Indicate EOF on fatal error in file or winstore

If decoders setup fails, this is a fatal error.
We indicate EOF from the store as otherwise the store
users will loop indefinitely.

Fixes #28667

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Mar  2 19:38:43 2026
(Merged from https://github.com/openssl/openssl/pull/30170)

diff --git a/providers/implementations/storemgmt/file_store.c b/providers/implementations/storemgmt/file_store.c
index 8493bb44261f070331cb5d501da7368efd42cf77..436c3b43dc8f73c16cd30606b6d1aacef2ab65aa 100644 (file)
--- a/providers/implementations/storemgmt/file_store.c
+++ b/providers/implementations/storemgmt/file_store.c
@@ -106,6 +106,8 @@ struct file_ctx_st {
 
     /* Expected object type.  May be unspecified */
     int expected_type;
+    /* Fatal error occurred. We should indicate EOF. */
+    int fatal_error;
 };
 
 static void free_file_ctx(struct file_ctx_st *ctx)
@@ -555,8 +557,10 @@ static int file_load_file(struct file_ctx_st *ctx,
 
     /* Setup the decoders (one time shot per session */
 
-    if (!file_setup_decoders(ctx))
+    if (!file_setup_decoders(ctx)) {
+        ctx->fatal_error = 1;
         return 0;
+    }
 
     /* Setup for this object */
 
@@ -754,6 +758,9 @@ static int file_eof(void *loaderctx)
 {
     struct file_ctx_st *ctx = loaderctx;
 
+    if (ctx->fatal_error)
+        return 1;
+
     switch (ctx->type) {
     case IS_DIR:
         return ctx->_.dir.end_reached;

diff --git a/providers/implementations/storemgmt/winstore_store.c b/providers/implementations/storemgmt/winstore_store.c
index 32965ba7c6d3e99a417795dbcb3c64c8a6d75c70..006c946da1252c8221282c777012f585e159d4df 100644 (file)
--- a/providers/implementations/storemgmt/winstore_store.c
+++ b/providers/implementations/storemgmt/winstore_store.c
@@ -267,8 +267,10 @@ static int winstore_load_using(struct winstore_ctx_st *ctx,
     const unsigned char *der_ = der;
     size_t der_len_ = der_len;
 
-    if (setup_decoder(ctx) == 0)
+    if (setup_decoder(ctx) == 0) {
+        ctx->state = STATE_EOF;
         return 0;
+    }
 
     data.object_cb = object_cb;
     data.object_cbarg = object_cbarg;