Fix encrypt decrypt fetch for cms from privoder side

For algorithms without NID (without registration via the engine), cms_enc attempts to fetch via OBJ_obj2txt.

passing cipher instead of NULL in EVP_PKEY_CTX_ctrl in apps/cms.c

Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sat Aug  1 03:02:06 2026
(Merged from https://github.com/openssl/openssl/pull/31512)

diff --git a/apps/cms.c b/apps/cms.c
index 5e32ab55aff561828aeaea1689c44c50b6766d3e..b7f339457191d396296ba2a8e04c6d6e44fcf869 100644 (file)
--- a/apps/cms.c
+++ b/apps/cms.c
@@ -1148,7 +1148,7 @@ int cms_main(int argc, char **argv)
 
             res = EVP_PKEY_CTX_ctrl(pctx, -1, -1,
                 EVP_PKEY_CTRL_CIPHER,
-                EVP_CIPHER_get_nid(cipher), NULL);
+                EVP_CIPHER_get_nid(cipher), cipher);
             if (res <= 0 && res != -2)
                 goto end;
 

diff --git a/crypto/cms/cms_enc.c b/crypto/cms/cms_enc.c
index 32133c6847db4fe1a00ff132ff68526863380fec..7daa218485bdff0f1d25b60779b9e7ce0c03e219 100644 (file)
--- a/crypto/cms/cms_enc.c
+++ b/crypto/cms/cms_enc.c
@@ -17,6 +17,7 @@
 #include "crypto/evp.h"
 #include "crypto/asn1.h"
 #include "cms_local.h"
+#include "internal/sizes.h"
 
 /* CMS EncryptedData Utilities */
 
@@ -65,9 +66,13 @@ BIO *ossl_cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec,
     if (cipher != NULL) {
         fetched_ciph = EVP_CIPHER_fetch(libctx, EVP_CIPHER_get0_name(cipher),
             propq);
-        if (fetched_ciph != NULL)
-            cipher = fetched_ciph;
+    } else {
+        char txtoid[OSSL_MAX_NAME_SIZE];
+        if (OBJ_obj2txt(txtoid, sizeof(txtoid), calg->algorithm, 1) > 0)
+            fetched_ciph = EVP_CIPHER_fetch(libctx, txtoid, propq);
     }
+    if (fetched_ciph != NULL)
+        cipher = fetched_ciph;
     if (cipher == NULL) {
         (void)ERR_clear_last_mark();
         ERR_raise(ERR_LIB_CMS, CMS_R_UNKNOWN_CIPHER);
@@ -81,8 +86,14 @@ BIO *ossl_cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec,
     }
 
     if (enc) {
+        (void)ERR_set_mark();
         calg->algorithm = OBJ_nid2obj(EVP_CIPHER_CTX_get_type(ctx));
-        if (calg->algorithm == NULL || calg->algorithm->nid == NID_undef) {
+        (void)ERR_pop_to_mark();
+
+        if (calg->algorithm == NULL || calg->algorithm->nid == NID_undef)
+            calg->algorithm = OBJ_txt2obj(EVP_CIPHER_get0_name(cipher), 0);
+
+        if (calg->algorithm == NULL || OBJ_length(calg->algorithm) == 0) {
             ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM);
             goto err;
         }