Add its mentions to NAME, SYNOPSIS, and RETURN VALUES sections.
Also, while at it, put OPENSSL_{str,strn,mem}dup() with the other
OPENSSL_* interfaces, and add mentions of OPENSSL_str{,n}dup()
to RETURN VALUES.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:23:55 2026
(Merged from https://github.com/openssl/openssl/pull/30623)
Sunwoo Lee [Fri, 27 Mar 2026 23:58:41 +0000 (08:58 +0900)]
quic: remove unused scid from port_default_packet_handler
Remove the scid variable entirely from port_default_packet_handler()
and all functions that accept it as a parameter. The scid was never
used meaningfully — cur_remote_dcid is set later during the handshake.
Jun Aruga [Fri, 27 Mar 2026 18:16:55 +0000 (18:16 +0000)]
crypto/pkcs12/p12_add.c: Restore ERR_set_mark and ERR_pop_to_mark
The commit <2ea6e785f526f88f913cc6f49372aae9dc54bc63> removed the
ERR_set_mark and ERR_pop_to_mark calls before and after the EVP_CIPHER_fetch
call in several files.
However, in PKCS12_pack_p7encdata_ex, crypto/pkcs12/p12_add.c, there is a valid
case that EVP_CIPHER_fetch returns NULL, raising an error, and calls
PKCS5_pbe_set_ex. The case is such as PBE-SHA1-3DES.
quic_channel.c: avoid clipping in ack_delay_exponent/disable_active_migration setters
Avoid clipping of the provided values in setters due to type casting
by checking the values agains the type-specific maximum beforehand.
Fixes: 35dc6c353bfe "QUIC: Make more transport parameters configurable" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:05:27 2026
(Merged from https://github.com/openssl/openssl/pull/30485)
quic_channel.c: avoid integer overflow in ossl_quic_channel_set_max_data_request
Check that DEFAULT_CONN_RXFC_MAX_WND_MUL * max_data multiplication
will not overflow uint64_t data type before performing it.
Fixes: 35dc6c353bfe "QUIC: Make more transport parameters configurable" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:05:26 2026
(Merged from https://github.com/openssl/openssl/pull/30485)
...and call them before updating QUIC_CHANNEL parameters.
Unchecked return value has been initially reported by Coverity
for ossl_quic_rxfc_init() call in ossl_quic_channel_set_max_data_request(),
but also seems to be relevant for ossl_quic_channel_set_max_streams_request()
and ossl_quic_channel_set_ack_delay_exponent_request().
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1689768 Fixes: 35dc6c353bfe "QUIC: Make more transport parameters configurable" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:05:25 2026
(Merged from https://github.com/openssl/openssl/pull/30485)
slontis [Tue, 10 Mar 2026 03:17:55 +0000 (14:17 +1100)]
Deprecate EVP_CIPHER_CTX_get_num() and EVP_CIPHER_CTX_set_num().
Suggested to be added in OpenSSL 4.1.
Since engines have been removed, these are redundant functions.
End users should not generally be accessing this internal field.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:02:58 2026
(Merged from https://github.com/openssl/openssl/pull/30335)
Original-Commit: 7b371d80d959 "Prepare for release of 3.6.0"
Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:00:08 2026
(Merged from https://github.com/openssl/openssl/pull/30686)
CHANGES.md: move SSL_CTX_is_server() entry to the 4.0 section
Also reword it to match the style of other entries.
Complements: ca20e54e8674 "SSL_CTX_is_server() was added." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 10:00:05 2026
(Merged from https://github.com/openssl/openssl/pull/30686)
Arne Schwabe [Wed, 25 Mar 2026 15:28:46 +0000 (16:28 +0100)]
Make ext argument of X509V3_EXT_print_fp const
Commit e75bd84ffc7 made the ext argument of 509V3_EXT_print const
but did not give 509V3_EXT_print_fp which is essentially is a wrapper
around X509V3_EXT_print the same treatment.
This commit aligns the two functions again.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 8 09:15:11 2026
(Merged from https://github.com/openssl/openssl/pull/30572)
Tomas Mraz [Mon, 6 Apr 2026 20:09:20 +0000 (22:09 +0200)]
80-test_cms.t: Accept success in malformed RSA decryption
The decryption of the malformed encrypted message might succeed
with some probability. We accept that as the testcase tries to
trigger a crash which does not happen.
Nikola Pajkovsky [Thu, 19 Mar 2026 11:17:45 +0000 (12:17 +0100)]
rsa_kem: test RSA_public_encrypt() result in RSASVE
RSA_public_encrypt() returns the number of bytes written on success and
-1 on failure.
Add regression coverage in evp_extra_test using custom low-level RSA
methods to exercise the provider/legacy boundary. The new tests verify
that encapsulation fails when RSA_public_encrypt() returns:
* -1, which is the documented failure result, and
* a short positive length, which is also invalid for RSASVE with
RSA_NO_PADDING because the ciphertext must be exactly nlen bytes.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr 6 19:45:39 2026
Nikola Pajkovsky [Thu, 19 Mar 2026 11:16:08 +0000 (12:16 +0100)]
rsa_kem: validate RSA_public_encrypt() result in RSASVE
RSA_public_encrypt() returns the number of bytes written on success and
-1 on failure. With the existing `if (ret)` check, a provider-side RSA KEM
encapsulation can incorrectly succeed when the underlying RSA public
encrypt operation fails. In that case the code reports success, returns
lengths as if encapsulation completed normally, and leaves the freshly
generated secret available instead of discarding it.
Tighten the success condition so RSASVE only succeeds when
RSA_public_encrypt() returns a positive value equal to the modulus-sized
output expected for RSA_NO_PADDING. Any other return value is treated as
failure, and the generated secret is cleansed before returning.
Fixes CVE-2026-31790 Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr 6 19:45:38 2026
Daniel Kubec [Wed, 18 Mar 2026 10:27:52 +0000 (11:27 +0100)]
Out-of-bounds read in AES-CFB-128 on X86-64 with AVX-512 support
The partial-block pre-processing code in ossl_aes_cfb128_vaes_enc and
ossl_aes_cfb128_vaes_dec unconditionally loads 16 bytes from the input buffer
using unmasked vmovdqu8 instructions, even when fewer bytes are valid.
This can read 1–15 bytes beyond the provided buffer. The post-processing code
in the same file correctly uses masked loads to avoid this issue.
Fixes CVE-2026-28386
Co-Authored-by: Stanislav Fort <stanislav.fort@aisle.com> Co-Authored-by: Pavel Kohout <pavel.kohout@aisle.com> Co-Authored-by: Alex Gaynor <gaynor@anthropic.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr 6 19:16:26 2026
Neil Horman [Wed, 1 Apr 2026 08:56:44 +0000 (10:56 +0200)]
Fix NULL deref in rsa_cms_decrypt
Very simmilar to CVE-2026-28389, ensure that if we are missing
parameters in RSA-OAEP SourceFunc in CMS KeyTransportRecipientInfo,
we don't segfault when decrypting.
Co-authored-by: Tomas Mraz <tomas@openssl.foundation>
Fixes CVE-2026-28390
Neil Horman [Tue, 31 Mar 2026 18:38:03 +0000 (14:38 -0400)]
Test for DH/ECDH CMS KARI processing NULL pointer dereference
Test to ensure that, if we attempt to decrypt a CMS message with a
missing parameter field of KeyEncryptionAlgorithmIdentifier
we fail, rather than segfault.
Co-authored-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Apr 6 18:58:29 2026
Neil Horman [Mon, 16 Mar 2026 17:49:07 +0000 (13:49 -0400)]
Fix NULL deref in [ec]dh_cms_set_shared_info
Multiple independent reports indicated a SIGSEGV was possible in CMS
processing when a crafted CMS EnvelopedData message using A Key
Agreement Recipient Info field. If the
KeyEncryptionAlgorithmIdentifier omits the optional parameter field, the
referenced functions above will attempt to dereference the
alg->parameter data prior to checking if the parameter field is NULL.
Confirmed to resolve the issues using the reproducers provided in the
security reports.
Co-authored-by: Tomas Mraz <tomas@openssl.foundation>
Fixes CVE-2026-28389
kovan [Mon, 2 Feb 2026 14:47:35 +0000 (15:47 +0100)]
doc: document PKCS12 password prompting for certificates
Document that commands reading certificates from PKCS#12 files may
prompt for a password. The existing documentation only mentioned
password prompting for private keys.
Fixes #21292
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:52:28 2026
(Merged from https://github.com/openssl/openssl/pull/29918)
Matt Caswell [Thu, 2 Apr 2026 08:01:00 +0000 (09:01 +0100)]
Fix a CHANGES.md entry added to the wrong section
This fixes the CHANGES.md entry added via #30225 which erroneously added
the entry in the "Changes between 3.6 and 4.0" section instead of the
"Changes between 4.0 and 4.1" section
quic: fix NULL deref in ossl_quic_new_from_listener()
ossl_quic_port_create_outgoing() can return NULL under memory pressure.
The result was used immediately by ossl_quic_channel_set_msg_callback()
without a NULL check, causing a crash on the SSL_new_from_listener()
API path.
The correct pattern already exists in create_channel() (same file): check
the return value and raise a non-normal error before jumping to cleanup.
Apply the same pattern here.
Fixes: 0b15147a37c ("Implement SSL_new_from_listener()") Signed-off-by: Abhinav Agarwal <abhinavagarwal1996@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:46:54 2026
(Merged from https://github.com/openssl/openssl/pull/30667)
Apparently, it has not been caught after a29d157fdb6d "Replace homebrewed
implementation of *printf*() functions with libc" due to non-working symbol
checks.
Fixes: a29d157fdb6d "Replace homebrewed implementation of *printf*() functions with libc" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:24 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
Update Windows CI workflow to supply correct DLLs to checkplatformsyms.pl
The check was broken in several ways, which was concealed by the fact
that checkplatformsyms.pl returned success in many cases before:
* Hard-coded file name suffixes (-3-x64) meant that the check
was not performed on OpenSSL 4.0+ and never for 32-bit builds.
* dumpbin also wasn't in PATH in some configurations, which also led
to skipped checks.
Fix that by supplying proper file names based on OpenSSL major version
and ABI, add missing VCVars calls and working dir setups.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:23 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
.github/workflows/windows_comp.yml: drop platform symbol usage check
It has never worked, as an attempt to make it work leads to this error:
Symbol ZSTD_compressStream2 not in the allowed platform symbols list
Symbol ZSTD_CStreamInSize not in the allowed platform symbols list
Symbol ZSTD_initCStream not in the allowed platform symbols list
Symbol ZSTD_freeCStream not in the allowed platform symbols list
Symbol ZSTD_endStream not in the allowed platform symbols list
Symbol ZSTD_freeDStream not in the allowed platform symbols list
Symbol ZSTD_initDStream not in the allowed platform symbols list
Symbol ZSTD_decompressStream not in the allowed platform symbols list
Symbol ZSTD_getErrorName not in the allowed platform symbols list
Symbol ZSTD_DStreamInSize not in the allowed platform symbols list
Symbol ZSTD_decompress not in the allowed platform symbols list
Symbol ZSTD_flushStream not in the allowed platform symbols list
Symbol ZSTD_isError not in the allowed platform symbols list
Symbol ZSTD_createCStream_advanced not in the allowed platform symbols list
Symbol ZSTD_createDStream_advanced not in the allowed platform symbols list
Symbol ZSTD_compress not in the allowed platform symbols list
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:22 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
util/checkplatformsyms.pl: do not hard-code "libcrypto-3-x64" library name
Ideally, it should probably passed to the script as a parameter,
but, in the meantime, follow the relaxed attitude of the Unix
counterpart and match against any version and all expected arch
suffixes.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:42:21 2026
(Merged from https://github.com/openssl/openssl/pull/30635)
Igor Ustinov [Sat, 28 Mar 2026 12:49:00 +0000 (13:49 +0100)]
evp_decodeblock_int(): Bugfix of padding check
The padding check didn't take into account that by this point the f pointer
had already shifted by 4 positions. Luckily, the original f[2] and f[3]
were saved in c and d .
This code is not reachable in normal operation, but that is not a reason
not to fix it.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:31:13 2026
(Merged from https://github.com/openssl/openssl/pull/30618)
Koda Reef [Sun, 22 Mar 2026 21:44:21 +0000 (21:44 +0000)]
Add INT_MAX bounds check to d2i_ASN1_UINTEGER before (int)len cast
d2i_ASN1_UINTEGER uses (int)len for OPENSSL_malloc, memcpy, and
ASN1_STRING_set0 where len is a long. On LP64 platforms (long is
64-bit, int is 32-bit), values exceeding INT_MAX are silently
truncated, causing undersized allocation and heap buffer overflow.
The sibling function ossl_c2i_ASN1_BIT_STRING in a_bitstr.c already
has this guard (line 92: if (len > INT_MAX)). This adds the same
check to d2i_ASN1_UINTEGER for consistency.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Fri Apr 3 15:22:30 2026
(Merged from https://github.com/openssl/openssl/pull/30532)
Matt Caswell [Thu, 19 Mar 2026 10:38:22 +0000 (10:38 +0000)]
Fix a Use-After-Free bug in the DTLS code
The newly added #30225 introduced a UAF bug in the master branch found
by the dtlsserver fuzzer. If a CCS arrives early and there is trailing
data left in the current record at the point that we change epoch then
the buffer holding the trailing data is freed as part of setting up the
new record layer, but we still have dangling references into that buffer
causing the UAF.
Fixes #30487
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 15:06:50 2026
(Merged from https://github.com/openssl/openssl/pull/30503)
huanghuihui0904 [Mon, 16 Mar 2026 03:05:36 +0000 (11:05 +0800)]
crypto/x509/pcy_tree.c: fix leak of tree in X509_policy_check()
When init_ret indicates both X509_PCY_TREE_EXPLICIT and X509_PCY_TREE_EMPTY,
the function returns without freeing the initialized policy tree.
Free the tree before returning, consistent with the earlier TREE_EMPTY branch.
Also defer *ptree = tree assignment and free the tree when user policies
are empty to avoid returning invalid memory.
Fixes #30435
Signed-off-by: huanghuihui0904 <625173@qq.com> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 3 15:03:37 2026
(Merged from https://github.com/openssl/openssl/pull/30436)
Herman Malik [Wed, 11 Mar 2026 21:49:18 +0000 (14:49 -0700)]
doc: clarify X509_STORE thread safety and lifetime contract
Improve the description of X509_STORE_lock() in X509_STORE_new.pod to
emphasize it acquires an exclusive write lock.
Add a NOTES section to X509_STORE_new.pod covering which operations are
internally thread-safe and which are not, as well as documentation on
lifetime management and reference counting.
Add a NOTES section to X509_STORE_CTX_get_by_subject.pod explaining
that the store's internal lock is released before the found object's
reference count is incremented, so the caller must ensure the store
outlives the lookup.
Clarify the reference counting and the caller's responsibilities.
Remove internal details for conciseness.
Related to #30310
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 3 15:00:55 2026
(Merged from https://github.com/openssl/openssl/pull/30382)
eclipse07077 [Mon, 9 Mar 2026 12:35:43 +0000 (21:35 +0900)]
Fix integer overflow in EVP_ENCODE_LENGTH and base64 encoding paths
The EVP_ENCODE_LENGTH macro performs all arithmetic in the type of
its argument. When the argument is int and exceeds approximately
1.6 billion, intermediate results overflow signed int, potentially
wrapping to a smaller positive value rather than a negative one.
In b64_write() (crypto/evp/bio_b64.c), this causes OPENSSL_malloc
to allocate a buffer smaller than the actual encoded output size.
EVP_EncodeUpdate then writes past the end of the undersized buffer.
Changes:
- Cast macro argument to size_t in EVP_ENCODE_LENGTH to prevent
signed integer overflow
- Change encoded_length in b64_write() from int to size_t and add
an explicit overflow sanity check before allocation
- Change return type of evp_encodeblock_int() and
encode_base64_avx2() from int to size_t so that large encoded
output lengths are not truncated
- Update EVP_EncodeUpdate() to use size_t for the encoder return
value accumulator (j), consistent with the existing size_t total
- Add explicit (int) casts in EVP_EncodeBlock() and EVP_EncodeFinal()
where the public API requires int return values
Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 3 14:55:29 2026
(Merged from https://github.com/openssl/openssl/pull/30321)
Arne Schwabe [Tue, 31 Mar 2026 11:30:38 +0000 (13:30 +0200)]
Fix names of X509_V_ERR_ERROR_IN_CERT_* constants in man page
The names of the X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD and
X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD in the man page have
the first _ERR_ spelt out as _ERROR_ instead.
Signed-off-by: Arne Schwabe <arne@rfc2549.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Wed Apr 1 17:06:53 2026
(Merged from https://github.com/openssl/openssl/pull/30643)
apps/lib/apps.c: use fstat on an opened fd in app_mmap_file()
Coverity has rightfully complained that using stat() before opening file
leads to TOCTOU issues, refactor the code to open the file first and
then perform stat checks on the opened file descriptor. It is still far
from foolproof, as the file is not locked, and stat() is used elsewhere,
but at least it seems to be a step in the right direction.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1690686 Fixes: 80b7e49c273f "Use mmap for pkeyutl -rawin and dgst one-shot input" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Apr 1 12:46:08 2026
(Merged from https://github.com/openssl/openssl/pull/30624)
Viktor Dukhovni [Thu, 26 Mar 2026 17:02:34 +0000 (04:02 +1100)]
Refactor ML-KEM decap, also cleanse failure_key
Pedantically cleanse the typically unused decap failure_key's stack
copy.
When actually used, it is copied into the caller's shared secret result,
perhaps to be cleansed there after use, or not, that's the callers
business.
While at it, slightly refactor the internal decap() implementation to
consolidate all the data to be cleansed into a single buffer, but now
avoid copying the public key hash, instead, when computing "K || r" as
"G(m || h)" include "h" via a separate EVP_DigestUpdate() call.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 31 05:19:40 2026
(Merged from https://github.com/openssl/openssl/pull/30598)
Collin Funk [Sat, 28 Mar 2026 07:41:01 +0000 (00:41 -0700)]
Fix -Wdiscarded-qualifiers warnings shown when glibc-2.43 is used
When building with glibc-2.43 there is the following warning:
crypto/x509/x509_vpm.c: In function 'validate_email_name':
crypto/x509/x509_vpm.c:317:13: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
317 | if ((at = memchr(name, '@', len)) == NULL)
| ^
This is due to a change described in the NEWS file of glibc-2.43:
* For ISO C23, the functions bsearch, memchr, strchr, strpbrk, strrchr,
strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr that return
pointers into their input arrays now have definitions as macros that
return a pointer to a const-qualified type when the input argument is
a pointer to a const-qualified type.
Systems using this recent glibc version will likely also be using GCC 15
or later which default to `-std=gnu23`, meaning that this warning will
show up without modifying `CFLAGS`.
We can make these pointers const since we never write to them.
Complements: f584ae959cbc "Let's support multiple names for certificate verification"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 31 02:38:14 2026
(Merged from https://github.com/openssl/openssl/pull/30613)
Pranavjeet-Naidu [Tue, 24 Mar 2026 23:45:30 +0000 (05:15 +0530)]
Add negative length validation in EVP_EncryptUpdate and EVP_DecryptUpdate
Added input length validation checks to prevent potential security issues
when negative values are passed to EVP_EncryptUpdate and EVP_DecryptUpdate.
These functions cast inl (int) to size_t without validation, which could lead
to unexpectedly large buffer allocation attempts or unintended behavior with
negative inputs.
Validation is performed early in both functions to ensure only valid,
non-negative lengths are processed. Error is reported via EVP_R_INVALID_LENGTH.
Fixes: https://github.com/openssl/openssl/issues/30486 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 02:10:52 2026
(Merged from https://github.com/openssl/openssl/pull/30560)
Milan Broz [Fri, 27 Mar 2026 09:38:52 +0000 (10:38 +0100)]
Remove superfluous volatile for RCU on Windows
When compiling on the MINGW platform, there are many warnings like this:
warning: passing argument 1 of 'CRYPTO_atomic_add64' discards 'volatile'
qualifier from pointer target type [-Wdiscarded-qualifiers]
CRYPTO_atomic_add64(&lock->qp_group[qp_idx].users, (uint64_t)1, &tmp64,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The warning actually shows several issues with volatile in struct rcu_qp:
- all handling functions using it do not use the volatile modifier,
so that the compiler can treat this pointer as non-volatile already
(Posix pthread variant does not use volatile here at all.)
- thread safety is already guaranteed by using locks
(NO_INTERLOCKEDOR64) or Interlocked*64 Win32 API functions.
- the volatile removal modifier should always be explicit
In short, I think the volatile in struct rcu_qp on Windows
has no additional value and can be removed.
This also fixes the warnings mentioned above :-)
Signed-off-by: Milan Broz <gmazyland@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 01:25:56 2026
(Merged from https://github.com/openssl/openssl/pull/30602)
kovan [Tue, 27 Jan 2026 11:11:08 +0000 (12:11 +0100)]
doc: fix -signcert grouping in CA.pl documentation
The -signcert option was incorrectly grouped with -sign and -xsign at
line 109, which implied they were equivalent. However, -signcert is
different: it expects a self-signed certificate (not a certificate
request) in newreq.pem, and converts it to a request before signing.
This is correctly documented in its own separate section at line 123,
which states "-signcert is the same as -sign except it expects a self
signed certificate".
Remove -signcert from the -sign/-xsign grouping to eliminate the
contradiction.
Resolves: https://github.com/openssl/openssl/issues/29165 Fixes: 022696cab014 "Allow CA.pl script user to pass extra arguments to openssl command" Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 01:10:50 2026
(Merged from https://github.com/openssl/openssl/pull/29794)
Update the documentation to include that added const qualifiers
to the arguments of X509_EXTENSION_get_object(), X509_EXTENSION_get_data(),
and X509v3_add_ext().
References: https://github.com/openssl/openssl/pull/30595
Complements: e75bd84ffc73 "Constify X509_get_ext() and friends.." Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Tue Mar 31 00:47:35 2026
(Merged from https://github.com/openssl/openssl/pull/30601)
ikev2kdf.c: expand missing secret check in kdf_ikev2kdf_derive()
The seemingly impossible (and erroneous) case of (secret == NULL &&
secret_len != 0) is not accounted for in sanity checks, which provoked
Coverity to report potential NULL dereference in ikev2_check_secret_and_pad()
afterwards. Placate it by expanding the check to cover that improbable
situation and echo the seedkey check from the previous case.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1690439
Complements: 0dd1c50fc070 "Add IKEV2KDF implementation" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Mar 31 00:33:22 2026
(Merged from https://github.com/openssl/openssl/pull/30566)
Milan Broz [Sat, 28 Mar 2026 11:37:32 +0000 (12:37 +0100)]
Use OPENSSL_assert for Windows RCU for missing lock
If NO_INTERLOCKEDOR64 is define, Windows RCU code must
use thread locks.
The lock *must* be provided in that case otherwise it is
an internal code error, not a runtime error.
Use OPENSSL_assert here.
This also fixes several unititialized variable warnings
as analyzer no longer see this impossible paths in code.
Signed-off-by: Milan Broz <gmazyland@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 00:28:20 2026
(Merged from https://github.com/openssl/openssl/pull/30619)
Milan Broz [Fri, 27 Mar 2026 09:40:35 +0000 (10:40 +0100)]
Silence MINGW warning about INVALID_SOCKET
On Windows, SOCKET is defined as unsigned (UINT_PTR).
In OpenSSL, the socket abstraction uses int, see
discussion in https://github.com/openssl/openssl/issues/7282.
MINGW for some time uses a signed definition of INVALID_SOCKET,
then switched back to unsigned, see for example
https://sourceforge.net/p/mingw-w64/discussion/723797/thread/71522d10/
Currently, it is defined as unsigned, creating many warnings like
warning: overflow in conversion from 'long long unsigned int' to 'int'
changes value from '18446744073709551615' to '-1' [-Woverflow]
*sock = INVALID_SOCKET;
As we use INVALID_SOCKET only in our code, we can safely silence
this warning just by redefining INVALID_SOCKET to signed
(version that is commented out in MINGW headers).
While this is only a workaround, it has been here for years and
allows focus on more important warnings.
Signed-off-by: Milan Broz <gmazyland@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 00:22:27 2026
(Merged from https://github.com/openssl/openssl/pull/30616)
Milan Broz [Fri, 27 Mar 2026 09:39:56 +0000 (10:39 +0100)]
Define static set_cloexec() only when really used
Statically defined set_cloexec helper is used only
if RIO_NOTIFIER_METHOD_SOCKET is set (for non-Windows branch)
and if RIO_NOTIFIER_METHOD_SOCKETPAIR is set
(always).
This avoids unused code warnings.
Signed-off-by: Milan Broz <gmazyland@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 31 00:22:26 2026
(Merged from https://github.com/openssl/openssl/pull/30616)
openssl-machine [Tue, 24 Mar 2026 15:13:42 +0000 (15:13 +0000)]
Update ordinals from 4.0.0-beta1
This is a partial forward-port of commit 3c4194022cc4 "make update"
from the openssl-4.0 branch, that includes updates to util/libcrypto.num
and util/libssl.num files.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:52:22 2026
(Merged from https://github.com/openssl/openssl/pull/30555)
Abhinav Agarwal [Tue, 24 Mar 2026 02:17:04 +0000 (19:17 -0700)]
quic: add missing return 0 after raise_protocol_error for NEW_CONN_ID
Every other frame type handler in depack_process_frames() returns 0
after calling ossl_quic_channel_raise_protocol_error(), but the
NEW_CONN_ID case falls through to depack_do_frame_new_conn_id().
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 27 16:48:44 2026
(Merged from https://github.com/openssl/openssl/pull/30550)
Adds NULL checks for EVP_MD_CTX_get_pkey_ctx() return values
Guard against potential NULL pointer dereferences when
EVP_MD_CTX_get_pkey_ctx() is called and its result is used
without validation. Store the return value in a local variable,
check for NULL before passing it to subsequent functions, and
remove redundant repeated calls.
Fixes #27735
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:39:04 2026
(Merged from https://github.com/openssl/openssl/pull/30522)
Amaan Qureshi [Fri, 20 Mar 2026 00:40:20 +0000 (20:40 -0400)]
s390x: set minimum architecture level to z10
The keccak1600 perlasm file (`keccak1600-s390x.pl`) emits `cijne`, a
z10 compare-immediate-and-branch instruction, without declaring a
minimum architecture level. GCC defaults to `-march=z900` on s390x,
causing assembler errors when building with the default toolchain
flags:
z900 has been out of service since 2014, the Linux kernel requires
z196 minimum, and clang already defaults to z10 on s390x. A
`.machine "z10"` GAS directive in the generated assembly resolves the
error by declaring the architecture level the file already requires.
Ref: #27323
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Mar 27 16:32:22 2026
(Merged from https://github.com/openssl/openssl/pull/30507)
herbenderbler [Wed, 25 Mar 2026 06:49:06 +0000 (00:49 -0600)]
Use mmap for pkeyutl -rawin and dgst one-shot input
When using openssl pkeyutl -rawin or openssl dgst for one-shot sign/verify
(e.g. Ed25519, Ed448), file input is now read via mmap() on Unix where
supported, avoiding a full buffer allocation and copy. Large files are
supported without doubling memory use; on failure of the mmap path we
do not fall back to the buffer path.
- Add app_mmap_file() in apps/lib/apps.c: stat/open/mmap/close, tri-state
return (1 mapped, 0 size zero, -1 error). Parameter err_bio avoids
shadowing global bio_err (-Wshadow).
- apps/pkeyutl.c and apps/dgst.c: use app_mmap_file(); single exit for
mmap path in pkeyutl; dgst includes apps.h first for _FILE_OFFSET_BITS;
do_fp_oneshot_sign returns EXIT_SUCCESS/EXIT_FAILURE like do_fp(); no
fallback when mmap attempted but fails.
- pkeyutl mmap/buffer path: pass filesize to EVP_DigestVerify and
EVP_DigestSign (review suggestion, avoids casting buf_len).
- Error messages: per-file messages for stat/size (dgst, pkeyutl); CHANGES.md
"Unix-like" and "16 MB" (documentation style).
- Centralize _FILE_OFFSET_BITS and mmap includes in apps/include/apps.h.
- Tests: pkeyutl/dgst oneshot from file, no-fallback regression tests;
use srctop_dir for test paths; stderr patterns for mmap errors.
- Docs: man pages and CHANGES.md.
CI fixes: return failure from dgst one-shot sign when mmap fails; treat
non-regular paths as mmap errors in app_mmap_file() and pkeyutl; reject
directories before mmap.
Addresses review feedback from DDvO, npajkovsky, and vdukhovni (PR #30429).
Fixes #11677
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org> Co-authored-by: David von Oheimb <DDvO@users.noreply.github.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Mar 27 16:25:33 2026
(Merged from https://github.com/openssl/openssl/pull/30429)
Weidong Wang [Sat, 21 Mar 2026 15:41:49 +0000 (10:41 -0500)]
Fix missing EVP_CIPHER_get_iv_length() guard in PKCS5_pbe2_set_scrypt
Store the return value of EVP_CIPHER_get_iv_length() in a local variable
and guard with (ivlen > 0) before passing to memcpy/RAND_bytes, matching
the pattern already used in p5_pbev2.c. Without this, a negative return
value (-1) is implicitly converted to SIZE_MAX when cast to size_t,
causing a stack buffer overflow on iv[EVP_MAX_IV_LENGTH].
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Mar 27 16:14:09 2026
(Merged from https://github.com/openssl/openssl/pull/30510)
CMS/PKCS#7 doc: Fix inconsistencies and missing detail w.r.t. smimesign and smimeencrypt purposes
* Fix inconsistent doc (so far using purpose names smime_sign and smime_encrypt) vs. implementation
* Add the info that "smimesign" is the default purpose here.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Fri Mar 27 06:25:20 2026
(Merged from https://github.com/openssl/openssl/pull/18914)
projects / thirdparty / openssl.git / log
