From: Jakub Zelenka Date: Tue, 21 Jul 2026 22:11:18 +0000 (+0200) Subject: apps: fail skeyutl -genkey on bad -skeyopt X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=02047ece21cf8f6126fdf4119a463ef4d950b1cc;p=thirdparty%2Fopenssl.git apps: fail skeyutl -genkey on bad -skeyopt app_params_new_from_opts() returns NULL when a key option cannot be converted, either because the key management does not settle the parameter or because the opt:value separator is missing. skeyutl ignored that and generated the key without the requested options, only printing the parameter error to stderr and still exiting successfully. Bail out instead, the way the mac, kdf and enc applications do. A NULL return is only an error when key options were actually given, as app_params_new_from_opts() also returns NULL for an empty option list. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale Reviewed-by: Dmitry Belyavskiy Reviewed-by: Daniel Kubec MergeDate: Mon Jul 27 09:06:03 2026 (Merged from https://github.com/openssl/openssl/pull/32036) --- diff --git a/apps/skeyutl.c b/apps/skeyutl.c index 46461781ff5..cb9a8131de0 100644 --- a/apps/skeyutl.c +++ b/apps/skeyutl.c @@ -102,6 +102,9 @@ int skeyutl_main(int argc, char **argv) goto end; params = app_params_new_from_opts(skeyopts, EVP_SKEYMGMT_get0_gen_settable_params(mgmt)); + /* A NULL return is an error only if key options were given */ + if (skeyopts != NULL && params == NULL) + goto end; skey = EVP_SKEY_generate(app_get0_libctx(), skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),