git.ipfire.org Git - thirdparty/openssl.git/log

Fix nullpointer dereference in OSSL_PARAM_merge

OSSL_PARAM_merge contained an error, where a nullpointer was
dereferenced when both parameter arrays ended with the same key

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27910)

(cherry picked from commit 63cb8f99a13fdc4c7c3b1e88d66a3ff70b72e642)

Better lookup for openssl executable

Fixes #27891

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27895)

(cherry picked from commit fa0c67a28a5a7d6ebeae7cb14d036780485e2fcd)

Fix exit code for s_time when -new command line switch specified

When operating with the -new switch in apps/openssl s_time, we neglect
to set the exit code properly, and so the app exits with a code of 1
rather than 0 as expected

Fixes #27856

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27857)

(cherry picked from commit b6ff5598539bf91608246ed81b4b534cbea6539d)

Allow our *_gen_cleanup functions to tolerate a NULL ctx

Our *_gen_cleanup functions are essentially "free" functions. Our
free functions tolerate NULL being passed. We are being inconsistent with
our *_gen_cleanup functions. Some of them tolerate NULL and others do not.

We should consistently tolerate NULL.

See also #27795

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27813)

(cherry picked from commit 743bae4a225b9df1d11446e5f0620270b10c835a)

fix: Better documentation on DTLS_set_timer_cb()

Also more precise description of DTLS timeout mechanism.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27800)

(cherry picked from commit 49885aebe7cafc5caaa6929d0ed5a946e7f09c45)

return NULL if gctx allocation fails.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27795)

(cherry picked from commit 443298e0f0e2c8225f8c6d6fdc01c6c4d434028b)

check gctx for NULL before cleanup.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27795)

(cherry picked from commit 02f9c9342d54c99981b0a83088982bf0d1083d7f)

ossl_assert() is in cryptlib.h

In 3.0 the ossl_assert() is in internal/cryptlib.h not internal/common.h

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27799)

Avoid shell commandline processing in CA.pl

The CA.pl script used to build single-string string commandlines to pass
to a shell via `system(command_string)`.  That was fragile and not a best
practice.

This PR replaces `system(command_string)` with `system { executable } @argv`,
which avoids the shell whenever possible (at least Unix-like systems and
Windows).  The only question mark is whether some sort of quoting is
needed for VMS to preserve the case of commandline arguments even when
processes are spawned directly, rather than via the shell.

Unfortunately, given the way that some environment variables and
command-line options are used to construct the commands to run,
the result is still brittle.  The CA.pl utility really should
be replaced with something better.

CA.pl supports interpolating multiple arguments into the executed
commands.  Previously these were evaluated by a shell, which supported
quoting of values that contain whitespace, backslashes, ...

With a shell no longer used (avoid command injection), backwards
compatibility requires some similar functionality.  The code now handles
double and single-quoted strings (shell-style word splitting), but not
parameter expansion ($foo remains unexpanded) or command substitution
(`cmd` and $(cmd) remain unexpanded).

On Windows system(@LIST) does not correctly preserve argv, do our
own quoting instead and use system(<$quoted_cmd>).

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27782)

Silence -Wstringop-overflow warnings with gcc 14 on s390x

Compiling OpenSSL on s390x with gcc 14 (i.e. in Fedora 41) shows several
-Wstringop-overflow warnings in providers/implementations/rands/drbg_ctr.c
and test/params_api_test.c.

Add explicit length checks to let the compiler know that it won't overrun
the buffer. This also silences the warnings.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27710)

(cherry picked from commit 9a788281d91f698d6a229d588b9cb36987549669)

Allow keygen after dup of minimal PKEY ctx

It should be possible to repeatedly duplicate a PKEY CTX created via
EVP_PKEY_CTX_new_from_name() that has not yet been assigned an
"operation" (e.g. via EVP_PKEY_CTX_keygen_init()), and then perform
keygen_init() and keygen() on the duplicated copies.

When the operation is not yet set, all that's needed is to not try to
use the key if one isn't set yet.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27662)

(cherry picked from commit 2c74a8d1ef4e9c4b4468afefedb1f72425772a37)

Fix SHAKE AlgorithmIdentifier encodings

NIST CSOR specifies that the id-shake128 and id-shake256
algorithm identifiers, like the SHA-3 ones, do not carry
any parameters.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27190)

(cherry picked from commit bef03c6a24f02df4e670697b16b6d7c8b1b604b4)

ci: remove windows-2019 runner images

According to https://github.com/actions/runner-images/issues/12045
The Windows 2019 Actions runner image will begin deprecation on
2025-06-01 and will be fully unsupported by 2025-06-30. Jobs using
the windows-2019 YAML workflow label should be updated to
windows-2022, windows-2025 or windows-latest.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27759)

rand: document the EVP_RAND_nonce() return correctly

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27767)

rand: produce correct return from EVP_RAND_nonce

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27767)

rand: fix memory overrun bug

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27767)

rand: add unit test exhibiting memory overrun

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27767)

Remove _strlen31

This function is old and fairly broken. Code archeology in our git tree
hasn't revealed why it was creted (though it may have possibly been to
support older win32 systems that couldn't do 64 bit integers properly,
like windows 95/98).

There seems to be no good reason to keep it around, and given that it
has potentially serious side effects, lets just remove it.

Fixes #27761

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27763)

(cherry picked from commit b0d363a2cb039eac2908b7cb00b395235373193e)

dtls1_read_bytes(): Fix backported patch for no renegotiation

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27762)

Update documentation regarding no_renegotiation handling

Clarify what happens in the event that a no_renegotiation alert is
received.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27591)

(cherry picked from commit 0db6a59ea7931024d673024c2d17ff1ec44a4e69)

Test that a no_renegotiation alert is handled correctly

If we receive a no_renegotiation alert we should abort the connection. We
add a test for this.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27591)

(cherry picked from commit 7f6e66b048cb50dd5381211ef2006ae5e912a914)

Fix DTLS handling when receiving a no_renegotiation alert

no_renegotiation is a warning alert sent from the server when it is not
prepared to accept a renegotiation attempt. In TLS we abort the connection
when we receive one of these - which is a reasonable response. However,
in DTLS we incorrectly ignore this and keep trying to renegotiate.

We bring the DTLS handling of a no_renegotiation alert into line with
how TLS handles this. In versions prior to 3.2 handling of a warning
alert in DTLS was mishandled resulting in a failure of the connection,
which ends up being the right thing to do "by accident" in the case of
"no_renegotiation". From 3.2 this mishandling was fixed, but exposed this
latent bug.

Fixes #27419

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27591)

(cherry picked from commit e5feca0659ef6119f6cedfab1b6af034735723ff)

OSSL_HTTP_get(): Reset redirection_url in each iteration

Also remove some dead assignments.
Fixes #27629

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27637)

Handle 0 return values from DH key computations as errors

Returned 0 from ossl_dh_compute_key(), DH_compute_key_padded() and
DH_compute_key() needs to be treated as an error.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27673)

(cherry picked from commit 1c1ce2a6eeb18b3102e0618a988b2dfe96b709aa)

Use value barrier for constant_time_cond_swap_*

Resolves #27497

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27581)

(cherry picked from commit 8a9e0d0f499a288cf3363668870806d5e7be3924)

Document that FIPS provider cannot be used by multiple libcryptos

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27702)

(cherry picked from commit 08b2042a20e76472416c8c7c48e479d893ba904f)

test/evp_test.c: Free fetched_digest on error to avoid memory leak

Call EVP_MD_free() to release fetched_digest if OPENSSL_zalloc() fails, preventing a memory leak.

Fixes: 2208ba56eb ("evp_test: Add the missing check after calling OPENSSL_malloc")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27648)

(cherry picked from commit e8deb32af4874c781838c1596c6355712b5d0ed0)

crypto/property/property.c: Free impl->method to avoid memory leak

After ossl_method_up_ref() succeeds, impl_free() should be called to free impl->method.

Fixes: 860ecfd ("property: check return values from the property locking
calls.")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27564)

(cherry picked from commit 00c531a5e327320f0ec78ce4b153fac65ebca229)

Note finished state in cipher BIO EOF

When the cipher BIO encounters a non-retriable EOF (or error), mark the
state as "finished", else a subsequent BIO_flush() or attempted read may
attempt to finalise the crypto state again, and fail, leading, for
example, to users seeing erroneous apparent decryption failure.

This is not a new problem, the fix should be backported to all supported
releases. It was made more apparent by recent changes to the base64
BIO, which returns a non-retriable EOF when padding is seen at the end
of the base64 data, even if the underlying next BIO is "retriable".

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27680)

(cherry picked from commit 005fa3e00e1ccfd83aa99d28e2eff55597dd5fc2)

Document EVP_CIPHER failure for missing provider function

When writing a new CIPHER implementation the OSSL_FUNC_cipher_get_params
must be present, otherwise the fetch fails. This behaviour is seen in
function evp_cipher_cache_constants@crypto/evp/evp_lib.c.

Resolves: #25801

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27696)

(cherry picked from commit 3423c30db3aa044f46e1f0270e2ecd899415bf5f)

crypto/pkcs7/pk7_smime.c: Add BIO_free() to avoid memory leak

Add BIO_free() to free tmpout if OPENSSL_malloc() fails to avoid memory leak.

Fixes: 8e70485 ("RT3955: Reduce some stack usage")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27631)

(cherry picked from commit 9882d389df71ef7163c7769b4431a0dbe713ab65)

apps/pkeyutl.c: Add OPENSSL_free() to avoid a memory leak

If EVP_PKEY_CTX_ctrl_str() fails, the code jumps to 'end' label without freeing passwd, causing a memory leak.

Fixes: 9d1bf5f7de ("Add option to read pkeyopts interactively")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27470)

(cherry picked from commit 0dc6ea55a13dbe27af234b5328527d0a31ae68eb)

Fix memory leaks after failure of PKCS7_add_signed_attribute()

If PKCS7_add_signed_attribute fails,
seq never escapes out of the callee and will
therefore result in a memory leak.
This is similar to ed3d277127.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27670)

(cherry picked from commit 6543f34dda8908db56372581eef6eafa0ae4add4)

Updated Windows notes on the use of “no-makedepend” for new builds

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27361)

(cherry picked from commit afd32bcb5456a9e33b0f4e07f572263b404d4d4b)

Drop "by store"'s by_store_subject_ex()

It was used to pass libctx and propq, which would override the
corresponding values passed to by_store_ctrl_ex(). This wasn't
really reasonable to do either way, as it could potentially be a
surprise to the user, who can reasonably expect that the URI is
opened with the libctx and propq that was passed with the URI, and
not with those passed later.

(cherry picked from commit af5952d533b772ef8a3d7c666ed918acfc1dd911)

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27551)

(cherry picked from commit 8bc0f6757d656fff67f2923cea802945a40a38e2)

Add test_verify tests

Originally from https://github.com/openssl/openssl/pull/27507, with some
changes.

Co-authored-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 927debaf7b4e83e47d3f016808acab947cc50ea2)

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27551)

(cherry picked from commit 6143e70e8edde7f79fb5fb70b3c4cc548950f341)

Rework the "by store" X509_LOOKUP method to open the given URI early

The cached X509_LOOKUP method data is no longer just the URI, but now
includes the OSSL_STORE_CTX pointer, and required parameters to reopen
the URI at any time. cache_objects() is modified to handle this, and
only (re)open the URI when it wasn't previously opened, or when it was
closed by an earlier call.

This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and
get to see possible errors when the URI is loaded.

This assumes that if the URI could be opened once, it can be opened
again.

Fixes #27461

(cherry picked from commit 0c48ee2bf513cbc2f1de2ff8bc11750e4b593620)

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27551)

(cherry picked from commit 08220efd4aeee63094cd366099572b9e20076581)

The condition that is never checked has been removed.

If criterion == OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT, the criterion !=0 condition will be triggered.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27607)

(cherry picked from commit 00480f1def86aab882f2bd4d15d2d03862009718)

demos/bio/sconnect.c: Free ssl_bio on error to avoid memory leak

Call BIO_free() to release ssl_bio if an error occurs before BIO_push(), preventing a memory leak.

Fixes: 396e720965 ("Fix certificate validation for IPv6 literals in sconnect demo")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27639)

(cherry picked from commit 55d8d859797e8229bc499bbc7c3c76821b654682)

crypto/x509/v3_lib.c: Free tmpext if X509V3_EXT_add() fails to avoid memory leak

Add OPENSSL_free to free tmpext if X509V3_EXT_add() fails to avoid memory leak.

Fixes: 878dc8dd95 ("Join the x509 and x509v3 directories")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27566)

(cherry picked from commit 5f661e4e96bc3bfa52b4e0735f407cb41f162869)

s3_lib.c: Use illegal_parameter for failing encapsulation in ml_kem

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27627)

(cherry picked from commit e66097fc6687750ac792986a71375b23793766c2)

s3_lib.c: Handle weak x keys as illegal_parameter alert

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27597)

(cherry picked from commit 5da4ea10be8cf8ca66dff95c9997966f21c82029)

test/testutil/testutil_init.c: Add OPENSSL_free() to avoid memory leak

Free trace_data if error occurs to avoid memory leak.

Fixes: d73458d17a ("Add tracing capability in test utilities")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27600)

(cherry picked from commit 3818f7779ef4bf4d4ccacd13506ec92885e45553)

Stop a TLSv1.3 server emitting an unsolicited PSK extension

If we attempt to accept a connection on an SSL object, and the
application has set an SSL_SESSION on that SSL object then we
can mistakenly believe that we are resuming and
emit an unsolicited PSK extension back to the client.

This can especially happen when using SSL_clear() which leaves
any SSL_SESSION associated with the SSL object.

See
https://github.com/openssl/openssl/discussions/27563#discussioncomment-13049352
and
https://github.com/openssl/openssl/discussions/24567

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27584)

(cherry picked from commit aa8bca2e81030560d690cb68bbcbe8b7d00d1d29)

APPS/cmp.c: fix char encoding of subject, issuer, sender, and recipient DN

Fixes #27572

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27592)

(cherry picked from commit 35e431ed6daa894ee5385363cf4cfe4954312e4d)

chacha_poly: fix settable ctx param list

The settable list used the generic AEAD cipher list which included
an extra parameter and omitted the IV length one. The set ctx param call
was custom so the errant list didn't directly impact operation.

The comment about ignoring OSSL_CIPHER_PARAM_AEAD_MAC_KEY is completely bogus.
That parameter isn't accepted either here or by the shared AEAD cipher params.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27534)

(cherry picked from commit 1c63382294750c9111e23931dcd5637d60d1b6c4)

crypto/provider_conf.c: Fix possible memory leak

Assign the return value of ossl_provider_info_add_to_store to added instead of
setting it directly to 1, in order to avoid a memory leak caused by entry not
being freed if ossl_provider_info_add_to_store() fails.

Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27472)

(cherry picked from commit 9884f1dc11675a5c4613339cfb92903c6ba6103f)

Fix use after free bugs for public_keys and private_keys in evp_test

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27421)

(cherry picked from commit 81e8b5a5038b4952a22b2dc9fcf9994615ee8dc4)

Test+fix handling "wrong" downgrade signals

This accounts for cases that can only occur when een non-compliant server sends
the wrong downgrade signal. (TLS1.1 signal when negotiating TLS1.2 or TLS1.2
signal when negotiating TLS1.0/TLS1.1). According to the TLS1.3 RFC these
cases should be rejected:

RFC8446, section 4.1.3: TLS 1.3 clients receiving a ServerHello indicating
TLS 1.2 or below MUST check that the last 8 bytes are not equal to either of
these values. TLS 1.2 clients SHOULD also check that the last 8 bytes are
not equal to the second value if the ServerHello indicates TLS 1.1 or below.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27535)

Repair downgrade tests

A number of these tests were failing for the wrong reasons. The intention is to verify
that the client sends an illegal parameter alert when an unexpected downgrade signal
is received. Instead, a number of tests failed because TLS1.1 was not available. The
tests are adapted to explicitly check for an illegal parameter alert from the client.

Client and server flags are updated to enable TLS1.1 where required and a few tests
requiring TLS1.1 were moved to be disabled when TLS1.1 is not available.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27535)

Disable unterminated-string-initialization in strict-warnings

Recently updated to fedora 42, which includes an updated gcc, which
triggers a new warning:

test/afalgtest.c:44:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (18 chars into 17 available) [-Werror=unterminated-string-initialization]
   44 |         "\x53\x69\x6e\x67\x6c\x65\x20\x62\x6c\x6f\x63\x6b\x20\x6d\x73\x67"

The warning occurs because in some locations we create char buffers of
length X, and fill it with X bytes of data, truncating the NULL
terminator.

We could fix it by adding the nonstring attribute, but given that:
1) Adding attributes might impact other platforms that don't understand the
   attribute.

2) We often create char buffers that don't expect a NULL terminator.

3) Converting the unsigned char arrays to uint8_t, or other types that
   could be interpreted as non-strings has no impact, only applying the
   nonstring attribute silences the warning.

It seems more sensible to just disable the warning entirely

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27490)

(cherry picked from commit d08d77789e20e8b47a48f4d0a998ccfcde9d389b)

Clarify how s_client -ign_eof and -quiet impact command processing

If -ign_eof -or -quiet are passed to s_client this implicitly turns off
command processing (i.e. equivalent to -nocommands). This was stated on
the man page in the "CONNECTED COMMANDS" section, but not in the
documentation for "-ign_eof" or "-quiet" directly. We state it here as
well to make it clearer.

Fixes #27443

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27500)

(cherry picked from commit 20fb5dcb1e2b762545aa127058cc11efe09d6700)

BIO_dump_indent_cb(): Check for negative return from BIO_snprintf()

In practice this cannot happen but Coverity complains.

Fixes Coverity 1646683

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27493)

(cherry picked from commit 56c739816f3dacbb024ceae29c546abe677ee02c)

Fix also BIO_printf formatting for INF and NAN

Avoid infinite loooooooops in %e and %g formatting for +/-INF and
make the invalid value at least visible by using '?' as signvalue.

Fixes #26973

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27491)

(cherry picked from commit b56dd5bfec8e790cc2d5b1bdca6ecd350a3b7779)

Fix BIO_printf formatting for negative numbers formatted with %e

Some parts of the formatting code assumed that the input number is
positive. This is fixed by working on its absolute value.

test/bioprinttest.c is amended to test the output of negative numbers
as well.

Fixes #26973

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27478)

(cherry picked from commit fb555eb7a1d523e9df5584b44d16d0f72417bd19)

docs: update OSSL_PARAM_int documentation

This change adds an example to allow compilation without warnings using
compiler options like `-Wincompatible-pointer-types-discards-qualifiers`

Code for the example was inspired by libarchive's https://github.com/libarchive/libarchive/pull/1869/commits/9e3a7e4b6c77e8aa19a69430f48917dbc15b319d

Fixes #20956

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27157)

(cherry picked from commit b83b67fe59511de951db1987fb2ab9e028e2da32)

Replace ilammy/setup-nasm with nasm install from choco

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27462)

(cherry picked from commit 1ad186986c8c90dfc58666531c0554641e022dbb)

Document SSL_CTX_set_min_proto_version defaults

If the function is not called the settings default to 0.

Fixes #10584

Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27410)

(cherry picked from commit 871182d29dc24bbb51ff7a4d952ff9d9868f14b5)

provider-signature.pod: fix typos (digeset -> digest)

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27372)

(cherry picked from commit 7d14d1c46a6144c5f8eafc8d07b750324e1275be)

provider-signature.pod: fix doc of OSSL_SIGNATURE_PARAM_ALGORITHM_ID, describing its relevance

This provides a fix for the documentation part of #22932.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27372)

(cherry picked from commit 23e3b3c0c5d8f29d95f518a1f0e40f3e1c63ead9)

test: test for setting hkdf salt to null

Fixes #27302

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27305)

(cherry picked from commit 727117960c0a47073290de936fb517db12351174)

hkdf: allow salt to be set to null

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27305)

(cherry picked from commit 12eb6c58ff2a8d857924b3020d30c8d485ace0a7)

Fix OSSL_FUNC_keymgmt_load declaration in man7/provider-keymgmt

OSSL_FUNC_keymgmt_load prototype declared in man7 does not match
the actual OSSL_FUNC_keymgmt_load prototype declared in
include/openssl/core_dispatch.h. This commit fixes the prototype
in man7.

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27189)

(cherry picked from commit ada231523f6569c92795e16c9a61b7190f2032b1)

Fix EVP_PKEY_CTX_dup() so that it copies the keymanager.

A call to EVP_PKEY_CTX_new() creates a keymgmt pointer internally,
but EVP_PKEY_CTX_dup() does not copy this field.

Calling EVP_PKEY_derive_set_peer_ex() after EVP_PKEY_CTX_dup() resulted
in a segfault because it tried to access this pointer.

EVP_PKEY_CTX_dup() has been updated to copy the keymanager (and upref it).

Reported by Eamon ODea (Oracle).

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27304)

(cherry picked from commit 3c22da73465f5dd211299e64f0de8786dcaf86c3)

Fix PKCS7_sign and CMS_sign default hash documentation

Fixes #27291. See issue for details.

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27292)

(cherry picked from commit 4f81470afadea3d1582d1df7f1b2b5e3ece63331)

Updated the change log to include SSLv3 being disabled by default.

This change was implemented into version 1.1.0 and onward. The last version that had SSLv3 enabled was version 1.0.2h, which is why the addition was made where it is.

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27289)

(cherry picked from commit 6509f18c9fdbf76a63e8c6056da989cd047a7fb2)

Remove DAYS argument

This commit removes DAYS from certificate requests to avoid the warning

'Ignoring -days without -x509; not generating a certificate'

This argument is not needed with the -new argument. Additionally makes sure
$1 is handled when -nodes is not given. Preventing an uninitialized value
error when the DAYS argument is removed.

Fixes #26595

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27277)

(cherry picked from commit d890ad2b96efea4f5f4b0db190017ce9a3897df7)

crypto/ui/ui_lib.c: Add OPENSSL_free to avoid memory leaks

Add OPENSSL_free() if general_allocate_boolean() or general_allocate_string fails to avoid memory leaks.

Fixes: a63d5eaab2 ("Add a general user interface API. This is designed to replace things like des_read_password and friends (backward compatibility functions using this new API are provided). The purpose is to remove prompting functions from the DES code section as well as provide for prompting through dialog boxes in a window system and the like.")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27218)

(cherry picked from commit 8f06efe234ca875eb09af7f35f1ad3d62be696aa)

Fix a visual glitch in test_cmp_http.t

Kill the shell process after the Mock server is running,
to prevent the shell from printing an error message when
the Mock server is finally killed.

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27158)

Temporarily disable gost-engine tests in ci

We need to temporarily disable this as we have a build break in CI:
https://github.com/openssl/openssl/actions/runs/14192630435

Its occuring because gost-engine depends on libprov, which requires a
minimum version cmake-3.0. The update of github runners to cmake-4.0
causes a bail out as cmake 4.0 no longers supports cmake 3.0 syntax.

Libprov is fixed now, but gost-engine needs to update its libprov
submodule, and then we need to update the gost-engine submodule. Until
thats done (which may take days), we should disable the gost-engine
external tests

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27234)

(cherry picked from commit db9771b5a056d939b6112cdc099fbf4f86d184ee)

statem: always save sigalgs during PHA

We use the same extension-parsing function on server and client
for convenience, but while the server might worry about tracking
what was previously received and not overwriting it, on the client
receiving a request for post-handshake authentication, we always
want to use the values from the current extension (and should
always have a new session object that we are free to mutate).

It is somewhat unclear whether the server also needs the check
for a resumed connection; it appears to have been added back in
2015 in commit 062178678f5374b09f00d70796f6e692e8775aca as part
of a broad pass to handle extensions on resumption, but without
specific documentation of each extension's handling.

Fixes: #10370
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24651)

(cherry picked from commit ddd99d52d30e2fdae08f9684947cba45ce53898b)

Fix Strict c issue in aes_gcm for armv8

Reported by David Makepeace

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27203)

(cherry picked from commit 0a78595eac55cc9ec9d2046c704404ec52752b8c)

apps/lib/apps.c: Add a check for OPENSSL_strdup()

Add a check for the return value of OPENSSL_strdup() to guarantee the success of allocation, similar to the other call sites.

Fixes: c7d5ea2670 ("Prepare to detect index changes in OCSP responder.")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27172)

(cherry picked from commit 930c645e6b74a09398f6345b2d265c38ff035afe)

Update X509_VERIFY_PARAM_set_flags.pod

Change description of B<X509_V_FLAG_CRL_CHECK_ALL> to reflect its inability
to function without B<X509_V_FLAG_CRL_CHECK> being enabled as well.

Fixes #27056 (https://github.com/openssl/openssl/issues/27056)

CLA: trivial

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27098)

(cherry picked from commit b7d3c729b14ccd9d23437d8ae107020a4332af72)

bn_mul_words.pod: Fix failures in doc-nits check

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26597)

(cherry picked from commit 1b61f8e1808d3b3ee2d8f8e42bdc8fcc2b538373)

Moved crypto/bn/README.pod to internal manpages

The new place is doc/internal/man3/bn_mul_words.pod.

Also removed outdated information.

Implementing the fix from https://github.com/quictls/quictls/pull/214

Fixes #26399

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26597)

(cherry picked from commit 78b1fdf4a101ae4909038e90b2c3c961be5a7064)

Fix return value of the i2d_ASN1_bio_stream() call

If the flags argument does not contain the SMIME_STREAM bit,
the i2d_ASN1_bio_stream() function always returns 1,
ignoring the result of the ASN1_item_i2d_bio() call.

Fix the return value to the result of the ASN1_item_i2d_bio()
call for this case.

CLA: trivial

Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27106)

(cherry picked from commit 3edb1f09c62c058edf4039587ef35f6b074e0870)

Update provider compatibility CI to run on 3.5 branch

Also drop 3.1 development branch as it is out of public support now.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27149)

(cherry picked from commit 725f55e235057c463feadabbb4d23450126117fd)

In doc/man7/provider-{en,de}coder.pod, clarify where properties are defined

Fixes #27126

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27132)

(cherry picked from commit a006b0a0894b9aa399eee91bd28ca06b281eef7e)

Change documentation to point to new wiki location

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27081)

(cherry picked from commit da8de0e8dd3e09655cd17ef700359c63acdc9cd4)

Fix NULL pointer dereference in `asn1_ex_i2c()`, crypto/asn1/tasn_enc.c

Adds handling of V_ASN1_UNDEF to avoid NULL dereference
in case ASN1 structure contains an element of type ASN1_TYPE
without initializing its value (i.e. default constructed)

CLA: trivial

Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27100)

(cherry picked from commit 8e08f9c5a013d9a9fb9e2db3c90a70eda50f78b5)

Avoid erroneous legacy code path when provided

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27075)

(cherry picked from commit 27b88364e41f01cc1be6ff2941dd07919f286c89)

apps/cms.c, apps/ocsp.c: Added NULL pointer checks

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27059)

(cherry picked from commit 952d9b83b20359e9ed0fff8f18a84add29949f6f)

Fix gettable_params() for ECX

The OSSL_PKEY_PARAM_MANDATORY_DIGEST parameter is only handled by the
ed25519_get_params() and ed448_get_params(). The x25519 and x448
versions of get_params() always ignore that parameter, so it should not
be in the list of gettable params.

Fixes: 1a7328c88256 ("PROV: Ensure that ED25519 & ED448 keys have a mandatory digest")
cla: trivial

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27043)

(cherry picked from commit 482d3f9338b3d4c7537a1d112dce9c8e370c8d9f)

Keep the provided peer EVP_PKEY in the EVP_PKEY_CTX too

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26976)

(cherry picked from commit 2656922febfc36f6b44cff1c363917685633b4c5)

Updated SSL_SESSION_get0_hostname() documentation to be consistent with the function

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26559)

(cherry picked from commit 8d6fd6142b0b55ce029df6d7b63dda5f7cb8ce54)

compiler-zoo.yml: Switch to ubuntu-22.04 where possible

And drop the rest.

The ubuntu-20.04 CI runners are discontinued.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26971)

(cherry picked from commit 4e9b542868890428f0294a4ce53fcde68c1fcaf7)

Update doc README URLs

This updates the openssl documentation link to the one currently in use,
and removes the standards.txt section as that URL leads to the normal
documentation page and there is no "standards" page in the openssl
documentation site.

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26759)

(cherry picked from commit da44eb2901bd541f86547d814f45ab305b918611)

Fix hashsum files in release assets

We use the coreutils format since 3.4.0.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26907)

(cherry picked from commit 808a0861716e6dd5e1c9f08cebec93084f028fd8)

Fix libctx passing for CMS PWRI use

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26937)

(cherry picked from commit 5045712d3dbe6abdfffcb4f518c67409ec85535e)

Encoder : Fix floating pointer when OSSL_ENCODER_to_data() is called
twice.

Fixes #26862

This only happens when using the FIPS provider, since it needs to export
the key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26891)

(cherry picked from commit c2f4d7aae1c7c726eb1f8226d3d454dfd9754758)

Tolerate 3.5+ FIPS providers in kem_rsa_params test

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26909)

add_uris_recursive(): Avoid OSSL_STORE_INFO leak on error

Fixes #26480

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26511)

(cherry picked from commit be5965acad7a1c45e49411bcf4abad99d106a7c1)

Fix potential leak in error path in cert_response()

get1_cert_status() returns an object that must be freed,
but the error path does not do that.
Fix it by adding a call to X509_free() in the error path.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26513)

(cherry picked from commit 56160f173d055486357b7a315ab4e9579b2538d5)