Niels Provos [Tue, 12 May 2026 16:44:12 +0000 (09:44 -0700)]
crypto/x509: replace O(N^2) RFC 3779 canonicalisation merge with linear sweep
ASIdentifierChoice_canonize and IPAddressOrRanges_canonize previously
merged adjacent entries with an in-place loop that called
sk_..._delete() after each merge, making the merge O(N^2) due to the
per-merge stack shift.
Replace the merge with a single linear sweep using a write index
distinct from the read cursor: mergeable entries fold into the
previous output's upper bound in O(1), non-mergeable entries are slid
forward into the write slot, and the source slot is set to NULL so the
ASN.1 free machinery cannot double-free on a subsequent abort.
Canonicalisation is now O(N log N) overall, bounded by the existing
sort.
Mixed-state-on-error safety is provided by the caller's normal
teardown path: OPENSSL_sk_pop unlinks without freeing, OPENSSL_sk_set
replaces without freeing the displaced value, and
ossl_asn1_item_embed_free no-ops on NULL slots, so returning early on
an inner failure leaves the stack in a state that the choice's normal
free path handles cleanly.
New regression tests in test/v3ext.c at N=8192 cover the all-merge,
no-merge, interleaved (slide-forward), range-merge,
overlap-mid-sweep, and inverted-range-mid-sweep paths; the
mixed-state teardown invariant is exercised under ASan + UBSan.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Fri Jul 3 19:20:01 2026
(Merged from https://github.com/openssl/openssl/pull/31147)
Jakub Zelenka [Wed, 24 Jun 2026 14:12:37 +0000 (16:12 +0200)]
ci: run full cross-compile tests on PRs with 'extended tests' label
Previously the cross-compile workflow only ran the EVP tests on pull
requests, with the full test suite done only for push events. Allow the
full suite to run on a pull request when it has the 'extended tests'
label which is already used for extended tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 3 14:39:38 2026
(Merged from https://github.com/openssl/openssl/pull/31705)
Neil Horman [Tue, 30 Jun 2026 17:06:52 +0000 (13:06 -0400)]
Add test to exercise non-caching code paths
Use openssl list, which uses EVP_*_do_all_provided on non-caching
algorithms. The do_all_provided path callbacks expect the algorithms
that are looked up to be saveable via up_ref, so this, when run under
asan, makes for a good test to ensure we don't trigger any use after
free situations when not caching algs.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:17 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
Neil Horman [Mon, 29 Jun 2026 21:27:53 +0000 (17:27 -0400)]
Extend refcounting on evp objects to provider requesed no-caching
We recently removed reference counting for EVP objects, but kept the
refcounting when we build with no-cached-fetch.
There is a corner case in which providers in builds that do caching may
still request non-caching by setting *no_cache = 1 in their query
operations.
OQS tripped over this here:
https://github.com/open-quantum-safe/oqs-provider/pull/787
When a provider requests no caching, we need to treat those algorithms
as though we are running in a no-cached-fetch build and still do ref
counting on them.
Teach our algorithms implementation to understand when a provider is
requesting non-caching, mark them as such and ref count only those.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:13 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
crypto/pem/pem_info.c: avoid switching on PEM_INFO_NONE
Coverity complains that the switch statements in PEM_X509_INFO_read_bio_ex()
switches on PEM_INFO_NONE, while the enclosing condition
(itype != PEM_INFO_NONE) explicitly rules it out. Pacify it by changing
the switch case to default (not removing it to avoid triggering
-Werror=switch).
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695453
Complements: 0e8f2844ed3e "fix function pointer type mismatch in PEM_X509_INFO_read_bio_ex" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 2 07:26:24 2026
(Merged from https://github.com/openssl/openssl/pull/31792)
fuzz/provider.c: check evp##_up_ref return value in collect_##evp
Coverity has reported an unchecked result of an evp##_up_ref call
that is checked elsewhere. Rewrite the collect routine to try to do
the up_ref first, and then call free if push doesn't succeed.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695451
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695454 Fixes: f3b988dc2951 "Add provider fuzzer" Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 2 07:26:22 2026
(Merged from https://github.com/openssl/openssl/pull/31792)
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_asym_cipher_free in evp_asym_cipher_from_algorithm
evp_asym_cipher_from_algorithm, in its error path frees the allocated
cipher with EVP_ASM_CIPHER_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_asym_cipher_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_signature_free in evp_signature_from_algorithm
evp_signature_from_algorithm, in its error path frees the allocated sig
with EVP_SIGNATURE_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_signature_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_keymgmt_free in keymgmt_from_algorithm
keymgmt_from_algorithm, in its error path frees the allocated keymgmt
with EVP_KEYMGMT_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keymgmt_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_keyexch_free in evp_keyexch_from_algorithm
evp_keyexch_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keyexch_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:13:21 +0000 (11:13 -0400)]
use evp_kem_free in evp_kem_from_algorithm
evp_kem_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_kem_free (the internal
function that acutally does free the alg) instead.
Michał Trojnara [Sat, 27 Jun 2026 20:39:44 +0000 (22:39 +0200)]
s_client: skip TCP shutdown drain for datagram protocols
The shutdown-side drain uses a TCP half-close and a fixed 500 ms
select() timeout to let peers consume buffered alerts before close.
Running it for DTLS/QUIC datagram connections causes an unnecessary
delay after the connection has otherwise completed.
Limit this workaround to non-DTLS, non-QUIC connections.
Mounir IDRASSI [Tue, 30 Jun 2026 10:12:18 +0000 (19:12 +0900)]
apps/s_server.c: fix SSL object leak on rpk_enable() failure
In www_body() and rev_body(), con = SSL_new(ctx) is called before
rpk_enable(con), but ownership of con is transferred to ssl_bio only
later by BIO_set_ssl(..., BIO_CLOSE). If rpk_enable() fails, the code
jumps to err: before that transfer without freeing con, leaking the SSL
object.
Add SSL_free(con) before goto err in both rpk_enable() failure paths,
matching the adjacent SSL_set_session_id_context() and BIO_new_socket()
error paths. sv_body() is unaffected because its err: block already
frees con.
The global rpk_files is not leaked. Its lifetime is managed
by s_server_main(), which frees it in the end cleanup block.
Mounir IDRASSI [Mon, 29 Jun 2026 07:46:29 +0000 (16:46 +0900)]
Suppress MSVC C4996 in applink.c
applink.c deliberately stores legacy CRT function pointers because
ms/uplink.h expects the old fopen and _open signatures. Keep the
table entries unchanged and suppress MSVC warning C4996 locally
around OPENSSL_Applink() instead of switching to fopen_s or
_sopen_s.
Fixes #8241
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 1 09:17:39 2026
(Merged from https://github.com/openssl/openssl/pull/31765)
Milan Broz [Mon, 29 Jun 2026 11:59:16 +0000 (13:59 +0200)]
Use more recent default for _WIN32_WINNT
After the windows.h include optimization introduced in
commit 1eaf29ef6c, the _WIN32_WINNT default was changed, causing
performance regressions.
Currently, _WIN32_WINNT is defined as 0x0501, which means WinXP.
This causes the code to be compiled with WinXP-compatible code, notably
- without USE_RWLOCK
- using legacy thread implementation
- legacy RNG seeding (no BCryptGenRandom)
This patch increases the requirement to 0x600 (Windows Vista).
Note that code running on WinXP cannot currently be compiled with
any default configuration, as supported compilers generate executables
for Windows Vista and above.
If we provide some way to support WinXP, it can be done by
redefining _WIN32_WINNT.
Resolves: https://github.com/openssl/project/issues/2010 Fixes: 1eaf29ef6c "Remove direct includes of windows.h where possible" Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 1 09:14:18 2026
(Merged from https://github.com/openssl/openssl/pull/31774)
Ingo Franzki [Mon, 29 Jun 2026 11:04:32 +0000 (13:04 +0200)]
s390x: Fix AES-XTS hardware acceleration in IBM z17
For the re-init case where only the IV is specified, but no key, the 'nap'
field must also be initialized.
Instead of setting the s390 specific fields in a special case block, call
ctx->hw->init() also in this case. It performs the necessary setup already
(when the KM function code was once set already).
Adjust the cipher_hw_aes_xts_s390x_initkey() function so that it can also
be called with a NULL key. It then only performs the IV setup as well as
setting up the 'nap'.
Closes: https://github.com/openssl/openssl/issues/31766 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Jul 1 09:12:26 2026
(Merged from https://github.com/openssl/openssl/pull/31775)
Ingo Franzki [Thu, 25 Jun 2026 09:06:30 +0000 (11:06 +0200)]
s390x: Fix return code handling in HMAC_Init_ex()
When running on the s390x platform HMAC_Init_ex() calls s390x_HMAC_init()
to optionally allow hardware acceleration of the HMAC operation. In case
the hardware acceleration is not available, s390x_HMAC_init() returns -1
to indicate that. In this case the software path is continued.
The problem is that rv was set to -1 by s390x_HMAC_init() and stays at
this until the end of the function. In case the software path detects an
error it goes to the 'err' label which just returns rv as is, and thus
HMAC_Init_ex() now returns -1 instead of 0 (rv was initialized to 0 at
declaration).
The wrong return value might then be propagated through all layers, i.e.
to EVP_MAC_init() which also returns -1 in this case. However, EVP_MAC_init()
is defined as returning 1 on success, or 0 on error, i.e. a boolean kind of
return value.
Typically, callers will do something like 'if (!EVP_MAC_init(s....))' to
check for errors. A return value of -1 is non-zero, and thus it is treated
as successful return.
Fix this by setting rv back to 0 when s390x_HMAC_init() returned -1.
Fixes: 0499de5adda2 "s390x: Add hardware acceleration for HMAC"
Resolves: https://github.com/openssl/openssl/issues/31706 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Tue Jun 30 20:49:52 2026
(Merged from https://github.com/openssl/openssl/pull/31723)
Jakub Zelenka [Thu, 25 Jun 2026 15:57:37 +0000 (17:57 +0200)]
property: add cache provider-order regression test
When two providers cache the same nid and property query, the first one
to do so must own the providerless cache entry, so that a NULL-provider
lookup keeps resolving to that provider. This covers commit 9d476175d7.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 11:01:57 2026
(Merged from https://github.com/openssl/openssl/pull/31738)
Daniel Kubec [Fri, 5 Jun 2026 11:44:47 +0000 (13:44 +0200)]
TEST: Add DTLS 1.2 coverage for Session ID verification
The DTLS 1.2 tests exercise the same verification logic and confirm that the
behavior matches the TLS 1.2 implementation. The tests pass as expected and
provide additional coverage for DTLS 1.2 without requiring any functional
changes.
Fixes #31250
Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Jun 30 11:00:55 2026
(Merged from https://github.com/openssl/openssl/pull/31389)
Bob Beck [Fri, 22 May 2026 10:10:37 +0000 (04:10 -0600)]
Don't attempt to check the security level on what signed our own certificate.
What matters to us is that the key *we* are using matches our desired
security level, as we may sign things with that key. As far as who
signed us, this could be signed by something we don't recognize at all,
and it is up to the peer to decide if the thing signing us matters to
it (i.e. if it recognizes the algorithm, decides it's strong enough,
or it even verifies the signature, as it might already trusts our key
due to pinning, TOFU, Prayer and Clean Living, or whatever.)
Obviously, we still check the security level on any signatures *we*
recieve to verify *from* a peer.
Fixes: https://github.com/openssl/openssl/issues/31195 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 10:47:09 2026
(Merged from https://github.com/openssl/openssl/pull/31271)
Jakub Zelenka [Tue, 23 Jun 2026 14:21:27 +0000 (16:21 +0200)]
apps: cover the smime multiple -signer parsing path
The signerfile != NULL block in smime_main(), reached when more than one
-signer is given (including the case where a preceding -inkey leaves
keyfile != NULL), was not exercised: the existing multi-signer tests run
through the cms command, and the smime app was only ever run with a
single signer. Add a two-signer test, with an explicit -inkey, to the
pkcs7 test set so it runs through smime when signing.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jun 30 08:57:47 2026
(Merged from https://github.com/openssl/openssl/pull/31675)
Jakub Zelenka [Thu, 18 Jun 2026 18:45:06 +0000 (20:45 +0200)]
quic: add mfail test for RCIDM
This tests memory failures in remote connection ID manager code.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:45 2026
(Merged from https://github.com/openssl/openssl/pull/31602)
Jakub Zelenka [Thu, 25 Jun 2026 20:49:07 +0000 (22:49 +0200)]
quic: add mfail test for multi-packet RXE
Add a record layer test that executes qrx_process_pkt() under mfail
on a freshly created qrx whose rx_free freelist is empty. This
deterministically lands the qrx_ensure_free_rxe() call for the first
packet of a multi-packet datagram among the enumerated injection points
which is the precondition for triggering assert failure in
qrx_validate_hdr_early(). The test reuses rx_script_5's coalesced
Initial+Handshake+1-RTT datagram and only provides the Initial secret,
since the bug fires before any decryption is attempted.
Assisted-by: Claude:claude-opus-4-7 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun 30 08:56:00 2026
(Merged from https://github.com/openssl/openssl/pull/31331)
Jakub Zelenka [Fri, 19 Jun 2026 16:52:37 +0000 (18:52 +0200)]
statem: add direct tests for tls_construct_client_hello
Add a new test which calls tls_construct_client_hello() directly,
creating an SSL_CONNECTION enough to invoke the construct function
without making a full handshake, then verifies the produced
ClientHello structurally and by round-tripping it through the
server-side tls_process_client_hello().
The covered branches include TLS 1.3 (with and without middlebox
compat), TLS 1.2, DTLS, session resumption, HelloRetryRequest, the DTLS
cookie and client_random reuse paths, the deterministic error branches
(WPACKET overflow and no usable ciphers), and the ECH wrapper path
(happy path with server-side decryption, the TLS 1.2 version error, and
OOM). Out-of-memory branches are exercised with the mfail tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:48 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
Jakub Zelenka [Fri, 19 Jun 2026 13:58:59 +0000 (15:58 +0200)]
statem: fail handshake if there is memory failure in negotiate_dhe
Previously this just resulted in the skip of the group but such failure
should result in a proper error. This is not a big issue but it impacts
mfail tests so it would be good to fail.
Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 08:54:47 2026
(Merged from https://github.com/openssl/openssl/pull/31618)
Neil Horman [Wed, 24 Jun 2026 19:55:48 +0000 (15:55 -0400)]
ensure writes are syncronized on windows in CRYPTO_THREAD_run_once
We've tried to fix this properly using InitOnceExecuteOnce, but it
results in an ABI breakage, so we're doing it this way.
on windows, CRYPTO_THREAD_run_once, on weakly memory ordered systems,
may complete the write of the run once variable lock before some of the
writes made by the init callback routine complete. The result is that
on a heavily multithreaded application, other therads may see the data
that was meant to be in an initalized state, as in some erroneous
in-between state, leading to errors.
Fix it by inserting a full memory barrier after we return from the init
callback, and prior to setting the run once variable to ONCE_DONE.
Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Jun 30 08:51:16 2026
(Merged from https://github.com/openssl/openssl/pull/31713)
Mounir IDRASSI [Sun, 14 Jun 2026 07:12:01 +0000 (16:12 +0900)]
test: run RIO notifier smoke test everywhere
The RIO notifier smoke test is currently limited to
Windows targets in both the build metadata and the
test recipe.
The test exercises the notifier abstraction and can
run on other platforms as well, so this removes the
Windows-only guards.
The test remains conditional on QUIC being enabled.
Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jun 30 08:49:54 2026
(Merged from https://github.com/openssl/openssl/pull/31494)
Billy Brumley [Thu, 25 Jun 2026 11:20:25 +0000 (07:20 -0400)]
[test] check tag abuse for AEAD ciphers
With AEAD ciphers, a tag is an input for decryption (the value to verify)
and an output of encryption (the generated value). Therefore:
- supplying a tag value while encrypting must fail
- reading a tag while decrypting must fail
- error codes should be consistent across all AEADs
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun 30 07:47:03 2026
(Merged from https://github.com/openssl/openssl/pull/31734)
Pauli [Mon, 22 Jun 2026 23:01:17 +0000 (09:01 +1000)]
demo: add program that shows how to query the FIPS provider version
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/31654)
Nikola Pajkovsky [Tue, 16 Jun 2026 06:32:35 +0000 (08:32 +0200)]
providers/fips/fipsprov.c, test/p_test.c: remove c_gettable_params static global
c_gettable_params is never read anywhere in the files; it was dead
storage. Remove it.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:55 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
Nikola Pajkovsky [Tue, 16 Jun 2026 06:11:32 +0000 (08:11 +0200)]
providers/baseprov.c: remove static globals
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the base provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Jun 28 17:51:54 2026
(Merged from https://github.com/openssl/openssl/pull/31508)
Matt Van Horn [Fri, 1 May 2026 04:46:43 +0000 (21:46 -0700)]
providers/defltprov.c: remove static globals from provider_init
The default provider stored two function pointers from the core
dispatch table (c_gettable_params, c_get_params) in file-scope statics,
written by ossl_default_provider_init() without any synchronization.
When OSSL_PROVIDER_load() is invoked from multiple threads concurrently,
TSAN reports a data race on both writes[1].
c_gettable_params is never read anywhere in the file; it was dead
storage. c_get_params is only consumed once, inside the same call
to ossl_default_provider_init(), to seed the provider context
via ossl_prov_ctx_set0_core_get_params(). It can therefore be a local
variable rather than file-scope state.
Drop the unused c_gettable_params static together with its dispatch
case, and scope c_get_params inside the init function. The behavior
of the default provider is unchanged for single-threaded callers;
the concurrent-load race goes away because the shared mutable state
is gone.
Jakub Zelenka [Mon, 15 Jun 2026 16:24:28 +0000 (18:24 +0200)]
test/recipes/15-test_pkey.t: extend tests for openssl pkey -text and -text_pub
This slightly improves openssl pkey text coverage.
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun Jun 28 17:42:46 2026
(Merged from https://github.com/openssl/openssl/pull/31521)
test/asn1_string_test.c: allocate tmpstring properly in asn1_string_new_not_owned_test
Since tmpstring's ownership is transferred to tmp in ASN1_STRING_set0(),
it should be allocated using OPENSSL_strdup() and not strdup()
(as it will be freed with OPENSSL_free() in ASN1_STRING_clear_free()).
Also, don't try to free tmpstring on error, as at no point there is a jump
to err when tmpstring is allocated and not owned by tmp.
Simo Sorce [Mon, 15 Jun 2026 13:59:47 +0000 (09:59 -0400)]
Expand AES mode macro into explicit functions
This removes the PROV_CIPHER_HW_aes_mode macro and replaces it with explicitly
written function definitions for each AES mode (ECB, CBC, CFB128, CFB8, CFB1,
OFB128, CTR).
Expanding macro-generated functions improves overall code readability, allows
code navigation tools to properly index the function signatures, and provides
clearer stack traces during debugging.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Mon, 15 Jun 2026 13:51:16 +0000 (09:51 -0400)]
Prefix internal AES-GCM functions with ossl_
The `aes_gcm_hw_initkey` and `generic_aes_gcm_cipher_update` functions are
shared across multiple hardware-specific provider implementations but lacked
the internal `ossl_` prefix. They have been renamed to
`ossl_aes_gcm_hw_initkey` and `ossl_generic_aes_gcm_cipher_update`
respectively to follow OpenSSL naming conventions and prevent potential
namespace collisions.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 23:19:19 +0000 (19:19 -0400)]
Consolidate SPARC T4 AES implementations
Move SPARC T4-specific AES hardware implementations (GCM, CCM, and XTS) from
individual mode-specific files into a single unified file
(cipher_aes_hw_t4.c). This consolidates the architecture-specific logic to
improve code organization and maintainability.
Additionally, this change removes the unused `keybits` parameter from several
SPARC T4 hardware initialization routines to clean up the internal API.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:06:01 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 23:02:27 +0000 (19:02 -0400)]
Consolidate s390x AES hardware implementations
Move the s390x hardware-accelerated AES mode implementations (GCM, CCM, and
XTS) from their respective files into a single `cipher_aes_hw_s390x.c` file.
Centralizing the platform-specific logic simplifies the code structure and
improves maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:58 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:51:14 +0000 (18:51 -0400)]
Extract Zvkned key length check to helper
A new helper function, zvkned_key_schedule_supported, is introduced to
centralize the verification of 128-bit and 256-bit key lengths.
This replaces multiple duplicated, hardcoded checks across the RISC-V AES
implementations to improve code readability and maintainability. It also
ensures consistent check handling for XTS mode by correctly evaluating half
the key length.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:56 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:32:37 +0000 (18:32 -0400)]
Consolidate RISC-V 64 AES hardware code
Merge the RISC-V 64 hardware-accelerated AES mode implementations (GCM, CCM,
and XTS) into a single file (`cipher_aes_hw_rv64i.c`). This removes the need
for separate files for GCM and CCM, and extracts RV64-specific XTS code from
the generic XTS hardware file, improving code organization.
Additionally, remove the unused `keybits` parameter from the RV64 AES hardware
retrieval functions.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:54 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 22:03:16 +0000 (18:03 -0400)]
Consolidate RV32I AES hardware implementations
Move the RISC-V 32-bit hardware-accelerated AES implementations for GCM, CCM,
and XTS modes into a single file (`cipher_aes_hw_rv32i.c`). This removes the
need for separate files (`cipher_aes_gcm_hw_rv32i.c` and
`cipher_aes_ccm_hw_rv32i.c`) and simplifies the build process. Additionally,
unused `keybits` parameters are removed from the provider hardware
initialization functions to clean up the code.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:52 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 21:22:17 +0000 (17:22 -0400)]
Consolidate ARMv8 AES hardware implementations
Move the ARMv8-specific hardware implementations for AES GCM into a single
consolidated file (`cipher_aes_hw_armv8.c`). This groups architecture-specific
optimizations together to improve code organization and maintainability.
Additionally, remove the unused `keybits` parameter from the ARMv8 provider
functions to simplify the function signatures.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:50 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 20:44:12 +0000 (16:44 -0400)]
Consolidate AESNI hardware implementations
Move the AES-NI specific hardware implementations for GCM, CCM, and XTS modes
from individual mode files into a single consolidated file
(`cipher_aes_hw_aesni.c`). This groups architecture-specific optimizations
together, improving code organization and maintainability.
As part of this refactoring, the unused `keybits` parameter was removed from
several AES-NI provider functions, and necessary XTS initialization and
context copy functions were exported for shared use.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:48 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 17:38:05 +0000 (13:38 -0400)]
Migrate s390x AES-XTS to standard HW interface
Move the s390x-specific AES-XTS implementation from `cipher_aes_xts_s390x.inc`
to `cipher_aes_xts_hw.c`, adapting it to use the standard `PROV_CIPHER_HW`
dispatch structure.
This refactoring removes standalone initialization wrappers and integrates the
s390x hardware backend more cleanly with the generic AES-XTS provider code. It
also reduces code duplication by relying on the generic layer for common
validations (such as the maximum blocks per data unit limit) before invoking
the hardware-specific stream cipher.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:46 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Thu, 11 Jun 2026 14:40:16 +0000 (10:40 -0400)]
Refactor AES XTS hardware key initialization
Replace complex AES XTS initialization and hardware selection macros
(`XTS_SET_KEY_FN`, `PROV_CIPHER_HW_declare_xts`, and
`PROV_CIPHER_HW_select_xts`) with standard C functions.
Architecture-specific initializers, particularly for RISC-V, are consolidated
to evaluate CPU capabilities within dedicated initialization functions rather
than relying on macro expansion. This refactoring improves overall code
readability, maintainability, and simplifies debugging by eliminating opaque
multi-statement macros.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:44 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Wed, 10 Jun 2026 21:55:57 +0000 (17:55 -0400)]
Convert AES CCM .inc files to separate .c files
The hardware-specific AES CCM implementations were previously included
directly as `.inc` files into `cipher_aes_ccm_hw.c`. This commit renames them
to standalone `.c` files and updates the build configuration, improving
modularity by treating them as separate compilation units.
Additionally, the `AES_HW_CCM_SET_KEY_FN` macro is replaced with a new
`ossl_cipher_set_ccm_aes_initkey` helper function. This reduces code
duplication, removes unsafe macro logic, and introduces proper error handling
during provider key initialization.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:42 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Tue, 9 Jun 2026 22:46:10 +0000 (18:46 -0400)]
Refactor AES hardware cipher implementations
Replace architecture-specific `.inc` files with standalone `.c` files for AES
ciphers and consolidate CFB mode logic into these new modules.
This eliminates the direct inclusion of source files and compiles each
hardware implementation as a separate translation unit.
This refactoring simplifies code organization and remove macro
complexity that makes it hard to understand what is implemented and
where enhancing maintainability.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:40 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Simo Sorce [Mon, 8 Jun 2026 22:23:00 +0000 (18:23 -0400)]
Replace GCM_HW_SET_KEY_CTR_FN with a function
The `GCM_HW_SET_KEY_CTR_FN` macro has been removed and replaced with a proper
function, `aes_gcm_hw_initkey`, for AES GCM hardware implementations. For ARIA
GCM, the macro expansion was manually inlined.
This refactoring eliminates a multi-line macro to improve debuggability and
type safety. Crucially, the new function checks the return value of the
underlying key setup routines, ensuring that key initialization failures are
now correctly caught and propagated instead of being ignored.
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sat Jun 27 09:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/31472)
Document the SNMPKDF "pass" parameter with OSSL_KDF_PARAM_PASSWORD,
matching the implementation and other KDF documentation. Also, fix
the nearby grammar.
007bsd [Tue, 23 Jun 2026 18:42:33 +0000 (21:42 +0300)]
crypto/x509/v3_ncons.c: fix scheme buffer leak in nc_uri() for schemeless URIs
OSSL_parse_url() allocates a 1-byte empty-string buffer for the scheme
even when the URI has no scheme. The empty-scheme error branch freed
uri_copy and jumped to end: which only frees host, leaving scheme
unfreed. Add OPENSSL_free(scheme) before the goto.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial Fixes: e599893a9fec "x509: allow SAN URIs to contain userinfo" Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
007bsd [Tue, 23 Jun 2026 18:42:29 +0000 (21:42 +0300)]
crypto/x509/pcy_cache.c: fix ext_pcons leak in policy_cache_new()
Two early-return paths in policy_cache_new() bypass the just_cleanup:
label and leak the POLICY_CONSTRAINTS object ext_pcons: (1) when
certificatePolicies is absent but policyConstraints is present, and
(2) when policy_cache_create() returns <= 0. Free ext_pcons before
each early return.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial Fixes: 4acc3e907d29 "Initial support for certificate policy checking and evaluation." Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jun 26 15:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
Neil Horman [Sat, 9 May 2026 14:26:57 +0000 (10:26 -0400)]
Fix up property test
Because the duplicate test expects the cache get operation to take
a reference count (which we no longer do), we need to not count it down
before checking the resulting ref count
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:17 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 23:16:28 +0000 (19:16 -0400)]
delay method store free in context_deinit_objs
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:47:16 +0000 (10:47 -0400)]
Makle STORE_LOADER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:13 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:46:54 +0000 (10:46 -0400)]
make OSSL_DECODER no do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:11 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:40:33 +0000 (10:40 -0400)]
Make OSSL_ENCODER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:33:49 +0000 (10:33 -0400)]
make EVP_RAND not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:30:16 +0000 (10:30 -0400)]
Make EVP_KEYEXCH not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:05 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:23:00 +0000 (10:23 -0400)]
Make EVP_KEYMGMT not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:04 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:18:52 +0000 (10:18 -0400)]
Make EVP_ASYM_CIPHER not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:02 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:13:59 +0000 (10:13 -0400)]
Make EVP_SIGNATURE not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:26:00 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:10:05 +0000 (10:10 -0400)]
make EVP_KEM not do refcounting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:57 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Fri, 8 May 2026 14:04:37 +0000 (10:04 -0400)]
Make EVP_KDF not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:55 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:29:37 +0000 (17:29 -0400)]
Make EVP_MAC not do refcounting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:53 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:16:40 +0000 (17:16 -0400)]
Make SKEYMGMT not do ref counting
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:51 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:05:11 +0000 (17:05 -0400)]
Make EVP_CIPHERS not need to take reference counts
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:49 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:04:41 +0000 (17:04 -0400)]
Make EVP_MD's not need to take reference counts
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:47 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Neil Horman [Thu, 7 May 2026 21:06:03 +0000 (17:06 -0400)]
Don't take reference counts on cache lookups
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Jun 25 21:25:45 2026
(Merged from https://github.com/openssl/openssl/pull/31143)
Jakub Zelenka [Mon, 22 Jun 2026 21:15:15 +0000 (23:15 +0200)]
apps: cover the kdf -cipher option in the test recipe
The -cipher option was not covered. Add KRB5KDF test cases that
exercise it, both via -cipher and the equivalent -kdfopt cipher: form.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:01:33 2026
(Merged from https://github.com/openssl/openssl/pull/31651)
Jakub Zelenka [Tue, 23 Jun 2026 13:10:33 +0000 (15:10 +0200)]
apps: fix Ed25519 typo in pkeyutl recipe subtest names
Two subtest descriptions read "Ed2559" instead of "Ed25519".
Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:37 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
Jakub Zelenka [Mon, 22 Jun 2026 17:47:23 +0000 (19:47 +0200)]
apps: cover pkeyutl oneshot buffer path with empty file input
The non-mmap buffer fallback in do_raw_keyop() for oneshot (only_nomd)
keys was never exercised on Unix, since any file with non-zero size
takes the mmap path and returns before reaching it. Signing and
verifying an empty file gives filesize 0, which skips the mmap block
(guarded by filesize > 0) and falls through to the buffer switch,
covering both the SIGN and VERIFY arms.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 17:00:36 2026
(Merged from https://github.com/openssl/openssl/pull/31644)
rootvector2 [Sun, 31 May 2026 17:22:26 +0000 (22:52 +0530)]
lms: free previous encoded public key in ossl_lms_pubkey_decode
ossl_lms_pubkey_decode() only freed pkey->encoded when the new public key
had a different length, so re-decoding a same-length key on the documented
repeated-call path overwrote the old buffer without freeing it. Always free
the existing buffer first.
Also clear pkey->encodedlen on the error path so a failed decode leaves the
key in a consistent state instead of keeping a stale length.
CLA: trivial
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:58:46 2026
(Merged from https://github.com/openssl/openssl/pull/31345)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Thu Jun 25 16:44:51 2026
(Merged from https://github.com/openssl/openssl/pull/31700)
dannyward630 [Thu, 18 Jun 2026 17:42:34 +0000 (19:42 +0200)]
Mention removed ERR macros in changelog
Update the existing 4.0.0 changelog entry for the ERR state cleanup to list the removed ERR_FLAG_MARK, ERR_FLAG_CLEAR, and ERR_NUM_ERRORS macros.
Fixes #31056
CLA: trivial
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 25 16:37:57 2026
(Merged from https://github.com/openssl/openssl/pull/31598)
Nikola Pajkovsky [Wed, 20 May 2026 06:20:33 +0000 (08:20 +0200)]
x_all.c: avoid mismatched d2i/i2d function pointer casts
the d2i_*/i2d_* fp and bio wrappers for RSA_PUBKEY, the DSA and EC key
types, and the EVP_PKEY Private/PUBKEY converters passed their
type-specific functions to ASN1_{d2i,i2d}_{fp,bio}, which invoke them
through the generic d2i_of_void / i2d_of_void / void *(*)(void) pointer
types.
Add file-local thunks with the exact generic signatures that forward to
the concrete functions, and pass those instead of cast pointers. This
removes the mismatched calls while keeping the public API unchanged.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:13:01 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Wed, 20 May 2026 06:19:46 +0000 (08:19 +0200)]
avoid d2i_of_void asn1 callbacks in GENERAL_NAME_dup
use IMPLEMENT_ASN1_DUP_FUNCTION(GENERAL_NAME) so duplication goes
through ASN1_item_dup() instead of calling ASN1_dup() with cast
i2d/d2i function pointers. This avoids UBSan function type errors
while preserving the public GENERAL_NAME_dup() API.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:59 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 09:39:41 +0000 (11:39 +0200)]
avoid mismatched d2i callbacks in PEM readers
decode PEM payloads through the generated typed d2i_* functions in the
PEM read macros instead of routing them through the d2i_of_void
callback path. This avoids UBSan function type mismatch reports while
preserving the public PEM reader APIs.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:57 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Thu, 21 May 2026 05:14:07 +0000 (07:14 +0200)]
decode_der2key: wrap key-free callbacks to avoid function pointer casts
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:55 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
Nikola Pajkovsky [Tue, 19 May 2026 08:50:02 +0000 (10:50 +0200)]
fix function pointer type mismatch in PEM_X509_INFO_read_bio_ex
PEM_X509_INFO_read_bio_ex stored d2i_X509, d2i_X509_AUX, d2i_X509_CRL
or d2i_AutoPrivateKey -- each with a distinct, type-specific signature
returning X509*, X509_CRL* or EVP_PKEY* -- in a single d2i_of_void*
variable and dispatched through it:
Replace the function-pointer dispatch with an enum tag
(pem_info_type) and a switch that calls each typed d2i_* directly
with the correctly type.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 25 12:12:53 2026
(Merged from https://github.com/openssl/openssl/pull/31523)
projects / thirdparty / openssl.git / log
