Document trailing data handling for DER input

Commands that read a single DER object may stop after decoding that object and leave trailing input unchecked. Document that successful decoding is therefore not a full-input validity check.

Fixes #31495

CLA: trivial

Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31524)

diff --git a/doc/man1/openssl-format-options.pod b/doc/man1/openssl-format-options.pod
index 2da9bef5efcc3cae0b17d3782d242b94356d59e6..1bdb82efad5118b8834ec862332e324dca877a7e 100644 (file)
--- a/doc/man1/openssl-format-options.pod
+++ b/doc/man1/openssl-format-options.pod
@@ -60,6 +60,11 @@ is described in each command documentation.
 A binary format, encoded or parsed according to Distinguished Encoding Rules
 (DER) of the ASN.1 data language.
 
+When a command reads a single DER object, it may stop after successfully
+decoding that object. Any trailing data in the input is not necessarily
+examined or rejected. Therefore, a successful command does not by itself
+confirm that the entire input consists of one valid DER object.
+
 =item B<P12>
 
 A DER-encoded file containing a PKCS#12 object.
@@ -124,7 +129,7 @@ Note that the parsing is simple and might fail to parse some legal data.
 
 =head1 COPYRIGHT
 
-Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy