Greensi7 [Fri, 7 Aug 2026 22:09:15 +0000 (00:09 +0200)]
Add valid single field tests
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sun Aug 9 04:06:52 2026
(Merged from https://github.com/openssl/openssl/pull/32181)
Greensi7 [Thu, 6 Aug 2026 14:42:37 +0000 (16:42 +0200)]
Run clang-format - chore
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sun Aug 9 04:06:46 2026
(Merged from https://github.com/openssl/openssl/pull/32181)
Greensi7 [Thu, 6 Aug 2026 14:05:37 +0000 (16:05 +0200)]
Add x509v3 duplicate field config tests
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sun Aug 9 04:06:42 2026
(Merged from https://github.com/openssl/openssl/pull/32181)
Greensi7 [Thu, 6 Aug 2026 13:33:27 +0000 (15:33 +0200)]
Reject duplicate fields in X509v3 config
Reject repeated fields in policyConstraints, basicConstraints
and basicAttConstraints instead of silently accepting the last value.
Assisted-by: ChatGPT:gpt-5.6 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sun Aug 9 04:06:37 2026
(Merged from https://github.com/openssl/openssl/pull/32181)
Greensi7 [Tue, 4 Aug 2026 17:52:50 +0000 (19:52 +0200)]
Fix memory leaks in x509v3 config handling
Duplicate integer value fields in the policyConstraints,
basicConstraints and basicAttConstraints extensions overwrite
previously allocated ASN1_INTEGER values without freeing them.
Found by : x509v3 fuzzer
Example 1: (crypto/x509/v3_pcons.c)
```
[default]
policyConstraints = requireExplicitPolicy:1,requireExplicitPolicy:2
```
Example 2: (crypto/x509/v3_bcons.c)
```
[default]
basicConstraints = pathlen:1,pathlen:2
```
Example 3: (crypto/x509/v3_battcons.c)
```
[default]
basicAttConstraints = pathlen:1,pathlen:2
``` Assisted-by: ChatGPT:gpt-5.6 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sun Aug 9 04:06:32 2026
(Merged from https://github.com/openssl/openssl/pull/32181)
Georgy Karataev [Tue, 4 Aug 2026 09:47:30 +0000 (11:47 +0200)]
ci: let the CI bot dispatch the compiler, merge and AVX512 zoos
These three only run after the fact: compiler-zoo and run-checker-merge on a
push, avx512-sde on a nightly cron. Their coverage therefore lands once a pull
request is already merged, which is when it is most expensive to act on.
Give all three the dispatch entry point the daily workflows already have:
validated pr/head_sha/check_run_id inputs, the run-name both services correlate
on, concurrency keyed on the pull request, and every checkout pinned to the
requested commit.
Existing behaviour is untouched. A push or a cron carries no inputs, so the
validator is skipped and each checkout falls back to github.sha -- the build jobs
still run on a push to a fork branch, the only pre-merge signal a contributor
gets here. The jitter library stays pinned to its release tag: a dispatched run
may choose the OpenSSL tree, never its dependencies.
Refs: openssl/project#2027
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Reviewed-by: Dmitry Misharov <dmitry@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sat Aug 8 15:34:06 2026
(Merged from https://github.com/openssl/openssl/pull/32174)
Georgy Karataev [Tue, 4 Aug 2026 09:47:03 +0000 (11:47 +0200)]
ci: name the second reader of the dispatch run-name
The run-name of a dispatched workflow is parsed by two services, not one: the CI
bot correlates a run with its check-run, and the Actions statistics collector
attributes CI load to the pull request that caused it. Neither validates the
string, so a mis-copied run-name is silent in both. The comment named only the
first reader, which understates what editing that line costs.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Reviewed-by: Dmitry Misharov <dmitry@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sat Aug 8 15:34:01 2026
(Merged from https://github.com/openssl/openssl/pull/32174)
Jakub Zelenka [Fri, 17 Jul 2026 17:20:38 +0000 (19:20 +0200)]
Add BIO bss_file test
Add a cmocka based unit test for the file BIO covering BIO_new_file,
BIO_new_fp and the file method callbacks, with stdio and openssl_fopen.
Additionally add a Windows-only Detours based side test for the
Windows specific branches.
Assisted-by: Claude:claude-fable-5 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sat Aug 8 15:26:34 2026
(Merged from https://github.com/openssl/openssl/pull/31991)
Acture [Fri, 27 Mar 2026 12:02:17 +0000 (20:02 +0800)]
Fix double-free of tlsmac in cipher dupctx implementations
Multiple cipher dupctx functions perform shallow copies (via
OPENSSL_memdup or *dctx = *sctx through IMPLEMENT_CIPHER_HW_COPYCTX)
without deep-copying the heap-allocated tlsmac buffer. When both the
original and duplicated contexts are freed, ossl_cipher_generic_reset_ctx
calls OPENSSL_free(ctx->tlsmac) twice on the same address.
Add ossl_cipher_generic_dupctx_tlsmac() as a centralized helper that
deep-copies tlsmac after any shallow dupctx copy. Apply it to all
affected implementations listed in #30548, plus cipher_aes_wrp and
cipher_chacha20 which had hand-rolled fixes that are now unified.
Fixes #30548
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
MergeDate: Sat Aug 8 15:12:21 2026
(Merged from https://github.com/openssl/openssl/pull/30603)
Viktor Dukhovni [Wed, 27 May 2026 11:51:56 +0000 (21:51 +1000)]
Expand and refactor test_evp_extra2
The "expand" part adds a algorithm-independent probe that walks every
gettable OSSL_PARAM of an EVP_PKEY in two passes -- first a size query,
then a real fetch. This is exercised for each algorithm. In the SM2
case it catches the gettable-params/getter type mismatch fixed in the
preceding commit: reverting that commit trips the probe for SM2.
The "refactor" part replaces the per-algorithm test code with a single
PKEY_TEST_SPEC table of (name, optional prefab DER, optional keygen
params), driven through pkey_from_spec(). The key-selection and
gettable tests no longer involve any algorithm-specific code.
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sat Aug 8 13:21:30 2026
(Merged from https://github.com/openssl/openssl/pull/30938)
Viktor Dukhovni [Wed, 22 Apr 2026 12:48:02 +0000 (22:48 +1000)]
Fix data type of SM2 EC_PUB_X/Y params
The provider's gettable-params list advertised types that didn't match
what the getter implementation supported, so fetching either coordinate
tripped "incompatible type". Nothing in-tree was asking; the follow-up
commit adds a test that detects the problem.
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Sat Aug 8 13:21:24 2026
(Merged from https://github.com/openssl/openssl/pull/30938)
Greensi7 [Tue, 4 Aug 2026 13:26:32 +0000 (15:26 +0200)]
Fix NULL dereference in v2i_AUTHORITY_KEYID()
X509V3_EXT_d2i() may return NULL on malformed input
or on allocation failure. v2i_AUTHORITY_KEYID() passed
that NULL to ASN1_STRING_length_ex() causing NULL dereference.
Found by x509v3 fuzzer. Example fuzzer input:
```
[default]
subjectKeyIdentifier = DER:05:00
authorityKeyIdentifier = keyid
```
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MergeDate: Fri Aug 7 13:42:59 2026
(Merged from https://github.com/openssl/openssl/pull/32177)
Billy Brumley [Tue, 4 Aug 2026 11:35:48 +0000 (07:35 -0400)]
Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs
At the EVP level, for AEADs EVP_Cipher(ctx, out, NULL, 0) performs
finalization. For consistency across AEADs (GCM, etc.), on decrypt it
must check the tag. OCB and ChaCha20-Poly1305 took an early exit on the
empty message (with or without AAD) and returned success without
checking, so a forged tag (with or without AAD) was accepted before this
change.
Follow-up to #31555
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Fri Aug 7 13:34:35 2026
(Merged from https://github.com/openssl/openssl/pull/32173)
Georgy Karataev [Tue, 4 Aug 2026 09:52:15 +0000 (11:52 +0200)]
ci: let the CI bot dispatch the platform, cross-compile, fuzzing and interop suites
These five suites only run nightly, so a break in a platform, a cross-compiled
target, a fuzzer or an interop peer is found the morning after it merged. Give
each the dispatch entry point the daily workflows already have, and adapt the
ones that assumed they only ever see their own default branch.
os-zoo's self-hosted legs (ppc64le, s390x, riscv64) are restricted to the
nightly cron and plain manual runs, keeping pull-request code off them; the
GitHub-hosted legs gain the repository guard the rest of the file already had.
The cross-compile suites' test steps, gated by event name, now also run on a
dispatch instead of silently skipping. oss-fuzz checks out the requested tree
so CIFuzz fuzzes it instead of the default branch. interop-tests skips
openssh_interop on a dispatch, since it never checks this repo out.
Refs: openssl/project#2027
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Fri Aug 7 13:31:12 2026
(Merged from https://github.com/openssl/openssl/pull/32175)
Adds test/recipes/80-test_tsget.t with 12 subtests covering:
- Default output extension (.tsr), custom extension (-e), custom output
file (-o), stdin input, debug mode (-d), TSGET environment variable
- Multiple input files processed in one invocation
- Output path derived from input file's directory
- HTTP server error response: tsget exits non-zero and removes the
partial output file
- Empty server response: same cleanup behaviour
- Argument validation: missing -h, multiple files combined with -o
Happy-path subtests use `openssl ts -verify` to confirm each response
is cryptographically valid against the TSA CA and signing certificate.
The mock HTTP server supports normal, error, and empty response modes
via keyword options so failure scenarios can be tested without a real
TSA endpoint.
Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:41 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
Add a progress() helper to centralise verbose output. Move usage()
to the top. Rename @old_argv to @saved_argv. Replace foreach with
for+lexical variable. Inline $output_base. Switch exists to defined
for option checks. Remove the main-program comment block.
Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:39 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
apps/tsget: use three-arg open and binmode for binary safety
Switch bareword INPUT filehandle to a lexical filehandle with
three-argument open. Add binmode on both the STDIN and file paths
so timestamp request data is read as raw bytes on all platforms.
Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:38 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
Add "use warnings" and wrap CURLOPT_RANDOM_FILE and CURLOPT_EGDSOCKET
setopt calls in eval blocks, as these constants were removed from
libcurl and would cause an exception on modern installations.
Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:37 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
apps/tsget: replace CURLOPT_UPLOAD with CURLOPT_POST
Switch from the UPLOAD+CUSTOMREQUEST+read-callback approach to
POSTFIELDS, eliminating the read_body/write_body callbacks and the
INFILE/INFILESIZE/FILE options. Rename get_timestamp to send_request
with a simpler interface that writes directly to the output file via
CURLOPT_WRITEDATA.
Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:36 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
apps/tsget: switch WWW::Curl::Easy to Net::Curl::Easy
Minimal module swap: replace WWW::Curl::Easy with Net::Curl::Easy.
Update callback signatures (Net::Curl passes the easy handle as the
first argument), replace error-code-based perform() with eval/die,
and drop cleanup() which Net::Curl does not require.
Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:35 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
Andrew Dinh [Tue, 4 Aug 2026 15:55:07 +0000 (22:55 +0700)]
fix module extension on non-.so platforms
pathed.cnf and nocache-and-default.cnf hardcoded "p_test.so", but
provider modules use the platform's DSO extension (e.g. .dylib on
macOS), so the file never existed there.
Convert both configs to build-time templates to
fill in the correct extension.
Update prov_config_test.c's presence check to use DSO_EXTENSION, and
have 30-test_prov_config.t read the generated build-tree file.
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Fri Aug 7 01:45:49 2026
(Merged from https://github.com/openssl/openssl/pull/32192)
Mounir IDRASSI [Thu, 6 Aug 2026 11:07:43 +0000 (20:07 +0900)]
.github/workflows/ci-doc-changes.yml: pin mdl to 0.17.0
mdl 0.18.0 loads URI::RFC2396_PARSER before linting. The uri 0.12.x
version on ubuntu-latest does not define that constant, so md-nits
fails for every PR.
Pin the last known-good mdl release until the upstream regression
is fixed:
https://github.com/markdownlint/markdownlint/issues/605
Reviewed-by: Dmitry Misharov <dmitry@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Aug 6 14:56:37 2026
(Merged from https://github.com/openssl/openssl/pull/32230)
Mounir IDRASSI [Sat, 6 Jun 2026 13:08:42 +0000 (22:08 +0900)]
Reject TLS 1.3 early data when PSK ciphersuite differs
TLS 1.3 PSK resumption can use any ciphersuite with the same hash, but 0-RTT
acceptance requires the selected ciphersuite to match the one associated with
the selected PSK.
Keep same-hash PSK resumption working and reject only early data on a
ciphersuite mismatch. Document the user-visible fix in CHANGES.md.
Also updated RFC8446 references in ssl/*.[ch] code comments to corresponding
RFC9846 locations.
Fixes #31803
Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Aug 5 08:16:57 2026
(Merged from https://github.com/openssl/openssl/pull/32032)
Mounir IDRASSI [Mon, 3 Aug 2026 13:47:08 +0000 (22:47 +0900)]
ssl: Remove shadowed variable in write retry path
Commit 5f3db0d81132 "Fix false success on zero BIO write" introduced
a function-scope left variable while the app-buffer recovery block
already declared one. This breaks builds using -Werror=shadow.
Assign the current buffer length to the existing function-scope variable
in the recovery block. This preserves the previous re-read at that point
while eliminating the shadowed declaration.
Fixes: 5f3db0d81132 "Fix false success on zero BIO write" Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Aug 3 15:46:22 2026
(Merged from https://github.com/openssl/openssl/pull/32153)
The TLS record layer treated BIO_write returning 0 as success unless
the BIO retry flag was set. For a write with data pending in the write
buffer, this could report success to the application while leaving record
data pending internally.
Capture the pending buffer length before the transport write. If a
positive length write returns zero, return retry when the BIO retry flag
is set and fatal otherwise. Do not queue an SSL reason for the fatal
zero-without-retry case: a custom BIO can return zero without retry
without this implying an SSL library or protocol error, so SSL_get_error()
reports SSL_ERROR_SYSCALL with an empty error queue.
Preserve the KTLS empty fragment case where the pending length is already
zero and a zero byte write is expected to succeed.
For DTLS, the same zero return without retry condition is now treated as
fatal; the failed buffer is still dropped in the existing DTLS write error
path. This intentionally tightens the previous behavior, which could treat
the zero return as success.
Add regression coverage with a custom BIO that returns 0 without setting
retry for a positive length write.
Fixes #31009
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Mon Aug 3 12:37:56 2026
(Merged from https://github.com/openssl/openssl/pull/31021)
Nikola Pajkovsky [Wed, 22 Jul 2026 05:37:25 +0000 (07:37 +0200)]
quic: use @-style Doxygen tags in ossl_quic_srtm_remove doc comment
Convert the doc comment for ossl_quic_srtm_remove() from backslash-style
Doxygen tags (\brief, \param, \return) to the @-style equivalents
(@brief, @param, @returns), matching the STYLE.md convention.
Complements: 63afe639141f "quic: report SRTM entry match status via an output argument" Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Aug 3 12:03:18 2026
(Merged from https://github.com/openssl/openssl/pull/32037)
Todd Short [Fri, 17 Jul 2026 17:35:56 +0000 (13:35 -0400)]
CMS/PKCS7: use EVP_CIPHER_fetch() for SMIMECapabilities
Fixes #25919
Replace EVP_get_cipherbynid()/EVP_get_digestbynid() with
EVP_CIPHER_fetch()/EVP_MD_fetch() when building SMIMECapabilities
attributes, so that only algorithms available in the active providers
are advertised. This prevents RC2, DES, and GOST from appearing by
default when only the default provider is loaded.
Add CMS_add_standard_smimecap_ex() as a provider-aware replacement
for the newly-deprecated CMS_add_standard_smimecap().
Adds missing documention and new unit-tests validating the new behavior.
Signed-off-by: Todd Short <todd.short@me.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Mon Aug 3 07:06:44 2026
(Merged from https://github.com/openssl/openssl/pull/31990)
Mounir IDRASSI [Mon, 29 Jun 2026 07:00:00 +0000 (16:00 +0900)]
x509: fix OCSP BasicResponse leak in in-verify check
In check_cert_ocsp_resp(), OCSP_response_get1_basic() returns an owning
OCSP_BASICRESP. The combined-condition early return on
OCSP_resp_count(bs) < 1 bypassed the end: cleanup label, leaking bs when
a stapled OCSP response decoded to a BasicResponse with no single
responses.
Separate the count check from the acquisition and route the empty case
through end: (ret = X509_V_ERR_OCSP_NO_RESPONSE; goto end;) so bs is
freed while preserving the previous return value. Reachable only with
the non-default X509_V_FLAG_OCSP_RESP_CHECK with peer-supplied (e.g.
TLS 1.3 stapled) responses.
Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Aug 3 07:02:30 2026
(Merged from https://github.com/openssl/openssl/pull/31764)
Jakub Zelenka [Fri, 10 Jul 2026 18:53:16 +0000 (20:53 +0200)]
quic-radix: add thread-assisted idle keepalive test
Add a radix vignette covering thread-assisted mode: with the client's
per-op ticking disabled, only its assist thread can act on the
connection, so skipping the virtual time past the idle timeout keeps the
server up only if the assist thread keeps sending keepalives. This
migrates the thread-assisted idle coverage away from the
QUIC_TSERVER-based test.
The client is created with OSSL_QUIC_client_thread_method() so the
method itself stays covered as well. The client and listener are linked
with an in-memory datagram BIO pair instead of real UDP sockets, so
keepalive delivery cannot race the virtual clock in the OS UDP path.
New ops: hf_set_tick_active (enable/disable per-op ticking),
hf_skip_time_wait (skip virtual time, wake the assist thread and wait
for it to catch up), hf_expect_connected, and hf_link_dgram_pair.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Mon Aug 3 02:12:44 2026
(Merged from https://github.com/openssl/openssl/pull/31918)
Its happening because, recently we made some fixes to account for
providers that request no-caching fetches, which all seems to work
reasonably well.
Except for the corner case oqs recently exposed, in which the provider
may request the caching of some algorithms, but not others. When this
occurs, the core libcrypto creates a temporary store for those
requested, but stored the cachable ones in the libctx store.
inner_evp_generic_fetch treats the presence of an allocated tmp store as
implying that all algorithms fetched are non-cacheable, even if some
are. The result is that, for those cacheable items, they also get
treated as non-cacheable, missing the extra ref count taken when they
are added to the method store cache. As a result, they get freed while
still in use, and you get the issue referenced above.
Instead of assuming that a tmp_store means all algorithms are
non-cacheable, instead, try to look the method up in the tmp_store
cache, and cache it if its not found (i.e. its not in the temp store)
Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sat Aug 1 14:30:49 2026
(Merged from https://github.com/openssl/openssl/pull/32077)
Andrew Dinh [Sat, 18 Jul 2026 12:43:18 +0000 (19:43 +0700)]
Port script_29
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Sat Aug 1 12:44:59 2026
(Merged from https://github.com/openssl/openssl/pull/32023)
Andrew Dinh [Sat, 18 Jul 2026 12:32:08 +0000 (19:32 +0700)]
Port script_28
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Sat Aug 1 12:44:55 2026
(Merged from https://github.com/openssl/openssl/pull/32023)
Andrew Dinh [Sat, 18 Jul 2026 12:26:01 +0000 (19:26 +0700)]
Port script_27
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Sat Aug 1 12:44:48 2026
(Merged from https://github.com/openssl/openssl/pull/32023)
Andrew Dinh [Sat, 18 Jul 2026 12:16:53 +0000 (19:16 +0700)]
Port script_26
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Sat Aug 1 12:44:41 2026
(Merged from https://github.com/openssl/openssl/pull/32023)
Andrew Dinh [Sat, 18 Jul 2026 11:56:23 +0000 (18:56 +0700)]
Port script_25
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Sat Aug 1 12:44:36 2026
(Merged from https://github.com/openssl/openssl/pull/32023)
doc/man7/openssl-env.pod: fix and augment OPENSSL_RUNNING_UNIT_TESTS description
Commit 619a0fe71825 "Fix unit tests when run under fuzz builds"
not just inserted a new entry, that describes OPENSSL_RUNNING_UNIT_TESTS
environment variable, out of the lexicographical order, but did so
in the middle of the OPENSSL_TRACE environment variable description;
also, it contained formatting that is not valid POD syntax, for some
reason ("`make test`").
Move the item to a correct place, correct the formatting, typos,
and add missing essential information about applicability
and security considerations.
Fixes: 619a0fe71825 "Fix unit tests when run under fuzz builds" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sat Aug 1 03:03:42 2026
(Merged from https://github.com/openssl/openssl/pull/31973)
Fix encrypt decrypt fetch for cms from privoder side
For algorithms without NID (without registration via the engine), cms_enc attempts to fetch via OBJ_obj2txt.
passing cipher instead of NULL in EVP_PKEY_CTX_ctrl in apps/cms.c
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Sat Aug 1 03:02:06 2026
(Merged from https://github.com/openssl/openssl/pull/31512)
Add CHANGES.md entry for AES-CBC AVX-512/VAES decryption
Document the AVX-512 and VAES optimizations for AES-CBC decryption,
which improve decryption performance for large inputs (1024 bytes or
more) by 3.5x to 3.8x.
Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Fri Jul 31 16:33:42 2026
(Merged from https://github.com/openssl/openssl/pull/30902)
Implement an AVX-512 VAES-based bulk path for AES-CBC decryption that
processes multiple blocks in parallel, improving decryption performance
for large inputs (1024 bytes or more) by 3.5x to 3.8x.
- Add the VAES CBC decrypt intrinsic implementation
(crypto/aes/aes_cbc_vaes_intrinsic.c) and wire it into the AES-NI
provider cipher path.
- Centralize the VAES_CBC_ELIGIBLE eligibility guard in
include/crypto/aes_platform.h to keep the header and implementation in
sync, and drop the redundant AES_BLOCK_SIZE define.
- Guard the intrinsics with refined gcc, clang, and msvc compiler-version
checks, ensuring clean builds in no-asm, no-deprecated, and Windows
(shared/minimal) configurations.
- Add an EVP-level AES-CBC decrypt test exercising the VAES bulk path
across AES-128/192/256 and a range of input lengths.
Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Fri Jul 31 16:33:35 2026
(Merged from https://github.com/openssl/openssl/pull/30902)
The Visual Studio 2013 CRT does not support the C99 z, t and j length modifiers. Passing such formats to _vsnprintf_s invokes the invalid-parameter path and normally terminates the process.
For _MSC_VER < 1900, translate z and t to the pointer-sized I modifier and j to I64 before calling the CRT. Allocate a translated format only when needed, leaving newer MSVC versions and unaffected formats unchanged. Delegate BIO_snprintf to BIO_vsnprintf so all BIO formatting entry points use the same compatibility path.
Add focused coverage for BIO_snprintf, BIO_vsnprintf and BIO_printf, including the large-output allocation path and truncation behavior.
Fixes #31645
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 31 13:13:06 2026
(Merged from https://github.com/openssl/openssl/pull/31988)
Visual Studio 2013 does not provide the C99 __func__ predefined identifier in C mode. Use OPENSSL_FUNC, which maps to the compiler-supported equivalent.
This is the only source change required to compile current master with VS2013 Update 5 (cl 18.00.40629), on both x86 and x64.
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Fri Jul 31 13:13:04 2026
(Merged from https://github.com/openssl/openssl/pull/31988)
Bob Beck [Thu, 16 Jul 2026 13:30:27 +0000 (15:30 +0200)]
Rework v3nametest for SAN-first matching, add flag and long-name coverage
Drive the match matrix primarily through SAN dNSName/rfc822Name rather
than subject CN/emailAddress (subject setters cut to one each, decoy
multi-SAN variants added). Add explicit coverage of ALWAYS/NEVER_CHECK_
SUBJECT and the non-matching-SAN-plus-matching-subject case, and a
long-name test for the 64/68-byte dNSName boundary and truncation guards.
Test only; no behavioural change.
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Thu Jul 30 09:11:28 2026
(Merged from https://github.com/openssl/openssl/pull/31981)
Despite the -quiet option s_client still reports the host it connects to
and the certificate chain. Since -quiet is documented as "No s_client
output", hide all non-error output.
Pass the quiet option to init_client() to suppress the host output.
Set verify's quiet flag if quiet is passed.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 30 09:09:35 2026
(Merged from https://github.com/openssl/openssl/pull/30519)
Jakub Zelenka [Wed, 22 Jul 2026 19:24:57 +0000 (21:24 +0200)]
apps: test pkey -inform and -outform handling
Add test recipe subtests for the pkey app format options: the public key
PEM/DER round-trip, format detection when -inform is omitted, rejection of
a mismatching -inform, the restriction of -outform to PEM and DER, and
reading a private key from a PKCS#12 file with -inform P12.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 30 08:54:04 2026
(Merged from https://github.com/openssl/openssl/pull/32049)
Jakub Zelenka [Thu, 23 Jul 2026 21:44:56 +0000 (23:44 +0200)]
apps: test ec -check key consistency reporting
Add a test recipe subtest checking that 'openssl ec -check' reports a
valid key and an invalid one, using a new data file that combines the
testec-p256.pem private scalar with the group generator as the public
key, so it loads but fails the pairwise consistency check.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Jul 30 08:53:23 2026
(Merged from https://github.com/openssl/openssl/pull/32059)
Mounir IDRASSI [Sat, 27 Jun 2026 02:39:18 +0000 (11:39 +0900)]
test/strtoultest: add coverage for ossl_strtol, ossl_strtoint and test_strtoint
Add direct unit tests for the three conversion helpers introduced to
replace atoi()/atol():
- ossl_strtol: signed parse, including negative values, LONG_MIN/MAX
boundaries, ERANGE on overflow, no-consumption and NULL-endptr
full-consumption rules, NULL result/str, and the internal errno reset;
- ossl_strtoint: narrowing to int (INT_MIN/MAX pass, +/-1 fail), long
overflow, plus a NULL result;
- test_strtoint: the test-util helper wrapping OPENSSL_strtoul(),
covering negative rejection, trailing-garbage rejection, empty input,
int and unsigned overflow, and the INT_MAX boundary.
Link strtoultest against the static libcrypto.a instead of the shared
library, since the internal ossl_* symbols are not exported (the version
script hides them with local: *).
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 17:02:19 2026
(Merged from https://github.com/openssl/openssl/pull/31731)
Mounir IDRASSI [Thu, 25 Jun 2026 13:09:30 +0000 (22:09 +0900)]
Remove remaining atoi()/atol() calls
Remove the remaining direct atoi()/atol() uses across apps, libcrypto,
libssl, providers, demos and tests, and route the replacements through
checked helpers instead of open-coding the conversion at each call site:
- apps use the existing opt_int()/opt_long()/opt_int_arg() parsers;
- libcrypto and provider code use the new internal ossl_strtol()/
ossl_strtoint() helpers, a checked (and, for ossl_strtoint(),
narrowing) signed counterpart to the public OPENSSL_strtoul();
- libssl, demos and tests use OPENSSL_strtoul(); the test code shares
a single test_strtoint() helper rather than repeating the bound check
and cast per file;
- unsigned values use OPENSSL_strtoul(), with call-site-specific range
checks before narrowing where the destination type requires it.
Reject conversion failures and narrow through the helpers rather than
acting on garbage, and preserve the signed RSA-PSS saltlen sentinels
while rejecting invalid numeric strings. Add regression coverage for the
invalid RSA-PSS saltlen string path.
Fixes #8216
Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 17:02:18 2026
(Merged from https://github.com/openssl/openssl/pull/31731)
The internal provider test can retain provider-init allocations
when the Valgrind suppression workflow intentionally skips OPENSSL_cleanup().
Its stack calls OSSL_provider_init directly from provider_activate, without
the provider_init frame covered by the existing suppression.
Add a second exact suppression for that stack shape instead of broadening the
existing block with an ellipsis.
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 16:58:17 2026
(Merged from https://github.com/openssl/openssl/pull/32094)
Jakub Zelenka [Thu, 23 Jul 2026 22:02:53 +0000 (00:02 +0200)]
apps: test ecparam -inform, -outform and -conv_form handling
Add test recipe subtests for the ecparam format options: the PEM/DER
parameter roundtrip, rejection of DER input without -inform as the input
format defaults to PEM, the restriction of -outform to PEM and DER, and
the -conv_form selection of the generator point encoding in explicit
parameters including that it has no effect on named curve parameters.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 29 16:55:11 2026
(Merged from https://github.com/openssl/openssl/pull/32061)
Abel Thomas [Wed, 8 Jul 2026 08:19:40 +0000 (10:19 +0200)]
pkcs7_test: disable time checks in pkcs7_verify_test
The test certificate has a hardcoded validity period, making
`pkcs7_verify_test` fail when run under a faketime outside that
window. Set `X509_V_FLAG_NO_CHECK_TIME` on the store so verification
no longer depends on the system clock.
Fixes #31788
Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 29 16:54:09 2026
(Merged from https://github.com/openssl/openssl/pull/31890)
Abel Thomas [Thu, 9 Jul 2026 12:22:50 +0000 (14:22 +0200)]
pkcs7: null-guard enveloped and signedAndEnveloped arms in PKCS7_stream
Dereferences of `p7->d.enveloped->enc_data` and
`p7->d.signed_and_enveloped->enc_data` crash with UBSan when the union
member is NULL after parsing a minimal/malformed input. Mirror the guard
added for the signed arm in PR #30351.
Added unit-tests to validate the change.
Fixes: #31682 Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Wed Jul 29 16:51:46 2026
(Merged from https://github.com/openssl/openssl/pull/31716)
Mounir IDRASSI [Sun, 7 Jun 2026 06:33:43 +0000 (15:33 +0900)]
Fix CMS Ed448 signer NULL digest handling
Reject ossl_cms_adjust_md() failures unconditionally in
CMS_add1_signer(), so unsupported Ed448 signing with signed attributes
fails cleanly instead of passing a NULL digest to X509_ALGOR_set_md().
Add a defensive NULL digest check to X509_ALGOR_set_md(), and cover
the CMS Ed448 signed-attributes/no-attributes cases plus the low-level
NULL digest path in regression tests.
Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 16:49:57 2026
(Merged from https://github.com/openssl/openssl/pull/31409)
Andrew Dinh [Fri, 24 Jul 2026 06:37:46 +0000 (13:37 +0700)]
Fix mutcbk_inject_frames after mutation
mutcbk_inject_frames returned 0 once its one-time mutation was applied, which
tells the QTX the packet send failed and tears down the connection instead of
continuing the test with unmutated packets. Now it passes subsequent packets
through unmodified by returning the input header, iovec, and count unchanged.
Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 29 14:00:23 2026
(Merged from https://github.com/openssl/openssl/pull/32065)
Jakub Zelenka [Wed, 15 Jul 2026 10:20:03 +0000 (12:20 +0200)]
cms: fix AuthenticatedData authAttrs and unauthAttrs element type
The CMS_AuthenticatedData ASN.1 template declared the authAttrs and
unauthAttrs fields as X509_ALGOR, whereas per RFC 5652 section 9.1 they
are [2] and [3] IMPLICIT SET OF Attribute and the CMS_AuthenticatedData
structure already declares them as STACK_OF(X509_ATTRIBUTE). The implicit
tags [2] and [3] were already correct, so only the element type was wrong.
An Attribute (SEQUENCE { type, SET OF value }) is structurally accepted as
an AlgorithmIdentifier (SEQUENCE { algorithm, ANY OPTIONAL }), so parsing
did not fail; the attributes were merely misinterpreted, e.g. cms -cmsout
-print rendered them as algorithm/parameter instead of decoding them as
attributes. Use X509_ATTRIBUTE with the existing tags so the template
matches the structure.
Add a parse test using a BouncyCastle-generated AuthenticatedData message
carrying an authenticated and an unauthenticated attribute, asserting both
are decoded as SET OF Attribute.
Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jul 29 10:02:08 2026
(Merged from https://github.com/openssl/openssl/pull/31960)
SSL_set_bio() transfers ownership of cbio to the client SSL object.
Clear the local pointer after the handoff so the error path does not
release an SSL-owned reference before SSL_free().
Fixes #32084
Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Wed Jul 29 09:55:13 2026
(Merged from https://github.com/openssl/openssl/pull/32086)
Matt Caswell [Fri, 26 Jun 2026 08:36:25 +0000 (09:36 +0100)]
test: add regression test for SSL_poll() abort_blocking handling
The race fixed by the previous commit (an item becoming ready in the
window between poll_translate() registering it for cross-thread
notification and the OS-level poll) is normally vanishingly narrow and
not practical to hit by timing alone in a test.
Add ossl_quic_poll_translate_test_step_cb, a test-only instrumentation
hook (always NULL in production use) that poll_translate() calls between
translating consecutive items. This lets a test deterministically make
one item ready while an earlier item's blocking section is still
entered, exercising the abort_blocking path on demand.
Add the poll_abort_blocking RADIX script/test, which uses the hook to
trigger this on two independent QUIC connections (so the second item's
reactor is provably distinct from the first's) and checks that
SSL_poll() reports success and that the first item's blocking-section
entry is correctly balanced afterwards.
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Wed Jul 29 07:20:33 2026
(Merged from https://github.com/openssl/openssl/pull/31743)
Matt Caswell [Thu, 25 Jun 2026 16:15:16 +0000 (17:15 +0100)]
SSL_poll: fix abort_blocking mishandling in poll_translate()/poll_block()
When SSL_poll() has to block, poll_translate() registers each item's QUIC
connection for cross-thread notification one item at a time. If an item
turns out to already be ready right as it is being registered, translation
sets abort_blocking and is meant to bail out so the caller retries the
readout instead of actually blocking.
Two bugs in that abort path:
- poll_translate() returned immediately on abort_blocking without calling
postpoll_translation_cleanup() for any earlier items that had already
had their blocking section entered. Those items' enter/leave calls were
left unbalanced, leaking into the QUIC reactor's blocking-waiter count.
Fixed by routing through the existing "out" cleanup label, mirroring
what the FAIL_ITEM()/error path already does for items 0..i-1.
- poll_block() initializes ok = 0 and only ever sets it on the actual
poll() success path. The abort_blocking branch jumped straight to "out"
without setting ok, so SSL_poll() reported failure even though nothing
actually went wrong; the caller's retry loop never got a chance to pick
up the now-ready item.
Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Wed Jul 29 07:20:31 2026
(Merged from https://github.com/openssl/openssl/pull/31743)
dannyward630 [Mon, 15 Jun 2026 17:46:57 +0000 (19:46 +0200)]
Document trailing data handling for DER input
Commands that read a single DER object may stop after decoding that object and leave trailing input unchecked. Document that successful decoding is therefore not a full-input validity check.
Fixes #31495
CLA: trivial
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation> Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/31524)
test: fix flaky -md and -iter mismatch checks in 20-test_enc.t
The subtests added in f26d632a0e assert that "openssl enc -d" exits
non-zero when the key derivation parameters do not match. enc has no
MAC, so a wrong key is not detectable as such; the only signal is
whether the garbage happens to form valid PKCS#7 padding, which
openssl-enc(1) documents as passing better than one time in 256. With
a random salt the tests thus failed about 0.4% of the time.
Assert instead that mismatching parameters do not recover the
plaintext: the decryption must either fail or produce differing output.
Jakub Zelenka [Thu, 16 Jul 2026 08:02:21 +0000 (10:02 +0200)]
apps: drop invalid trust setting in check_cert_might_be_valid()
check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with
X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid
trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and
left that error on the error stack, which was then printed via
ERR_print_errors() for every certificate loaded by the x509 app, even on
success.
The intended liberal behavior is already provided by X509_PURPOSE_ANY and
by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call.
Add a test checking that printing certificate info emits nothing on stderr.
Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Ryan Hooper <ryanh@openssl.foundation>
MergeDate: Mon Jul 27 11:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31968)
EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD
and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value,
so the "< 0" checks on the cipher-with-MAC path cannot detect any
failure. A return of 0 means a failed or unsupported control, or
for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is
usable here.
Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG
check fixed by commit 674c23d2656e in this function.
Follow-up to https://github.com/openssl/openssl/pull/30923.
Fixes: ea0add4a8227 "New GOST PKCS12 standard support"
CLA: trivial
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Mon Jul 27 10:21:13 2026
(Merged from https://github.com/openssl/openssl/pull/31848)
projects / thirdparty / openssl.git / log
