git.ipfire.org Git - thirdparty/openssl.git/log

Allow our *_gen_cleanup functions to tolerate a NULL ctx

Our *_gen_cleanup functions are essentially "free" functions. Our
free functions tolerate NULL being passed. We are being inconsistent with
our *_gen_cleanup functions. Some of them tolerate NULL and others do not.

We should consistently tolerate NULL.

See also #27795

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27807)

(cherry picked from commit fcc5df53697a63d0f153b0086054f509aad8e6bb)

genpkey.c: Fix filename copy & paste bug in error output

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27789)

(cherry picked from commit a4c5096d16a78d2c24f2880fba1ec7056eb3a96f)

Silence -Wstringop-overflow warnings with gcc 14 on s390x

Compiling OpenSSL on s390x with gcc 14 (i.e. in Fedora 41) shows several
-Wstringop-overflow warnings in providers/implementations/rands/drbg_ctr.c
and test/params_api_test.c.

Add explicit length checks to let the compiler know that it won't overrun
the buffer. This also silences the warnings.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27710)

(cherry picked from commit 9a788281d91f698d6a229d588b9cb36987549669)

Allow keygen after dup of minimal PKEY ctx

It should be possible to repeatedly duplicate a PKEY CTX created via
EVP_PKEY_CTX_new_from_name() that has not yet been assigned an
"operation" (e.g. via EVP_PKEY_CTX_keygen_init()), and then perform
keygen_init() and keygen() on the duplicated copies.

When the operation is not yet set, all that's needed is to not try to
use the key if one isn't set yet.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27662)

(cherry picked from commit 2c74a8d1ef4e9c4b4468afefedb1f72425772a37)

Fix SHAKE AlgorithmIdentifier encodings

NIST CSOR specifies that the id-shake128 and id-shake256
algorithm identifiers, like the SHA-3 ones, do not carry
any parameters.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27190)

(cherry picked from commit bef03c6a24f02df4e670697b16b6d7c8b1b604b4)

fix: add parsing check in TLS compress_certificate extension handler

The tls_parse_compress_certificate function was missing validation
for trailing bytes after parsing the algorithm list, violating
RFC8446 section 4.2 which requires sending a decode_error alert
for unparseable messages.

This commit adds a check for remaining bytes in the packet after
the while loop and sends SSL_AD_DECODE_ERROR if any trailing
bytes are found.

Fixes #27717

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27733)

(cherry picked from commit 8e787b102848e462a6d231883e2c42d91978c049)

crypto/evp/ctrl_params_translate.c: prevent clashes of generic names NONE, GET, SET

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27773)

(cherry picked from commit c37b9e3425c8576d089342c7cfdcc4dc0aedde54)

rand: add argument error checking to EVP_RAND_nonce()

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27766)

(cherry picked from commit a2cd7ecd75dcd0de214319ec11bf5b3701bec7a3)

rand: document the EVP_RAND_nonce() return correctly

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27766)

(cherry picked from commit e81b252a955ae380c3af6129b0f9054c2594b8d6)

rand: produce correct return from EVP_RAND_nonce

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27766)

(cherry picked from commit a2b9120d15073ab596452fc361d01bb26ee13773)

rand: fix memory overrun bug

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27766)

(cherry picked from commit da585e214cf98468e28f4c12ec96ecc7a6192746)

rand: add unit test exhibiting memory overrun

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27766)

(cherry picked from commit 6d490a92fe49ea6e41cb7874086dbad5462078c6)

Add a test to confirm that we can repeatedly create and destroy keys

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27775)

(cherry picked from commit b994ce4088fb52e769ee5e3e49bdde3030fadaf7)

Allow for reuse of thread_local keys in threads_none

If openssl is configured with no-threads, the implementation has a hard
limit of 256 LIB_CTX values, as each LIB_CTX allocates a thread local
key, and we never reuse them (like libc does when using
pthread_key_create/destroy.

Improve the situation by allowing for marking freed keys as unsued and
searching for an available key when allocating

Fixes #27757

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27775)

(cherry picked from commit b6d01d1b1fef2e98a956b7ba4e8443cf7d916dcb)

Fix NIST ACVP server URLs in SLH-DSA test files

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27770)

(cherry picked from commit 07c772847de682412448daea07582f566d30f7ac)

Remove _strlen31

This function is old and fairly broken. Code archeology in our git tree
hasn't revealed why it was creted (though it may have possibly been to
support older win32 systems that couldn't do 64 bit integers properly,
like windows 95/98).

There seems to be no good reason to keep it around, and given that it
has potentially serious side effects, lets just remove it.

Fixes #27761

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27763)

(cherry picked from commit b0d363a2cb039eac2908b7cb00b395235373193e)

Fix use of IO::Socket::IP on windows 2025

Apparently IO::Socket::IP has several odd behaviors on windows 2025,
notably indicating that AF_INET6 isn't a supported family when it
clearly is.

Follow the pattern in determinig the haveIPV6 variable in Proxy.pm, and
record if we determine IPv6 availablity with the IP class or the INET6
class and use the same method when testing port binding

Fixes project/#1213

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/27780)

(cherry picked from commit ae404a9b3bd052963b76434bcc97757d1d6d502e)

Test randomly selected client port for availabilty in sslrecords test

Encountered this error in a pr today:
https://github.com/openssl/openssl/actions/runs/15418713146/job/43387767612

===
Proxy started on port [::1]:56662
Engine "ossltest" set.
Using default temp DH parameters
ACCEPT [::1]:59189
Server responds on [::1]:59189
Engine "ossltest" set.
C0774F02907F0000:error:80000062:system library:BIO_bind:Address already in use:crypto/bio/bio_sock2.c:240:calling bind()
C0774F02907F0000:error:10000075:BIO routines:BIO_bind:unable to bind socket:crypto/bio/bio_sock2.c:242:
connect:errno=98
===

Its occuring because we randomly select a port to use for our client
connection in the sslrecords test.  Thats usually fine, but sometimes,
we get unlucky and pick a port thats already in use.  This presents as
random failures in our CI on this test.

So lets try harden ourselves against it.  When creating the client
connection, test the randomly selected port by trying to bind to it via
a call to IO::Socket::IP->new(). If that fails, try a different port
number, until we get one that works.  If it works, use that port in the
assignment for the clients local port value.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27752)

(cherry picked from commit f78f824c8e4064148af1186490e9b445871765fd)

apps/x509.c: re-add ERR queue printing on errors

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27739)

(cherry picked from commit ac85974bc34dc18830fa9401a7d4756dbd2d9e35)

Split arguments taking quotes into account

CA.pl supports interpolating multiple arguments into the executed
commands. Previously these were evaluated by a shell, which supported
quoting of values that contain whitespace, backslashes, ...

With a shell no longer used (avoid command injection), backwards
compatibility requires some similar functionality. The code now handles
double and single-quoted strings (shell-style word splitting), but not
parameter expansion ($foo remains unexpanded) or command substitution
(`cmd` and $(cmd) remain unexpanded).

On Windows system(@LIST) does not correctly preserve argv, do our
own quoting instead and use system(<$quoted_cmd>).

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27432)

(cherry picked from commit 287bbb28b09e930a8691efc92a5087bb951edb6b)

Avoid shell commandline processing in CA.pl

The CA.pl script used to build single-string string commandlines to pass
to a shell via `system(command_string)`.  That was fragile and not a best
practice.

This PR replaces `system(command_string)` with `system { executable } @argv`,
which avoids the shell whenever possible (at least Unix-like systems and
Windows).  The only question mark is whether some sort of quoting is
needed for VMS to preserve the case of commandline arguments even when
processes are spawned directly, rather than via the shell.

Unfortunately, given the way that some environment variables and
command-line options are used to construct the commands to run,
the result is still brittle.  The CA.pl utility really should
be replaced with something better.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27432)

(cherry picked from commit 0b1bdef38ef1e3369a7bcde1b9a6eabe44b10e54)

Add a CHANGES.md entry regarding no_renegotiation alert

Highight the bug being fixed for DTLS users

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27591)

(cherry picked from commit df5dff26efb6cdc96ebe50c35af394a1121e77fe)

Update documentation regarding no_renegotiation handling

Clarify what happens in the event that a no_renegotiation alert is
received.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27591)

(cherry picked from commit 0db6a59ea7931024d673024c2d17ff1ec44a4e69)

Test that a no_renegotiation alert is handled correctly

If we receive a no_renegotiation alert we should abort the connection. We
add a test for this.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27591)

(cherry picked from commit 7f6e66b048cb50dd5381211ef2006ae5e912a914)

Fix DTLS handling when receiving a no_renegotiation alert

no_renegotiation is a warning alert sent from the server when it is not
prepared to accept a renegotiation attempt. In TLS we abort the connection
when we receive one of these - which is a reasonable response. However,
in DTLS we incorrectly ignore this and keep trying to renegotiate.

We bring the DTLS handling of a no_renegotiation alert into line with
how TLS handles this. In versions prior to 3.2 handling of a warning
alert in DTLS was mishandled resulting in a failure of the connection,
which ends up being the right thing to do "by accident" in the case of
"no_renegotiation". From 3.2 this mishandling was fixed, but exposed this
latent bug.

Fixes #27419

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27591)

(cherry picked from commit e5feca0659ef6119f6cedfab1b6af034735723ff)

ci: remove windows-2019 runner images

According to https://github.com/actions/runner-images/issues/12045
The Windows 2019 Actions runner image will begin deprecation on
2025-06-01 and will be fully unsupported by 2025-06-30. Jobs using
the windows-2019 YAML workflow label should be updated to
windows-2022, windows-2025 or windows-latest.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27749)

(cherry picked from commit 19dfc4672a3e7d152195c890edfdb9bd81d878a7)

Reset qtls->local_transport_params_consumed to 0 on SSL_clear()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27656)

(cherry picked from commit 9bad2b86e892b70ea65e87c409ae90f625d3c12c)

Add test for yielding of write secrets before read

Test that, in QUIC, we yield write secrets before read secrets

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27732)

(cherry picked from commit 9a5ac06921357bdfd4e2f74b5b32955464bf9b75)

Ensure client read app data secret change occurs after write for QUIC

We don't want read secrets to be issue before write for QUIC, because
we want to avoid the situation where we want to ack something we've read
but we don't have the write secret yet.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27732)

(cherry picked from commit 098cfd216b9b54106cbf9338a511c7dda972b8c1)

Implement explicit storing of the server_finished_hash

tls13_change_cipher_state was storing the server_finished_hash as a
side effect of its operation. This decision is better made by the state
machine which actually knows what state we are in.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27732)

(cherry picked from commit c7f9c4d7d184cec988251b2a9c697302774fbe77)

Ensure client read handshake secret change occurs after write for QUIC

We don't want read secrets to be issue before write for QUIC, because
we want to avoid the situation where we want to ack something we've read
but we don't have the write secret yet.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27732)

(cherry picked from commit 86e75792622b39a9cf49c0915e58cca5c9d316d3)

Implement explicit storing of the handshake_traffic_hash

tls13_change_cipher_state was storing the handshake_traffic_hash as a
side effect of its operation. This decision is better made by the state
machine which actually knows what state we are in.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27732)

(cherry picked from commit 4579a18cf5129479e781bf05e168204ca739fa3c)

Regression test for incorrect HMAC API usage

Fixes #13210

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/27692)

(cherry picked from commit a5d1eadde1d566b528cfe495953300cd9f9fe1e9)

Handle 0 return values from DH key computations as errors

Returned 0 from ossl_dh_compute_key(), DH_compute_key_padded() and
DH_compute_key() needs to be treated as an error.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27673)

(cherry picked from commit 1c1ce2a6eeb18b3102e0618a988b2dfe96b709aa)

Use value barrier for constant_time_cond_swap_*

Resolves #27497

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27581)

(cherry picked from commit 8a9e0d0f499a288cf3363668870806d5e7be3924)

Cleanup - this constant and functions are no longer in use

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27716)

(cherry picked from commit 0b968a3572d2932e7e756fc9977dbf808510a958)

sslapitest: Add failing test for quic double free

The double free happened on the EVP_MD object, when we used external
quic implementation. This test makes the yield secret callback fail, to
make the kdfdigest free path happen.

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27713)

(cherry picked from commit 9ed90fd44cc1b8039d82610d90f56275d519c204)

quic_tls.c: Precede double free on EVP_MD variable

When external quic implementation is used, the variable is not used and
double free happens whe the yield_secret_cb fails.

Resolves: #27504

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27713)

(cherry picked from commit 258d3a695e32828df7dbda6ee9ae67d31e128f62)

[design] Functions for explicitly fetched signature algorithms

This design goes into more details what was outlined in the design for
[fetching composite (PKEY) algorithms and using them].

It also changes what functionality will be used for this. The design for
signature was originally to add modified initializers for DigestSign and
DigestVerify, but recent OTC discussions redirected us to have a closer look
at EVP_PKEY_sign() and EVP_PKEY_verify().

[fetching composite (PKEY) algorithms and using them]:
./fetching-composite-algorithms.md

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22672)

(cherry picked from commit 66454bf8bac860212bb959c1e847a0483a053025)

Document that FIPS provider cannot be used by multiple libcryptos

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27702)

(cherry picked from commit 08b2042a20e76472416c8c7c48e479d893ba904f)

test/evp_test.c: Free fetched_digest on error to avoid memory leak

Call EVP_MD_free() to release fetched_digest if OPENSSL_zalloc() fails, preventing a memory leak.

Fixes: 2208ba56eb ("evp_test: Add the missing check after calling OPENSSL_malloc")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27648)

(cherry picked from commit e8deb32af4874c781838c1596c6355712b5d0ed0)

crypto/property/property.c: Free impl->method to avoid memory leak

After ossl_method_up_ref() succeeds, impl_free() should be called to free impl->method.

Fixes: 860ecfd ("property: check return values from the property locking
calls.")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27564)

(cherry picked from commit 00c531a5e327320f0ec78ce4b153fac65ebca229)

apps: lib: Prevent potential NULL dereference in init_client()

apps: lib: Simplify ba_ret handling in init_client()

Simplify logic around ba_ret assignment:
- Fail early if ba_ret == NULL
- Assign directly otherwise, without checking *ba_ret

This avoids extra nesting and matches OpenSSL's conventions.

CLA: trivial
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Co-authored-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26783)

(cherry picked from commit 3161f460fa7eacc7a93f8edf413c78b4dcf65823)

Note finished state in cipher BIO EOF

When the cipher BIO encounters a non-retriable EOF (or error), mark the
state as "finished", else a subsequent BIO_flush() or attempted read may
attempt to finalise the crypto state again, and fail, leading, for
example, to users seeing erroneous apparent decryption failure.

This is not a new problem, the fix should be backported to all supported
releases. It was made more apparent by recent changes to the base64
BIO, which returns a non-retriable EOF when padding is seen at the end
of the base64 data, even if the underlying next BIO is "retriable".

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27680)

(cherry picked from commit 005fa3e00e1ccfd83aa99d28e2eff55597dd5fc2)

Attempt to fix occasional failure of quicapi test in ci

https://github.com/openssl/openssl/actions/runs/15214054228/job/42795224720

the theory I have for the cause of this failure is:

1. qtest_create_quic_connection_ex is called for the client
2. The client is in blocking mode, so we fall into the conditional on line 512
3. We create the server thread on line 519, which is non-blocking
4. The scheduler in the failing case, lets the server run ahead of the client
5. Server thread enters qtest_create_quic_connection_ex and iterates steps
   6-9 in the do_while loop starting on line 530
6. Server calls qtest_add_time
7. Server calls ossl_quic_tserver_tick
8. Server calls ossl_quic_tserver_is_term_any, received NULL return
9. Server calls qtest_wait_for_timeout
10. Eventually qtest_wait_for_timeout returns zero, adn the server jumps to
    the error label, returning zero to globservret, and the thread exits
11. Client thread regains the cpu, and attempts to call SSL_connect, which
    fails, as the server is no longer listening
12. We fall into the error case on line 556, and SSL_get_error returns
    SSL_ERROR_SSL, which causes clienterr to get set to 1
13. We exit the do{} while loop on line 581, and do the TEST_true check on
    line 593. The server having exited wait_for_thread returns true, but
    globserverret is still zero from step 10 above, and so the test fails

I can't prove this is the case, as the test only appears to fail in CI,
and we can't dump verbose logging there, lest we affect the timing of
the tests, so this is just a theory, but it seems to fit the
observations we have.

Attempting to fix this, by creating a thread interlock with a condition
variable that blocks the server from ticking the quic reactor until such
time as the client is about to call SSL_connect to prevent the race
condition

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27704)

(cherry picked from commit 864333b455eb36ba84562d6482547bf4c8b49581)

Document EVP_CIPHER failure for missing provider function

When writing a new CIPHER implementation the OSSL_FUNC_cipher_get_params
must be present, otherwise the fetch fails. This behaviour is seen in
function evp_cipher_cache_constants@crypto/evp/evp_lib.c.

Resolves: #25801

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27696)

(cherry picked from commit 3423c30db3aa044f46e1f0270e2ecd899415bf5f)

apps/cmp.c: Free bio on error to avoid memory leak

Call BIO_free() to release bio if ASN1_i2d_bio_of() fails, preventing a memory leak.

Fixes: 6a3579e190 ("CMP: add support for requesting cert template using genm/genp")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27647)

(cherry picked from commit e0ae801728776b53e2be0972846072ce32bea304)

OSSL_CMP_MSG_http_perform(): Remove extraneous %s from debug log print

Also add missing ":" to another log print.

Fixes #27634

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/27635)

(cherry picked from commit 0873cd1b680d2f54de3dbcc754ea6b1b397f112b)

crypto/pkcs7/pk7_smime.c: Add BIO_free() to avoid memory leak

Add BIO_free() to free tmpout if OPENSSL_malloc() fails to avoid memory leak.

Fixes: 8e70485 ("RT3955: Reduce some stack usage")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27631)

(cherry picked from commit 9882d389df71ef7163c7769b4431a0dbe713ab65)

apps/pkeyutl.c: Add OPENSSL_free() to avoid a memory leak

If EVP_PKEY_CTX_ctrl_str() fails, the code jumps to 'end' label without freeing passwd, causing a memory leak.

Fixes: 9d1bf5f7de ("Add option to read pkeyopts interactively")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27470)

(cherry picked from commit 0dc6ea55a13dbe27af234b5328527d0a31ae68eb)

Add more instructions in HACKING.md

It's been long since it was updated or refined, and it was a bit too
vague in certain areas.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27674)

(cherry picked from commit 8bd89f15c967db43e34d9d2986b6fa9614a0a9ac)

Avoid leaking duplicated EVP_PKEY_CTX in case of error

Fixes Coverity 1647946 1647947

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27686)

Fix memory leaks after failure of PKCS7_add_signed_attribute()

If PKCS7_add_signed_attribute fails,
seq never escapes out of the callee and will
therefore result in a memory leak.
This is similar to ed3d277127.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27670)

(cherry picked from commit 6543f34dda8908db56372581eef6eafa0ae4add4)

Updated Windows notes on the use of “no-makedepend” for new builds

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27361)

(cherry picked from commit afd32bcb5456a9e33b0f4e07f572263b404d4d4b)

apps/x509.c: Fix the -addreject option adding trust instead of rejection

Fixes CVE-2025-4575

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27672)

(cherry picked from commit 0eb9acc24febb1f3f01f0320cfba9654cf66b0ac)

crypto/evp/signature.c: add checks for consistent presence of 'update' and 'final' functions

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

(cherry picked from commit 8626a716b0776e4203dc89f2e81c54d078a7ad07)

provider-signature.pod: add missing doc of OSSL_FUNC_signature_query_key_types(), fix doc of return types, etc.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

(cherry picked from commit 1146b74a8a5784cc51426695d038ad8d9a4cc717)

crypto/evp/signature.c: add more specific diagnostic data in case provider does not implement functions needed

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

(cherry picked from commit 4a9a59cb075ee2fe0f76040f92f451e954ec8f64)

crypto/evp/signature.c: compensate for providers not adding error queue entries on operation failure

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

(cherry picked from commit 3a57fb1386df87481233ed046fc16bf3332de046)

crypto/evp: compensate for providers not adding error queue entries for keymgmt, sigver, and asymcipher

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

(cherry picked from commit 72351b0d18078170af270418b2d5e9fc579cb1af)

store_result.c: add to error queue which provider failed to load credential and hint on using default provider

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27367)

(cherry picked from commit 1fc96a3cff124777597ed18c2405dc7181bda2ef)

Fix some typos in the man pages

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27590)

(cherry picked from commit 8fd0d230fdf80f7b6a3ee6c1197923600ce45c6a)

The condition that is never checked has been removed.

If criterion == OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT, the criterion !=0 condition will be triggered.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27607)

(cherry picked from commit 00480f1def86aab882f2bd4d15d2d03862009718)

Check NASM version for {vex} prefix support

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27632)

(cherry picked from commit b9282ecafa36bf3192bdc2cd54c729fb70a92814)

Remove redundant space in effective address

To have effective address of vmovapd instruction recognized and
translated to Intel format by the x86_64 assembler translator.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27632)

(cherry picked from commit de4a7fad9ef84fe902119b58b1fca58d7437816f)

Pick up {vex} in x86_64 assembler translator

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27632)

(cherry picked from commit 4189992f5bd8e38d640ec0cbe602d7dfc8c78a7e)

demos/bio/sconnect.c: Free ssl_bio on error to avoid memory leak

Call BIO_free() to release ssl_bio if an error occurs before BIO_push(), preventing a memory leak.

Fixes: 396e720965 ("Fix certificate validation for IPv6 literals in sconnect demo")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27639)

(cherry picked from commit 55d8d859797e8229bc499bbc7c3c76821b654682)

crypto/x509/v3_lib.c: Free tmpext if X509V3_EXT_add() fails to avoid memory leak

Add OPENSSL_free to free tmpext if X509V3_EXT_add() fails to avoid memory leak.

Fixes: 878dc8dd95 ("Join the x509 and x509v3 directories")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27566)

(cherry picked from commit 5f661e4e96bc3bfa52b4e0735f407cb41f162869)

Fix AIX build in test/radix/quic_tests.c

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27354)

(cherry picked from commit 235092d780857baf64cefae7eeb8e06e56e19147)

Fix build failure on AIX

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27354)

(cherry picked from commit e11fdd8293c5e13e09c817b89b9c3d4c1a46d857)

ssl/t1_lib.c: Free gix if sk_TLS_GROUP_IX_push() fails to avoid memory leak

Add OPENSSL_free() to free gix if sk_TLS_GROUP_IX_push() fails to avoid memory leak

Fixes: 4b1c73d2dd ("ML-KEM hybrids for TLS")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27568)

(cherry picked from commit 0ba71c0a24b185780a96b2c257653f4dcd3446c8)

demos/guide/tls-client-block.c Spelling correction

Fix spelling error in one word.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27611)

(cherry picked from commit 10bd6fa8ca93b4cf53f005f110c827ed923c89a4)

s3_lib.c: Use illegal_parameter for failing encapsulation in ml_kem

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27627)

(cherry picked from commit e66097fc6687750ac792986a71375b23793766c2)

Fix trace output for provider algorithm names

Use the index variable to print out the provider algorithm details.

CLA: trivial

Signed-off-by: Ilie Halip <ilie.halip@nxp.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27624)

(cherry picked from commit 1094db3c4e57c4d537837912db3736299b50edef)

Add NULL check in ossl_quic_get_peer_token

If a peer address hasn't been set on a quic channel yet, we will not
yield a token from our hashtable of available tokens. Fail the
get_peer_token lookup in that event

Fixes #27608

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27610)

(cherry picked from commit 99ea6b38430dc977ba63c832694cdb3c2cb3c2c9)

s3_lib.c: Handle weak x keys as illegal_parameter alert

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27597)

(cherry picked from commit 5da4ea10be8cf8ca66dff95c9997966f21c82029)

Return SLH-DSA public key when requested

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27605)

(cherry picked from commit c1ab5734ab504b500ef2f00b0f268496ef3a7bf5)

Return ML-DSA public key when requested

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27605)

(cherry picked from commit 3e82012b39e4d5999cc33655175f6473f923c26e)

test/testutil/testutil_init.c: Add OPENSSL_free() to avoid memory leak

Free trace_data if error occurs to avoid memory leak.

Fixes: d73458d17a ("Add tracing capability in test utilities")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27600)

(cherry picked from commit 3818f7779ef4bf4d4ccacd13506ec92885e45553)

Stop a TLSv1.3 server emitting an unsolicited PSK extension

If we attempt to accept a connection on an SSL object, and the
application has set an SSL_SESSION on that SSL object then we
can mistakenly believe that we are resuming and
emit an unsolicited PSK extension back to the client.

This can especially happen when using SSL_clear() which leaves
any SSL_SESSION associated with the SSL object.

See
https://github.com/openssl/openssl/discussions/27563#discussioncomment-13049352
and
https://github.com/openssl/openssl/discussions/24567

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27584)

(cherry picked from commit aa8bca2e81030560d690cb68bbcbe8b7d00d1d29)

APPS/cmp.c: fix char encoding of subject, issuer, sender, and recipient DN

Fixes #27572

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27592)

(cherry picked from commit 35e431ed6daa894ee5385363cf4cfe4954312e4d)

Check rand_meth_lock existence before trying to lock it

There are situations during exit clean up where dependent libraries
might be using TLS to finalize stuff but that might crash because
the rand_meth_lock can get freed and there is still an attempt to
get rand bytes. This change makes sure that things fail nicely.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27119)

(cherry picked from commit 4eb3eea7a38eccfa2790020188d1d59dc68d8755)

chacha_poly: fix settable ctx param list

The settable list used the generic AEAD cipher list which included
an extra parameter and omitted the IV length one. The set ctx param call
was custom so the errant list didn't directly impact operation.

The comment about ignoring OSSL_CIPHER_PARAM_AEAD_MAC_KEY is completely bogus.
That parameter isn't accepted either here or by the shared AEAD cipher params.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27534)

Add a test for app data received too early

Add a test for app data which was received prior to the Finished is read
correctly, and that if we continue to read we get the expected result.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/27543)

Ensure we properly release DTLS buffered app data records

If we read an app data record before we have read the Finished we buffer
it. Once we've read it we need to make sure we've properly released it
otherwise we will attempt to read it again (and this time there will be
no data in it).

Fixes #27316

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/27543)

test/bio_comp_test.c: Initialize pointer to avoid undefined behavior

If the allocation for "original" fails, "result" may be freed without being
properly initialized. Since result could hold a random value due to its
assignment in do_bio_comp_test(), freeing it without initialization is unsafe
and may lead to undefined behavior.

Fixes: 12e96a2360 ("Add brotli compression support (RFC7924)")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27569)

(cherry picked from commit 4dca928a29cbe413f2416ac5e1ba2fe4e073f608)

Fix memory management in port_make_channel

Also make port_new_handshake_layer processing clearer.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27562)

(cherry picked from commit d56f9b4d894d1a3ce92f1c308ef42398495943e7)

Add a test for sending an empty app data record in DTLS

DTLS should ignore this

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27541)

(cherry picked from commit fe01b4d2f62261a6c78d5c2a7608d4ba76c6d6f3)

Drop empty app data records in DTLS

App data records with 0 bytes of payload will confuse callers of SSL_read().
This will cause a successful read and return 0 bytes as read. Unfortunately
a 0 return from SSL_read() is considered a failure response. A subsequent
call to SSL_get_error() will then give the wrong result.

Zero length app data records are actually allowed by the spec, but have
never been handled correctly by OpenSSL. We already disallow creating such
empty app data records. Since the SSL_read() API does not have a good way to
handle this type of read, we simply ignore them.

Partial fix for #27316

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27541)

(cherry picked from commit a23d5e20f162564d8c13bda50ea358caaa7b047c)

crypto/provider_conf.c: Fix possible memory leak

Assign the return value of ossl_provider_info_add_to_store to added instead of
setting it directly to 1, in order to avoid a memory leak caused by entry not
being freed if ossl_provider_info_add_to_store() fails.

Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27472)

(cherry picked from commit 9884f1dc11675a5c4613339cfb92903c6ba6103f)

Fix SSL_{set1,add1}_host() handling of host name/IP address and related documentation

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27457)

(cherry picked from commit 1eee02d3e710e01d864c37708f64e83511627e28)

SSL_set1_host.pod: add recommendation to use SSL_{set1,add1}_host() and SSL_set_tlsext_host_name()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27457)

(cherry picked from commit eb909d785f89c5f92613865ed8e7afc9f6fb9b2c)

Fix use after free bugs for public_keys and private_keys in evp_test

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27421)

(cherry picked from commit 81e8b5a5038b4952a22b2dc9fcf9994615ee8dc4)

Fix test/recipes/25-test_verify.t [3.5]

This removes a couple of tests that check a relaxation of the
'file:' scheme implementation that isn't present in OpenSSL 3.5

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27549)

Drop "by store"'s by_store_subject_ex()

It was used to pass libctx and propq, which would override the
corresponding values passed to by_store_ctrl_ex(). This wasn't
really reasonable to do either way, as it could potentially be a
surprise to the user, who can reasonably expect that the URI is
opened with the libctx and propq that was passed with the URI, and
not with those passed later.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27529)

(cherry picked from commit af5952d533b772ef8a3d7c666ed918acfc1dd911)

Add test_verify tests

Originally from https://github.com/openssl/openssl/pull/27507, with some
changes.

Co-authored-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27529)

(cherry picked from commit 927debaf7b4e83e47d3f016808acab947cc50ea2)

Rework the "by store" X509_LOOKUP method to open the given URI early

The cached X509_LOOKUP method data is no longer just the URI, but now
includes the OSSL_STORE_CTX pointer, and required parameters to reopen
the URI at any time. cache_objects() is modified to handle this, and
only (re)open the URI when it wasn't previously opened, or when it was
closed by an earlier call.

This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and
get to see possible errors when the URI is loaded.

This assumes that if the URI could be opened once, it can be opened
again.

Fixes #27461

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27529)

(cherry picked from commit 0c48ee2bf513cbc2f1de2ff8bc11750e4b593620)

Disable unterminated-string-initialization in strict-warnings

Recently updated to fedora 42, which includes an updated gcc, which
triggers a new warning:

test/afalgtest.c:44:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (18 chars into 17 available) [-Werror=unterminated-string-initialization]
   44 |         "\x53\x69\x6e\x67\x6c\x65\x20\x62\x6c\x6f\x63\x6b\x20\x6d\x73\x67"

The warning occurs because in some locations we create char buffers of
length X, and fill it with X bytes of data, truncating the NULL
terminator.

We could fix it by adding the nonstring attribute, but given that:
1) Adding attributes might impact other platforms that don't understand the
   attribute.

2) We often create char buffers that don't expect a NULL terminator.

3) Converting the unsigned char arrays to uint8_t, or other types that
   could be interpreted as non-strings has no impact, only applying the
   nonstring attribute silences the warning.

It seems more sensible to just disable the warning entirely

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27490)

(cherry picked from commit d08d77789e20e8b47a48f4d0a998ccfcde9d389b)