Jakub Zelenka [Mon, 29 Jun 2026 20:46:21 +0000 (22:46 +0200)]
mfail: add sampled and count-only modes to test driver
Sampled tests cap allocation-failure injection at a fixed number of
sampled points, running exhaustively when the allocation count is below
that. Non-sampled tests fall back to counting only on non-cached-fetch
builds, where exhaustive injection is impractical.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 09:43:50 2026
(Merged from https://github.com/openssl/openssl/pull/31780)
Marc Gutman [Thu, 9 Jul 2026 20:23:28 +0000 (15:23 -0500)]
Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundary
asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO. Callers
commonly loop, decoding concatenated DER values until the call fails, and
rely on a failure with no queued error to recognise a clean end of input.
CPython's ssl module does this in _add_ca_certs() when loading the Windows
certificate store via SSLContext.load_verify_locations(cadata=...); it
re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as
fatal.
Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the
BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read()
returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now
raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue.
The rewrite in commit 35852da1d9 carried this behaviour forward. As a
result Python 3 on Windows fails to initialise an SSLContext with:
ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data
Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, on an EOF in the
middle of an object (some bytes already buffered), or on an EOF while still
inside an indefinite-length value awaiting its end-of-contents octets - all
of which are genuine truncation. A clean EOF at a top-level object boundary
again fails without queuing an error, restoring the long-standing behaviour
that looping callers depend on.
Add regression tests covering the clean-EOF, truncated, indefinite-length
truncation and partial-header cases, and document the read behaviour in
ASN1_item_d2i_bio(3).
Fixes #31807
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jul 13 08:05:03 2026
(Merged from https://github.com/openssl/openssl/pull/31818)
An empty directoryName constraint has canon_enc == NULL and
canon_enclen == 0. nc_dn() must not pass that pointer to
memcmp(), even with a zero length.
Return X509_V_OK before comparing an empty base Name. This preserves
current match semantics and avoids UBSan-visible undefined behaviour.
Fixes #31687
Fixes #31688
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 10 15:51:01 2026
(Merged from https://github.com/openssl/openssl/pull/31814)
Jakub Zelenka [Tue, 7 Jul 2026 14:37:49 +0000 (16:37 +0200)]
rand: add mfail tests for generation and seeding
Add memory-failure injection coverage to rand_test for the full
RAND_bytes_ex/RAND_priv_bytes_ex stack on a fresh library context, the
SEED-SRC entropy acquisition and the CTR-DRBG operations with a
TEST-RAND parent. The cipher fetches used by the DRBG setup are warmed
up outside the injection window so that the injection targets the RAND
machinery itself.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 15:47:16 2026
(Merged from https://github.com/openssl/openssl/pull/31885)
Jakub Zelenka [Tue, 7 Jul 2026 14:33:12 +0000 (16:33 +0200)]
test-rng: handle nonce length query in generate mode
The DRBG instantiation probes the parent nonce callback with a NULL
output buffer to obtain the nonce length before requesting the actual
nonce. The generate mode branch of test_rng_nonce() wrote the bytes
without checking the output pointer, crashing when TEST-RAND with
generate=1 is used as a DRBG parent. The entropy-buffer branch already
handles a NULL output correctly.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Jul 10 15:47:15 2026
(Merged from https://github.com/openssl/openssl/pull/31885)
Bob Beck [Fri, 12 Jun 2026 15:55:42 +0000 (09:55 -0600)]
Change the Doxygen doc requirement for non public functions
To be at the prototype site in the internal header file.
The major reason *Why* we would like to have Doxygen style comments
describing what internals do is so that they work with modern IDE's
since most common ones support them.
It's wonderful to be looking at an internal function, thinking "wtf is this",
and be able to hover over it and - boink - up comes the docs. This
typically only works (or works better) when the Doxygen comment is
at the prototype site, not if it is at the implementation site.
This also reinforces the requirement that "yes you do this for shared
functions but you don't need to for statics".
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:18 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
Bob Beck [Fri, 12 Jun 2026 03:55:48 +0000 (21:55 -0600)]
Modernize and update STYLE.MD, add DOCUMENTATION.MD
So this repatriates DOCUMENTATION.MD from the web page to the
code base, and links both STYLE.MD and DOCUMENTATION.MD from
CONTRIBUTING.MD
It does a large rototilling of STYLE.MD to address many of the
outstanding concerns noted when I started this before clang-format
last year, and brings us roughly in line with the things that are
addressed in similar style guides for other projects.
Most of the changed or updated reccomendations reflect what we
currently have been doing, or have expressed as a desire to
move to in the future.
Most larger "OpenSSL-isms" I've tried to explicitly call out
to make this a more cohesive and useful guide for a new contributor
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:16 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
Bob Beck [Mon, 1 Dec 2025 22:10:48 +0000 (15:10 -0700)]
Add a STYLE.md file and link it from CONTRIBUTING.md
This is effectively, the current coding style policy web page
changed to accomodate clang-format. This is more or less the
same file I have had in the various clang-format sample PR's since
September.
It does include an additional sections on Integers and on
Return Values that are not in the original coding style
policy
It is changed from the September version in that it does not
have mention of keeping include files self contained. I believe
that is achievable and desirable, but I think should be done
as a separate change from this.
There were a number of issues brought up in discussion of this
file in the clang-format PR's. I recorded those in 818, 819,
820, 821, 822, 823, 824, 825, and 826, which we can
link in there to the appropriate section of the document.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 10 15:37:13 2026
(Merged from https://github.com/openssl/openssl/pull/29295)
Jakub Zelenka [Fri, 26 Jun 2026 13:04:27 +0000 (15:04 +0200)]
quic: fix intermittent idle-test failure in tserver test
The thread-assisted idle test advances fake time in 10ms steps while the
connection is kept alive solely by the background assist thread sending
keepalive PINGs. The test stepped fake time without checking that a due
keepalive had actually been sent, so whether it went out before the
server's idle deadline lapsed depended on thread scheduling - hence the
intermittent failure.
Now, before each step, check the event timeout (next_deadline minus
fake-now): while a keepalive is still due to be sent it stays at zero, so we
wake the assist thread and re-check without advancing until it goes positive
(or the existing real-time watchdog fires). Only then do we step fake time.
The negotiated 30s idle timeout and 60s idle duration are unchanged, so the
keepalive is still required and still tested; only the race is removed.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 10 15:33:45 2026
(Merged from https://github.com/openssl/openssl/pull/31746)
Mounir IDRASSI [Sun, 17 Jan 2021 01:04:08 +0000 (02:04 +0100)]
Allow MinGW-w64 builds to use BCryptGenRandom
MinGW-w64 has provided bcrypt headers and import libraries since
version 2.0, but OpenSSL only enabled the BCryptGenRandom seeding
path for supported MSVC builds. Enable the existing direct
BCryptGenRandom flow for MinGW-w64 when targeting Windows Vista or
newer, and link MinGW builds with bcrypt alongside the other Windows
import libraries.
Use __MINGW64_VERSION_MAJOR to detect MinGW-w64 because it is defined
by both the 32-bit and 64-bit MinGW-w64 toolchains.
Builds targeting older Windows versions keep the CryptoAPI fallback
because USE_BCRYPTGENRANDOM remains disabled when _WIN32_WINNT is
below 0x0600.
Fixes #13878
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 12:05:09 2026
(Merged from https://github.com/openssl/openssl/pull/13882)
Bob Beck [Thu, 18 Jun 2026 17:24:17 +0000 (11:24 -0600)]
Simplify printf-attribute guards in bio.h.in and test/testutil/output.h.
Now that C99 is the base level, and we are no longer supporting old
GCC's, The ossl_bio__printf__ / ossl_test__printf__ indirection only existed
to pick the gnu_printf attribute over the printf attribute for MinGW's MS-CRT printf, but
MinGW is already excluded by the outer guard, so we can use the modern attribute
everywhere this code runs.
Spotted by idrassi on review, thanks!.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:19 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
Bob Beck [Wed, 17 Jun 2026 22:58:11 +0000 (16:58 -0600)]
Drop Watcom C compiler support.
The only Watcom-specific code in the tree was a <tchar.h> _vsntprintf
mapping in crypto/cryptlib.c. There is no Watcom entry in Configurations/,
no CI job builds with Watcom, and the tree has had no other Watcom-aware
code in many years. The _vsntprintf symbol is supplied by <tchar.h>
on every supported Windows toolchain (MSVC, MinGW), so the conditional
fallback is dead.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 11:47:15 2026
(Merged from https://github.com/openssl/openssl/pull/31677)
Viktor Dukhovni [Sat, 25 Apr 2026 12:12:59 +0000 (22:12 +1000)]
Improve TLS handling of EC point formats
Decouple the ec_point_formats extension from TLS 1.2 X.509
selection and acceptance. Remove tls1_check_pkey_comp() and its
callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3
disregards the extension already, and we can decode any point form
a peer might send, so refusing a compressed peer cert in TLS 1.2
because we didn't advertise compressed buys nothing.
The RFC 4492/8422 section 5.1.2 requirement that the peer's list
contain "uncompressed" used to be enforced in a final hook on the
client side only. Move it to the two points where the negotiated
ciphersuite is known: the client's ServerHello parse hook, and the
server's ServerHello construct hook. Both sites fire the alert
only when an ECC TLS 1.2 ciphersuite has been negotiated, so a
missing "uncompressed" is ignored under TLS 1.3 or a non-ECC
cipher. The client- and server-side parse hooks now share one
function.
Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL;
our own list is built directly inside the constructors. The
peer's list continues to be stored verbatim, and is also exposed
through the SSL_get0_ec_point_formats() accessor (now documented).
New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS
1.2 vs 1.3) plus that a compressed point form EC cert is usable on
both sides without any opt-in.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:30 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
Viktor Dukhovni [Sat, 25 Apr 2026 18:05:02 +0000 (04:05 +1000)]
EC: make the group the single source of the point conversion form
The point conversion form (compressed, uncompressed, or hybrid)
was kept both on the key and on the group, and the two could
disagree -- a key imported as compressed could re-encode as
uncompressed. The group is now the single source of truth:
encoding, parameter output, and the legacy lookup all read it from
the group, and decoding (PEM, DER, or raw parameters) records it
there, so the form round-trips faithfully.
Generated keys are always uncompressed; the point-format option at
key generation is now a documented no-op (it had had no effect for
several releases), and the unused form field on the keygen context
is dropped. Imported keys still keep their form, and the
deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still
work.
EVP_PKEY_fromdata() and openssl pkey -text now report the form a
loaded EC key actually has, and re-encoding via PEM or DER
preserves it.
Docs drop a stale note about a compile-time macro for compressed
points on binary curves, and the EC tests now exercise both the
affine and the compressed/hybrid binary formats unconditionally
(fixing a latent bug in the compressed/hybrid form tests that were
never exercised by CI).
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:29 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
Jakub Zelenka [Sat, 20 Jun 2026 12:06:09 +0000 (14:06 +0200)]
Add unit testing cmocka based framework
This adds the unit testing framework that extends the build so it can
be enabled and tests are built. It is executed as part of the test
using a recipe which executes all unit tests.
The documentation is added with more info about writing the unit tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:14 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
Jakub Zelenka [Sun, 12 Apr 2026 13:57:43 +0000 (15:57 +0200)]
Deprecate unit-test configure option and SSL_test_functions
The unit-test configure option exists only to expose the
SSL_test_functions() API allowing to overwrite ssl_init_wbio_buffer.
Instead of renaming it, deprecate the option and the SSL_test_functions()
function so both can be removed in OpenSSL 5.0.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jul 9 17:39:13 2026
(Merged from https://github.com/openssl/openssl/pull/30788)
Nikola Pajkovsky [Tue, 30 Jun 2026 07:01:20 +0000 (09:01 +0200)]
crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_count() in x509_object_dup()
the return value of X509_OBJECT_up_ref_count() was ignored. If the
reference count increment fails, x509_object_dup() still returned a
duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL
without a reference actually having been taken. Freeing that duplicate
later drops a reference it never held, leading to a premature free and
use-after-free of the shared object.
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jul 8 18:20:10 2026
(Merged from https://github.com/openssl/openssl/pull/31811)
Mounir IDRASSI [Sat, 27 Jun 2026 22:50:14 +0000 (07:50 +0900)]
Reject AES-XTS operations without an IV
Commit 774525b38bd4 moved AES-XTS to an implementation-specific cipher
function but did not carry over the generic iv_set guard. This allowed
AES-XTS operations initialized with a NULL IV to proceed.
Restore the missing iv_set check before processing input and add an
evp_extra_test regression covering both a valid-IV control and the
missing-IV failure case.
Fixes #31755
Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:16:55 2026
(Merged from https://github.com/openssl/openssl/pull/31756)
Billy Brumley [Thu, 2 Jul 2026 08:30:13 +0000 (04:30 -0400)]
[test] exercise AEAD tag read rejection when actually present during decryption
Set a verify tag while decrypting (which must succeed) before
attempting the read, so the test asserts that a tag cannot be read
back while decrypting even when one is _actually_ present.
This isolates direction logic from tag present logic.
Follow-up to #31734
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 18:06:40 2026
(Merged from https://github.com/openssl/openssl/pull/31826)
Jakub Zelenka [Tue, 23 Jun 2026 09:35:42 +0000 (11:35 +0200)]
apps: cover the unencrypted key bag path in the pkcs12 test recipe
The NID_keyBag branch of dump_certs_pkeys_bag() was not exercised.
Export a file with -keypbe NONE and dump it, checking the key bag is
reported and its private key is output.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 18:02:22 2026
(Merged from https://github.com/openssl/openssl/pull/31665)
Matt Caswell [Tue, 16 Jun 2026 10:35:33 +0000 (11:35 +0100)]
Add regression test for remove_session_cb under lock
Install a remove_session_cb that calls SSL_CTX_flush_sessions_ex().
If the callback is invoked while ctx->lock is held, the nested
flush call deadlocks immediately.
The test covers the SSL_CTX_add_session() eviction path (adding a
second session to a size == 1 cache evicts the first, firing the
callback) and the SSL_CTX_flush_sessions_ex() path (SSL_CTX_free()
flushes the remaining session via flush_sessions_ex()).
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:48 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
Matt Caswell [Tue, 16 Jun 2026 10:35:25 +0000 (11:35 +0100)]
Fix remove_session_cb called while holding ctx->lock
SSL_CTX_add_session() held ctx->lock while calling remove_session_lock()
with lck = 0, which still fired the remove_session_cb callback.
SSL_CTX_flush_sessions_ex() had the same problem: it called
remove_session_cb for each expired session while holding the lock.
Any callback that re-entered an OpenSSL API requiring the same lock
would deadlock.
Refactor remove_session_lock() into remove_session_locked() (caller
holds the lock) which returns the removed SSL_SESSION * instead of
calling the callback and freeing it internally.
SSL_CTX_remove_session() manages its own locking and invokes the
callback unconditionally after releasing the lock (preserving the
existing behaviour where the callback fires even when the session is
not in the internal cache, to allow external caches to be notified).
SSL_CTX_add_session() collects evicted sessions in a temporary
singly-linked list (via the now-NULL next pointer) and processes them
after CRYPTO_THREAD_unlock().
SSL_CTX_flush_sessions_ex() already deferred SSL_SESSION_free() to
after the lock via a STACK_OF(SSL_SESSION). The callback is now also
deferred: sessions are collected on the stack under the lock, then
the lock is released before iterating the stack to fire callbacks
and free each session.
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 17:58:47 2026
(Merged from https://github.com/openssl/openssl/pull/31540)
Steven WdV [Tue, 7 Jul 2026 12:52:30 +0000 (14:52 +0200)]
Allow `getentropy` for Emscripten
Usually Emscripten emulates `/dev/urandom`, but in some cases,
like with `-sNODERAWFS`, it doesn't. This means that on non-Unix platforms,
where `/dev/urandom` does not exist on the host, OpenSSL will fail to seed
its PRNG. This fixes that by instead using the POSIX function it
implements, like which was already done for WASI.
See https://github.com/emscripten-core/emscripten/issues/9628#issuecomment-4892658766 for more context.
CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 17:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31882)
Neil Horman [Thu, 2 Jul 2026 17:28:16 +0000 (13:28 -0400)]
Suppress function pointer type validation in clang ubsan
We've been concerned about ubsan errors comming with more recent
versions of clang. specifically versions of clang later than 17
generate hundreds of function pointer type validation errors, i.e.
assigning a function of type void (*)(TYPE *) to a function pointer of
type void (*)(void *).
Fixing these requires the creation of lots of thunk function that get
littered through the code base, and are generally unpleasant to carry.
A better fix requires siginficant code refactoring, and potentially
large changes to our ABI, which we can't support until the next major
release.
So, for now, just suppress those ubsan errors, so we can more properly
deal with the issue when we are able.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jul 8 16:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31837)
Jakub Zelenka [Tue, 7 Jul 2026 11:38:16 +0000 (13:38 +0200)]
property: replace property_memfail with in-tree mfail tests
The standalone property_memfail.c program is superseded by memory-failure
tests added directly to property_test.c using the MFAIL harness. They
cover the same property store API surface under allocation failure
injection: ossl_method_store_new, ossl_method_store_add,
ossl_method_store_cache_set and the providerless ossl_method_store_cache_get
lookup, plus the method == NULL cache_set branch.
Unlike the old NO_CHECK-only program, the new tests run as checked mfail
tests, verifying both clean error propagation and the absence of reference
leaks on every failure path. The old program also relied on a stale,
pre-lockless STORED_ALGORITHMS layout to poke the cache directly, which no
longer matches property.c.
Drop property_memfail.c along with its wiring in test/build.info and the
90-test_memfail.t recipe.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 8 13:05:16 2026
(Merged from https://github.com/openssl/openssl/pull/31880)
BIO_vprintf: fix off-by-one at 512-byte buffer boundary
BIO_vprintf() first formats into a 512-byte stack buffer. Since
vsnprintf() returns the required length excluding the NUL, a return
value of 512 means truncation. The old strict greater-than check
therefore wrote the truncated buffer for exactly 512-byte output.
Use >= for the realloc path and add boundary coverage for 511-, 512-
and 513-byte outputs.
Fixes: a29d157fdb6d "Replace homebrewed implementation of *printf*() functions with libc" Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 11:24:31 2026
(Merged from https://github.com/openssl/openssl/pull/31842)
Commit aa4b47483f41 "Fix util/mkinstallvars.pl to treat LIBDIR
and libdir correctly" added more logs while bc44134c32b9 "Configure:
Remove extensive debug output by default" was under review, so those
were missed.
Complements: bc44134c32b9 "Configure: Remove extensive debug output by default"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 8 11:03:11 2026
(Merged from https://github.com/openssl/openssl/pull/31843)
olszomal [Tue, 5 Aug 2025 10:00:03 +0000 (12:00 +0200)]
BIO: avoid returning internal FILE * with UPLINK-enabled builds on Windows
On Windows with UPLINK enabled, BIO_get_fp() may return a FILE * pointer
incompatible with the C runtime. Ensure that it returns NULL instead,
preventing undefined behavior in applications. Update the documentation
to include the missing return type for BIO_[gs]et_fp() and remove
the mention that BIO_get_fp() never returns 0, as it does so now
when NULL fp is returned.
Fix crash in EVP_MD_CTX_copy_ex on inconsistent context
EVP_MD_CTX_copy_ex() might crash on an NULL pointer access when an
inconsistent context is copied. This happens when a context is copied
where digest is set but algctx is NULL, i.e. due to an incomplete
initialization.
The copyctx shortcut for cases where the in and out contexts use the
exact same digest call the copyctx function attempting to copy
the algctx, but it does not check if algctx is NULL on the in or out
contexts.
Fix this by only taking the copyctx shortcut if algctx is non-NULL on
both, in and out. Otherwise use the full copy path which will only
duplicate the algctx if it is non-NULL.
Closes: https://github.com/openssl/openssl/issues/31831 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31867)
Nikola Pajkovsky [Tue, 30 Jun 2026 06:55:09 +0000 (08:55 +0200)]
crypto/x509/x509_lu.c: fix memory leak in obj_ht_foreach_object()
when sk_X509_OBJECT_push() fails after x509_object_dup() has already
allocated the duplicate, the dup is neither stored on the destination
stack nor freed: the error path only pop_free()s the stack the dup was
never pushed onto, so it is leaked.
Set env ASAN_OPTIONS in test explicitly to detect_leaks=1 to force
ASAN to fail the test. Otherwise, the test reports ok even with valid
leak.
Fixes: 08cecb4448e9 "Add X509_STORE_get1_objects" Fixes: https://github.com/openssl/openssl/issues/31771 Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Tue Jul 7 07:42:17 2026
(Merged from https://github.com/openssl/openssl/pull/31784)
Neil Horman [Fri, 3 Jul 2026 20:19:57 +0000 (16:19 -0400)]
Fix new statem_clnt_test when dtls is disabled
The new statem client tests added in comimt c36a9b4 assume that if
OPENSSL_NO_DTLS is not defined, that we have DTLS support, but we have
this odd setup in which we can have DTLS enabled, but DTLS1_2 disabled,
in which case the needed support isn't present, and the test fails.
why we have it setup that way, I'm not sure, but we should only run the
dtls tests if both DTLS and DTLS1_2 support is available.
Fixes #31851
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Mon Jul 6 09:42:44 2026
(Merged from https://github.com/openssl/openssl/pull/31582)
Jakub Zelenka [Tue, 23 Jun 2026 14:32:12 +0000 (16:32 +0200)]
quic: add mfail test for handshake multi-packet processing
This tests handshake level phase using mfail covering SSL_do_handshake.
It is a test for #31323.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jul 4 16:57:38 2026
(Merged from https://github.com/openssl/openssl/pull/31324)
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Sat Jul 4 16:53:24 2026
(Merged from https://github.com/openssl/openssl/pull/30857)
Neil Horman [Fri, 26 Jun 2026 17:18:49 +0000 (13:18 -0400)]
Remove CRYPTO_GET_REF
This function should never have existed. Its a TOCTOU waiting to
happen. Now that we've eliminated all internal uses, and given that its
an internal function, send it to a nice farm upstate, where it can run
and play with all the other functions that shouldn't have been.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:16 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
Neil Horman [Fri, 26 Jun 2026 17:06:20 +0000 (13:06 -0400)]
Replace use of CRYPTO_GET_REF in bio_lib
BIO_free_all makes use of CRYPTO_GET_REF to determine if there is
another user of a BIO chain at some artibrary point within the chain.
But CRYPTO_GET_REF is begging for a TOCTOU error, and so we're
deprecating it.
replace the use of GET_REF with an internal version of BIO_free that
returns the value of the resultant ref count, and use that instead, so
we are TOCTOU free
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:13 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
Neil Horman [Thu, 25 Jun 2026 21:42:05 +0000 (17:42 -0400)]
eliminate use of CRYPTO_GET_REF in sslapitest
CRYPTO_GET_REF is almost by definition a TOCTOU race, and we shouldn't
use it.
As part of the effort to deprecate it, eliminate its use from
sslapitest.
Avoid the use-after-free possibility by getting a session with
SSL_get1_session (which increments the refcount) and freeing it after
we're done with it.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Sat Jul 4 16:47:10 2026
(Merged from https://github.com/openssl/openssl/pull/31750)
Jakub Zelenka [Thu, 25 Jun 2026 10:51:49 +0000 (12:51 +0200)]
apps: cover x509 DER key/cert input formats
The -keyform, -CAform and -CAkeyform options were not covered. Add a
test that self-signs a CSR with a DER-encoded key and signs a CSR with
a DER-encoded CA cert and CA key.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 3 19:40:27 2026
(Merged from https://github.com/openssl/openssl/pull/31733)
Jakub Zelenka [Tue, 30 Jun 2026 17:44:15 +0000 (19:44 +0200)]
apps: test dsa app PVK output
Cover the previously untested PVK code paths of the dsa app: round-trip
the test key through the PVK encoding (mirroring the existing rsa PVK
test, and skipped unless rc4, legacy and pvkkdf are enabled), and check
that requesting PVK output for a public key input is rejected.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul 3 19:30:48 2026
(Merged from https://github.com/openssl/openssl/pull/31801)
Jakub Zelenka [Thu, 25 Jun 2026 12:44:06 +0000 (14:44 +0200)]
apps: cover crl signature verification
The CRL signature verification path was not exercised. Add a test that
verifies a CRL signature against its issuer certificate supplied via
-CAfile, -CAstore and -CApath.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Fri Jul 3 19:26:15 2026
(Merged from https://github.com/openssl/openssl/pull/31736)
Jakub Zelenka [Thu, 25 Jun 2026 10:40:59 +0000 (12:40 +0200)]
apps: cover the req -set_serial option
The OPT_SET_SERIAL case in req_main() was not covered. Add a test that
generates a self-signed certificate with an explicit -set_serial value
and checks it, plus the error path when -set_serial is given twice.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul 3 19:25:05 2026
(Merged from https://github.com/openssl/openssl/pull/31730)
Jakub Zelenka [Wed, 24 Jun 2026 21:13:02 +0000 (23:13 +0200)]
x509: add delta CRL success test
Exercise the previously uncovered X509_V_FLAG_USE_DELTAS path in
get_delta_sk(): a current delta CRL revoking kLeaf must be honored.
The base and delta CRLs are generated by `ossl-test-tools crltest delta`.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Jul 3 19:22:29 2026
(Merged from https://github.com/openssl/openssl/pull/31714)
Jakub Zelenka [Tue, 23 Jun 2026 09:44:51 +0000 (11:44 +0200)]
apps: cover the CRL printing path in the pkcs7 test recipe
The crls != NULL block of pkcs7 -print_certs was not exercised. Build
a PKCS#7 structure containing a CRL with crl2pkcs7 and check the CRL is
both printed and output in PEM form.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 3 19:21:11 2026
(Merged from https://github.com/openssl/openssl/pull/31666)
Niels Provos [Tue, 12 May 2026 16:44:12 +0000 (09:44 -0700)]
crypto/x509: replace O(N^2) RFC 3779 canonicalisation merge with linear sweep
ASIdentifierChoice_canonize and IPAddressOrRanges_canonize previously
merged adjacent entries with an in-place loop that called
sk_..._delete() after each merge, making the merge O(N^2) due to the
per-merge stack shift.
Replace the merge with a single linear sweep using a write index
distinct from the read cursor: mergeable entries fold into the
previous output's upper bound in O(1), non-mergeable entries are slid
forward into the write slot, and the source slot is set to NULL so the
ASN.1 free machinery cannot double-free on a subsequent abort.
Canonicalisation is now O(N log N) overall, bounded by the existing
sort.
Mixed-state-on-error safety is provided by the caller's normal
teardown path: OPENSSL_sk_pop unlinks without freeing, OPENSSL_sk_set
replaces without freeing the displaced value, and
ossl_asn1_item_embed_free no-ops on NULL slots, so returning early on
an inner failure leaves the stack in a state that the choice's normal
free path handles cleanly.
New regression tests in test/v3ext.c at N=8192 cover the all-merge,
no-merge, interleaved (slide-forward), range-merge,
overlap-mid-sweep, and inverted-range-mid-sweep paths; the
mixed-state teardown invariant is exercised under ASan + UBSan.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Fri Jul 3 19:20:01 2026
(Merged from https://github.com/openssl/openssl/pull/31147)
Jakub Zelenka [Wed, 24 Jun 2026 14:12:37 +0000 (16:12 +0200)]
ci: run full cross-compile tests on PRs with 'extended tests' label
Previously the cross-compile workflow only ran the EVP tests on pull
requests, with the full test suite done only for push events. Allow the
full suite to run on a pull request when it has the 'extended tests'
label which is already used for extended tests.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Jul 3 14:39:38 2026
(Merged from https://github.com/openssl/openssl/pull/31705)
Neil Horman [Tue, 30 Jun 2026 17:06:52 +0000 (13:06 -0400)]
Add test to exercise non-caching code paths
Use openssl list, which uses EVP_*_do_all_provided on non-caching
algorithms. The do_all_provided path callbacks expect the algorithms
that are looked up to be saveable via up_ref, so this, when run under
asan, makes for a good test to ensure we don't trigger any use after
free situations when not caching algs.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:17 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
Neil Horman [Mon, 29 Jun 2026 21:27:53 +0000 (17:27 -0400)]
Extend refcounting on evp objects to provider requesed no-caching
We recently removed reference counting for EVP objects, but kept the
refcounting when we build with no-cached-fetch.
There is a corner case in which providers in builds that do caching may
still request non-caching by setting *no_cache = 1 in their query
operations.
OQS tripped over this here:
https://github.com/open-quantum-safe/oqs-provider/pull/787
When a provider requests no caching, we need to treat those algorithms
as though we are running in a no-cached-fetch build and still do ref
counting on them.
Teach our algorithms implementation to understand when a provider is
requesting non-caching, mark them as such and ref count only those.
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Jul 2 14:24:13 2026
(Merged from https://github.com/openssl/openssl/pull/31782)
crypto/pem/pem_info.c: avoid switching on PEM_INFO_NONE
Coverity complains that the switch statements in PEM_X509_INFO_read_bio_ex()
switches on PEM_INFO_NONE, while the enclosing condition
(itype != PEM_INFO_NONE) explicitly rules it out. Pacify it by changing
the switch case to default (not removing it to avoid triggering
-Werror=switch).
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695453
Complements: 0e8f2844ed3e "fix function pointer type mismatch in PEM_X509_INFO_read_bio_ex" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 2 07:26:24 2026
(Merged from https://github.com/openssl/openssl/pull/31792)
fuzz/provider.c: check evp##_up_ref return value in collect_##evp
Coverity has reported an unchecked result of an evp##_up_ref call
that is checked elsewhere. Rewrite the collect routine to try to do
the up_ref first, and then call free if push doesn't succeed.
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695451
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1695454 Fixes: f3b988dc2951 "Add provider fuzzer" Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 2 07:26:22 2026
(Merged from https://github.com/openssl/openssl/pull/31792)
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_asym_cipher_free in evp_asym_cipher_from_algorithm
evp_asym_cipher_from_algorithm, in its error path frees the allocated
cipher with EVP_ASM_CIPHER_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_asym_cipher_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_signature_free in evp_signature_from_algorithm
evp_signature_from_algorithm, in its error path frees the allocated sig
with EVP_SIGNATURE_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_signature_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_keymgmt_free in keymgmt_from_algorithm
keymgmt_from_algorithm, in its error path frees the allocated keymgmt
with EVP_KEYMGMT_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keymgmt_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:17:09 +0000 (11:17 -0400)]
use evp_keyexch_free in evp_keyexch_from_algorithm
evp_keyexch_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_keyexch_free (the internal
function that acutally does free the alg) instead.
Neil Horman [Fri, 26 Jun 2026 15:13:21 +0000 (11:13 -0400)]
use evp_kem_free in evp_kem_from_algorithm
evp_kem_from_algorithm, in its error path frees the allocated kem
with EVP_KEM_free, but thats a no-op now, and we actually want to
free it to avoid leaks, so we should use evp_kem_free (the internal
function that acutally does free the alg) instead.
Michał Trojnara [Sat, 27 Jun 2026 20:39:44 +0000 (22:39 +0200)]
s_client: skip TCP shutdown drain for datagram protocols
The shutdown-side drain uses a TCP half-close and a fixed 500 ms
select() timeout to let peers consume buffered alerts before close.
Running it for DTLS/QUIC datagram connections causes an unnecessary
delay after the connection has otherwise completed.
Limit this workaround to non-DTLS, non-QUIC connections.
projects / thirdparty / openssl.git / log
