picked from commit bf4c9b7b663e03e81fe0291e03b814bafd409d1b)

Fix quic_multistream_test: correct more frame types

There are a few more critical frame injections that
previously created an out-of-diskspace problem
and now only a CI test failure.  The pattern
in the qlog files is always similar to this:

{"frame_type":"stop_sending","stream_id":6,"error_code":1152,"length":4},
{"frame_type":"path_challenge","length":9},...{}

Note: The stream_id 6 is a OSSL_QUIC_FRAME_TYPE_CRYPTO.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27170)

(cherry picked from commit 8ed3eee3b416d0bff4890bba24af4a7a1839bf78)

Use OPENSSL_strdup() for strings freed by OPENSSL_free()

Things can get messy when application decides to use it's own memory
allocation functions using CRYPTO_set_mem_functions(3ossl)

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27163)

(cherry picked from commit 7fa51041e4d68838b2c7ddf4f77d6bba0edf2735)

Update X509_VERIFY_PARAM_set_flags.pod

Change description of B<X509_V_FLAG_CRL_CHECK_ALL> to reflect its inability
to function without B<X509_V_FLAG_CRL_CHECK> being enabled as well.

Fixes #27056 (https://github.com/openssl/openssl/issues/27056)

CLA: trivial

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27098)

(cherry picked from commit b7d3c729b14ccd9d23437d8ae107020a4332af72)

bn_mul_words.pod: Fix failures in doc-nits check

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26597)

(cherry picked from commit 1b61f8e1808d3b3ee2d8f8e42bdc8fcc2b538373)

Moved crypto/bn/README.pod to internal manpages

The new place is doc/internal/man3/bn_mul_words.pod.

Also removed outdated information.

Implementing the fix from https://github.com/quictls/quictls/pull/214

Fixes #26399

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26597)

(cherry picked from commit 78b1fdf4a101ae4909038e90b2c3c961be5a7064)

Fix return value of the i2d_ASN1_bio_stream() call

If the flags argument does not contain the SMIME_STREAM bit,
the i2d_ASN1_bio_stream() function always returns 1,
ignoring the result of the ASN1_item_i2d_bio() call.

Fix the return value to the result of the ASN1_item_i2d_bio()
call for this case.

CLA: trivial

Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27106)

(cherry picked from commit 3edb1f09c62c058edf4039587ef35f6b074e0870)

Update provider compatibility CI to run on 3.5 branch

Also drop 3.1 development branch as it is out of public support now.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27149)

(cherry picked from commit 725f55e235057c463feadabbb4d23450126117fd)

In doc/man7/provider-{en,de}coder.pod, clarify where properties are defined

Fixes #27126

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27132)

(cherry picked from commit a006b0a0894b9aa399eee91bd28ca06b281eef7e)

Change documentation to point to new wiki location

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27081)

(cherry picked from commit da8de0e8dd3e09655cd17ef700359c63acdc9cd4)

Memory leak fix ktls_meth.c

The OSSL_RECORD_LAYER needs to be properly freed when return code isnt success.
Memory leak fix

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27111)

(cherry picked from commit e5e4cf41c7af9b533265efb05e81ce1c56d58601)

Test EVP_DigestSignInit() with ECDSA and KECCAK-256 hash

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27107)

(cherry picked from commit 69fa61b08253a991e5553f35bd9fdaf8dc9aec43)

Allow ECDSA signing with digests without a NID in default provider

Also fix ineffective check in DSA signing.

Fixes #27084

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27107)

(cherry picked from commit 6708df48d6e31a598df2fa24bbc907a762d9a371)

Fix NULL pointer dereference in `asn1_ex_i2c()`, crypto/asn1/tasn_enc.c

Adds handling of V_ASN1_UNDEF to avoid NULL dereference
in case ASN1 structure contains an element of type ASN1_TYPE
without initializing its value (i.e. default constructed)

CLA: trivial

Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27100)

(cherry picked from commit 8e08f9c5a013d9a9fb9e2db3c90a70eda50f78b5)

Try to fix endless loops in quic_multistream_test

The problem seem to be caused by syntax errors due to injected
OSSL_QUIC_FRAME_TYPE_PATH_CHALLENGE packets which are too short
by 8 bytes.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27089)

(cherry picked from commit ad684e1a6a925c7fbadad7d309f0204f49e67105)

Upload artifacts despite possible test failures

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27089)

(cherry picked from commit 289dcbe008018b3cf81053cba2b36825a1f49b74)

Do not wrap the python3 in ../../util/wrap.pl

That is bad, because this script does seem to have issues,
because it is itself linked against libcrypto, which causes
crashes in enable-asan builds:

ASan runtime does not come first in initial library list;
you should either link runtime to your application or manually
preload it with LD_PRELOAD.
../../util/wrap.pl python3 ../../test/recipes/70-test_quic_multistream_data/verify-qlog.py => 1
    not ok 1 - running qlog verification script
not ok 2 - check qlog output

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27089)

(cherry picked from commit f346932a15b5ce0cf7e42628e0b02a1871de93e1)

Try to fix reported qlog issues

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27089)

(cherry picked from commit 9f85a036e331d2837db604fc505062f7790a8b2b)

qlog_event_helpers.c: Fix inverted condition

We want to skip up to PACKET_remaining() and not "at least"
PACKET_remaining() bytes.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27138)

(cherry picked from commit 83b11af01738196b0ebde28a2f91df351c1c72fc)

Avoid erroneous legacy code path when provided

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27075)

(cherry picked from commit 27b88364e41f01cc1be6ff2941dd07919f286c89)

apps/cms.c, apps/ocsp.c: Added NULL pointer checks

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27059)

(cherry picked from commit 952d9b83b20359e9ed0fff8f18a84add29949f6f)

Remove workaround for an old ppc64le compiler bug

Lowering the optimization level is no longer needed,
since the old compiler bug from ubuntu-20.04 has been
fixed meanwhile.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27033)

(cherry picked from commit c658a60aae5b3ac5a22cc11ad59d687bafcc6fbf)

Fix gettable_params() for ECX

The OSSL_PKEY_PARAM_MANDATORY_DIGEST parameter is only handled by the
ed25519_get_params() and ed448_get_params(). The x25519 and x448
versions of get_params() always ignore that parameter, so it should not
be in the list of gettable params.

Fixes: 1a7328c88256 ("PROV: Ensure that ED25519 & ED448 keys have a mandatory digest")
cla: trivial

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27043)

(cherry picked from commit 482d3f9338b3d4c7537a1d112dce9c8e370c8d9f)

Do some more cleanup in the RCU code

Only a minimum of 2 qp's are necessary: one for the readers,
and at least one that writers can wait on for retirement.
There is no need for one additional qp that is always unused.
Also only one ACQUIRE barrier is necessary in get_hold_current_qp,
so the ATOMIC_LOAD of the reader_idx can be changed to RELAXED.
And finally clarify some comments.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27012)

(cherry picked from commit a532f2302d9eac7a2ba52b9929b790c20347c9ba)

Fix a memory order issue with weakly ordered systems

this adds a dummy atomic release operation to update_qp, which
should make sure that the new value of reader_idx is visible in
get_hold_current_qp, directly after incrementing the users count.

Fixes: #26875
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26964)

(cherry picked from commit 4a1a7fe5ce088964010779e1f5a90560903ecc76)

Fix Minerva timing side-channel signal for P-384 curve on PPC

1. bn_ppc.c: Used bn_mul_mont_int() instead of bn_mul_mont_300_fixed_n6()
   for Montgomery multiplication.
2. ecp_nistp384-ppc64.pl:
   - Re-wrote p384_felem_mul and p384_felem_square for easier maintenance with
     minumum perl wrapper.
   - Implemented p384_felem_reduce, p384_felem_mul_reduce and p384_felem_square_reduce.
   - Implemented p384_felem_diff64, felem_diff_128_64 and felem_diff128 in assembly.
3. ecp_nistp384.c:
   - Added wrapper function for p384_felem_mul_reduce and p384_felem_square_reduce.

Signed-off-by: Danny Tsen <dtsen@us.ibm.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26709)

(cherry picked from commit 85cabd94958303859b1551364a609d4ff40b67a5)

Keep the provided peer EVP_PKEY in the EVP_PKEY_CTX too

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26976)

Fix RCU TODOs

- Update allocate_new_qp_group to take unsigned int
- Move id_ctr in rcu_lock_st for better stack alignment

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26972)

(cherry picked from commit 7097d2e00ea9f0119a5e42f13a51487fb1e67aa3)

Updated SSL_SESSION_get0_hostname() documentation to be consistent with the function

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26559)

(cherry picked from commit 8d6fd6142b0b55ce029df6d7b63dda5f7cb8ce54)

RCU: Ensure that qp's are actually retired in order

The current retirement code for rcu qp's has a race condition,
which can cause use-after-free errors, but only if more than
3 QPs are allocated, which is not the default configuration.

This fixes an oversight in commit 5949918f9afa ("Rework and
simplify RCU code")

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26952)

(cherry picked from commit 6e7be995fd7fd24d38b95982cf90f801ac045743)

Fix support for windows atomics

Make CRYPTO_atomic_add consistent with
CRYPTO_atomic_load_int and set the
reader_idx under write_lock since there
is no CRYPTO_atomic_store_int.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26963)

(cherry picked from commit bcb8eae1afe243a7c514b988289b06b838764fb6)

compiler-zoo.yml: Switch to ubuntu-22.04 where possible

And drop the rest.

The ubuntu-20.04 CI runners are discontinued.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26971)

(cherry picked from commit 4e9b542868890428f0294a4ce53fcde68c1fcaf7)

Fix a compilation failure in AIX

AIX (at least for 7.1)  defines some macros for "events" and "revents" which
interferes with our own use of these names.

Fixes #24236

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26933)

(cherry picked from commit 5eb55ad8a70ef948432ba17e0985c7b4d3b13c25)

minor doc fixes for CMP and HTTP

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26924)

(cherry picked from commit 1d3da367ab404dd0129277b6b9518d50175269d6)

Move ssl_err.c into libcrypto

We move ssl_err.c out of libssl and into libcrypto. This file is entirely
self contained and is used to load error strings into the libcrypto error
tables. By moving this file into libcrypto, libssl can be unloaded safely
without having dangling references to this error information.

Fixes #26672

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26931)

(cherry picked from commit aaad33c5ac1ce574229066ca3ce47ef3510a6e8d)

Update doc README URLs

This updates the openssl documentation link to the one currently in use,
and removes the standards.txt section as that URL leads to the normal
documentation page and there is no "standards" page in the openssl
documentation site.

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26759)

(cherry picked from commit da44eb2901bd541f86547d814f45ab305b918611)

Fix hashsum files in release assets

We use the coreutils format since 3.4.0.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26907)

(cherry picked from commit 808a0861716e6dd5e1c9f08cebec93084f028fd8)

Fix libctx passing for CMS PWRI use

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26937)

(cherry picked from commit 5045712d3dbe6abdfffcb4f518c67409ec85535e)

apps: Escape control characters in DNs by default

When displaying distinguished names the control characters
are escaped by default.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26932)

(cherry picked from commit 2411f9b662fa501c9eec257a30a7da0cfc2dc173)

doc: fix OSSL_WINCTX spelling windows notes

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26567)

(cherry picked from commit c2ab75e30a211aa278f8da1f0f040f9368adb81d)

Encoder : Fix floating pointer when OSSL_ENCODER_to_data() is called
twice.

Fixes #26862

This only happens when using the FIPS provider, since it needs to export
the key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26891)

(cherry picked from commit c2f4d7aae1c7c726eb1f8226d3d454dfd9754758)

Tolerate 3.5+ FIPS providers in kem_rsa_params test

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26911)

Add record overflow test to tlsfuzzer external tests

Add this to our regression test suite for tlsfuzzer, since it recently
caught an error

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26781)

(cherry picked from commit 83dbfde6aaf7a384cfc7bab6608943a56ac4ebed)

Change cipher suite alert for 0 length cipher_suites

From RFC 8446:

Note: TLS defines two generic alerts (see Section 6) to use upon
   failure to parse a message.  Peers which receive a message which
   cannot be parsed according to the syntax (e.g., have a length
   extending beyond the message boundary or contain an out-of-range
   length) MUST terminate the connection with a "decode_error" alert.
   Peers which receive a message which is syntactically correct but
   semantically invalid (e.g., a DHE share of p - 1, or an invalid enum)
   MUST terminate the connection with an "illegal_parameter" alert.

A zero length cipher suite list I think is considered out of range, and
so we should return "decode_error" rather than "illegal_parameter"

Fixes #25309

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26781)

(cherry picked from commit 2ce46ad8cef8909ae9162a429daf8e3d5fc8cb03)

Fix read out of buffer bounds when dealing with BIO_ADDR

This issue was discoevered while I was testing SSL_new_from_listener()
using a newly created unit test. It has turned out the QUIC stack
at few places contain pattern as follows:
foo(QUIC_WHATEVER *q, BIO_ADDR *a)
{
   q->a = *a;
}

The problem is that derefencning a that way is risky. If the address `a`
comes from BIO_lookup_ex() it may actually be shorter than sizeof(BIO_ADDR).
Using BIO_ADDR_copy() is the right thing to do here.

Fixes #26241

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26252)

(cherry picked from commit 395a83a617a09c1ae02e8040386f9acb356d13c1)

Fix potential memory leak in policy_section()

If sk_POLICYQUALINFO_push() fails, qual is not freed.
Fix it by adding POLICYQUALINFO_free() to the error path.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26499)

(cherry picked from commit ececabd9adb4b4def9c044491f993b94ba0c618f)

add_uris_recursive(): Avoid OSSL_STORE_INFO leak on error

Fixes #26480

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26511)

(cherry picked from commit be5965acad7a1c45e49411bcf4abad99d106a7c1)

Fix potential leak in error path in cert_response()

get1_cert_status() returns an object that must be freed,
but the error path does not do that.
Fix it by adding a call to X509_free() in the error path.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26513)

(cherry picked from commit 56160f173d055486357b7a315ab4e9579b2538d5)

Fix potential memory leaks in error paths in ossl_rsa_multiprime_derive()

There are several cases where new BIGNUM instances are created, not
using the context, but not freed when an error occurs.
Fix this by adding the necessary calls to BN_free().

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26515)

(cherry picked from commit 8cdba24ceea00de9c0cd8f90bf662d632c37e14b)

fix: add OOM handler for x509 fuzz test

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26830)

(cherry picked from commit 6d42072e0b9e52fbeee28cb451e2ec269b329708)

doc: document that the FIPS provider doesn't support deterministic ECDSA sigs

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26880)

(cherry picked from commit 53c54b13acdf0f0725fdd0b0eace82a723cc3647)

Revert wrong macos RCU fix

This reverts #23974 which seems to be no longer needed now,
due to other fixes nearby.  Most likely the change did just
slightly decrease the performance of the reader threads, and
did therefore create the wrong impression that it fixed the issue.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26881)

(cherry picked from commit a6f512a1e6c1c2e3e1efaad51a6fcf65f260bbb1)

Re-enable RCU torture test on MACOSX

This test was disabled due to "Stochastic failures in
the RCU test on MACOSX" by #23967, which sounds like an
issue that is probably fixed now.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26834)

(cherry picked from commit 4d16d2f40a135830ee667e1588c75293a7b23480)

Use linux-arm64 or the public ubuntu-24.04-arm runner image

dependent on whether this runs on the openssl/openssl repository
or a clone.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26855)

(cherry picked from commit 51597e2ee6ef4a384167bb1ed3528da1ab578d61)

Make CRYPTO_atomic_load/store use the same preprocessor guards

as the other CRYPTO_atomic_X functions.
All CRYPTO_atomic functions should use the same logic here,
just in case...

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)

(cherry picked from commit 3240427a8530f5aa6070f135e954e20e591fa132)

Cleanup atomic fallbacks in threads_pthread.c

the unused atomic stub functions make clang issue
unused function warnings -Wunused-function

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)

(cherry picked from commit eacf14594dd93c971ff6480094bc23e63b87f628)

Enhance thread sanitizer CI tests

Related to issue #26798

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)

(cherry picked from commit 00a173af77c878065c1370a40782aac04c4c83a8)

Make org.openssl.winstore: work in openssl-ts

Fixes #26739

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26833)

(cherry picked from commit c9e56da7774bbaca1597bbc754b4111729914e5c)

fix: add check for NULL zalloc in tls-provider.c (reverse if statement)

CLA: trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26814)

(cherry picked from commit c5eb70de753605cda978fda9a4eddbdb1fc692be)

Fix memory leak in ecdsa_keygen_knownanswer_test

We allocate an EC_POINT with EC_POINT_new here, but in failing a
subsequent check, we don't free it, correct that.

Fixes #26779

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26799)

(cherry picked from commit 20a2f3beba9be6e226a0633b60c29e8a928ccd21)

Free hashtable prior to freeing atomic worker_lock

lhash_test uses a hashtable that may not be empty at the end of the test

Given that the free function frees the elements in the list and uses the
atomic worker_lock to do so, we need to free the hash table prior to
freeing the working lock to avoid the use of unallocated memory.

Fixes #26798

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26800)

(cherry picked from commit 1636ae1a9022bad2fd5cf20f45e2729a55e688b7)

Don't use __ATOMIC_ACQ_REL on older compilers

Older compilers don't always support __ATOMIC_ACQ_REL, use a lock where
they don't

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/26747)

(cherry picked from commit 7d284560a0624206356d46a948ab3a0b6f670c0e)

SPARC assembly: Don't file aes-cbc on T4 with small sizes.

The "openssl speed -testmode -seconds 1 -bytes 1 aes-128-cbc" test
revealed that the assembly code is crashing if length is less than 16.
The code shifts the provided length by 4 and than subtracts one until
the length hits zero. If it was already zero then it underflows the
counter and continues until it segfaults on reading or writing.

Replace the check against 0 with less than 15.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25637)

(cherry picked from commit c71c65b9222135a767c39a24cb254ed792d1c942)

LoongArch: Fix output file name detection for Perl scripts

We were using the first (or second) argument containing a '.' as the
output name file, but it may be incorrect as -march=la64v1.0 may be in
the command line.  If the builder specifies -march=la64v1.0 in the
CFLAGS, the script will write to a file named "-march=la64v1.0" and
cause a build error with cryptic message:

    ld: crypto/pem/loader_attic-dso-pvkfmt.o: in function `i2b_PVK':
    .../openssl-3.4.1/crypto/pem/pvkfmt.c:1070:(.text+0x11a8): undefined reference to `OPENSSL_cleanse'

Adapt the approach of ARM and RISC-V (they have similar flags like
-march=v8.1-a or -misa-spec=2.2) to fix the issue.

Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26717)

(cherry picked from commit f48c14e94e38f543d4d2ae54c2fed51ce2e7065f)

Rework and simplify RCU code

Use __ATOMIC_RELAXED where possible.
Dont store additional values in the users field.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26690)

(cherry picked from commit 5949918f9afa85d72535676f114346ed541e0b1e)

Revert "rcu: Ensure that updates to the ID field of a qp don't lose refs"

This reverts commit fbd34c03e3ca94d3805e97a01defdf8b6037f61c.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26690)

(cherry picked from commit 65787e2dc219685c30539c6f60eb6b64b890bf6f)

test/quicapitest.c: Increase timeout of test_fin_only_blocking to 40ms

Running this test on heavily loaded systems may cause the SSL_read_ex() to
take more than 20ms, due to concurrent workload.

Increase the timeout to 40ms to allow a little bit more time.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26693)

(cherry picked from commit 0e93f64723894e6420faa8b95055ce637894abc1)

Add a test for configuring provider certs via config

A bug existed where provider added cert algorithms caused a crash when
they were configured via a config file. We add a test for this scenario.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26663)

(cherry picked from commit e2bfb61f617fa0f3acf88263a9afc702320660db)

Fix configuring provider certificate algs via config file

A crash could occur when attempting to configure a certificate via a
config file, where the algorithm for the certificate key was added
dynamically via a provider.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26663)

(cherry picked from commit 9cbaa8763c096bc91e09fc121583f90d93ecfc82)

Avoid calling ssl_load_sigalgs in tls1_set_sigalgs_list

- The signature algorithms are already loaded in SSL_CTX_new()

- Calling ssl_load_sigalgs() again is non-productive, and does
  not look thread safe.

- And of course avoiding the call is cheaper.

- Also fix broken loop test in ssl_cert_lookup_by_pkey()

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26671)

(cherry picked from commit 3252fe646b17c1a3cebed4ff8fe35c19c523e222)

Prepare for 3.4.2

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes

Prepare for release of 3.4.1

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes

make update

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes

Copyright year updates

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes

Update CHANGES and NEWS for security release

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit cf9d6685fda656c07fab8527750284f4446a7372)

Use ERR marks also when verifying server X.509 certs

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(cherry picked from commit 739c4b2e92116952e4baf3e14d219b82f871ec6a)

With SSL_VERIFY_PEER client RPK should abort on X509 error

While RPK performs X.509 checks correctly, at the SSL layer the
SSL_VERIFY_PEER flag was not honoured and connections were allowed to
complete even when the server was not verified.  The client can of
course determine this by calling SSL_get_verify_result(), but some
may not know to do this.

Added tests to make sure this does not regress.

Fixes CVE-2024-12797

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(cherry picked from commit 6ae8e947d8e3f3f03eeb7d9ad993e341791900bc)

Fix compile error when building VC-WIN64-CLANGASM-ARM target

With MSVC v143, C++ Clang Compiler for Windows (18.1.8) there are
many errors similar to:

crypto\aes\libcrypto-lib-aesv8-armx.obj.asm:3795:7: error: unknown token in expression
        ld1     {v2.16b},[x0],#16

CLA: trivial

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26603)

(cherry picked from commit becc0078f8215ffc062f5ba06c73ba51d3b14b6e)

perlasm: Replace .previous with the actual previous section

Older versions of darwin (10.8 and earlier) don't understand .previous.
this tweak emits the previous section directive which preceeds the
rodata (for example .text) instead of using .previous. We use the
same for mingw.

Fixes #26447

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26585)

(cherry picked from commit fd6f27bdd5f6cdc577fbf1b0556ff6c45bdd5116)

backport make-release.yml workflow to openssl-3.x branches

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26541)

80-test_cmp_http.t: on test failures also print failed client invocations

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26589)

(cherry picked from commit b1775ba4c9eff94df2a6395e2430749f7a7b259d)

80-test_cmp_http.t: on test failures print Mock server STDERR output

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26589)

(cherry picked from commit e7c6c5e0885b797c67a363802072fd1df2c54558)

80-test_cmp_http_data/Mock/test.cnf: further relax total_timeout as workaround for heavily loaded test systems

Fixes #26577

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26584)

(cherry picked from commit 12baad7ed47fce8977929cec4eafa0912bab8756)

Open pem files in binary mode

In order to avoid an MSVCRT bug affecting ftell and text mode[1], open PEM files
in binary mode. The PEM parser already handles CRLF translation[2].

[1] https://github.com/openssl/openssl/commit/8300a8742b2abc487594a09b5e6ee726dbd30771
[2] https://github.com/openssl/openssl/pull/24249#issuecomment-2192025429

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25716)

(cherry picked from commit 4f20de0c8adc9cdcd1475155d467f66980915ab3)

Revert "Work around Windows ftell() bug as per Microsoft engineering's suggestion"

This reverts commit 8300a8742b2abc487594a09b5e6ee726dbd30771.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25716)

(cherry picked from commit ed3ce7545797e2c7202a6fcbf83c8bba3ead460d)

Fix passing struct by value rather than by reference to syscall

Fixes #26521

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26523)

(cherry picked from commit b6f2ff93639d9c71aae62dfc72082dd0829c2170)

Fix data race in asn1_str2tag() on tntmp which was accidentally made static

Variables tntmp and tnst are declared in the same declaration and thus
share storage class specifiers (static). This is unfortunate as tntmp is
used during iteration through tnst array and shouldn't be static.
In particular this leads to two problems that may arise when multiple
threads are executing asn1_str2tag() concurrently:
1. asn1_str2tag() might return value that doesn't correspond to tagstr
   parameter. This can happen if other thread modifies tntmp to point to
   a different tnst element right after a successful name check in the
   if statement.
2. asn1_str2tag() might perform an out-of-bounds read of tnst array.
   This can happen when multiple threads all first execute tntmp = tnst;
   line and then start executing the loop. If that case those threads
   can end up incrementing tntmp past the end of tnst array.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26504)

(cherry picked from commit 7262c0bcc468ab8e43ba96ca219acdb4667e45e0)

eddsa_signverify_init(): Avoid memory leak on error

Add missing WPACKET_cleanup() call.
Fixes Coverity 1638693

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26500)

(cherry picked from commit abbc4073145cb6b2ea221f3e34809e9aefece9ab)

mac_legacy_kmgmt.c: Avoid possible memory leak on error

Use mac_gen_cleanup() instead of just freeing the gctx.
Fixes Coverity 1638702

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26500)

(cherry picked from commit 2455ef2112997d6a366623a209f1d0090ed2d847)