openssl, branch openssl-3.4

CI: give the cross-compile matrix jobs stable names

2026-10-21T16:53:44Z

GitHub names a matrix job after all its matrix values and cuts the name at 100 characters, so the aarch64 and riscv legs report identical names. Nothing reading job results by name can then tell whether every leg ran or which one failed. Name the jobs after a short per-entry label instead, as interop-tests.yml already does. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Neil Horman Reviewed-by: Bob Beck Merge-date: Wed Oct 21 16:48:12 2026 Merged-from: https://github.com/openssl/openssl/pull/33121 (cherry picked from commit 4fe51b0ad523d1863533b2c1f395ace6bf06fddf)

chore(bump): update FreeBSD image

2026-10-19T13:17:27Z

This is being done to help reduce OS maintainer burden as well as OpenSSL developer burden by using a version of FreeBSD which is currently supported by the project. This change updates FreeBSD from 13.4-RELEASE (an EOL release) to 14.4-RELEASE (a close to EOL release, but at the very least supported). Once 15.2-RELEASE is made available, this project should cut over to that version. Original-Commit: e4653f59eeea "chore(bump): update FreeBSD and OpenBSD images" Original-PR: https://github.com/openssl/openssl/pull/31840 Signed-off-by: Enji Cooper Reviewed-by: Nikola Pajkovsky Reviewed-by: Dmitry Belyavskiy Reviewed-by: Eugene Syromiatnikov Merge-date: Mon Oct 19 13:14:35 2026 Merged-from: https://github.com/openssl/openssl/pull/33248 (cherry picked from commit 951ce8ad0f983345008ca68aeb5f0dfce767d7ba)

chore(bump): update cross-platform-actions/action to v1.5.0

2026-10-19T13:17:22Z

Original-Commit: eacf272ea86a "chore(bump): update cross-platform-actions/action to v1.5.0" Original-PR: https://github.com/openssl/openssl/pull/31840 Signed-off-by: Enji Cooper Reviewed-by: Nikola Pajkovsky Reviewed-by: Dmitry Belyavskiy Reviewed-by: Eugene Syromiatnikov Merge-date: Mon Oct 19 13:14:34 2026 Merged-from: https://github.com/openssl/openssl/pull/33248 (cherry picked from commit 8937b8b2faae6eacdea58aeaabeedd5833b981fb)

doc/man3/EC_GROUP_new.pod: document EC_GROUP_get_ecpkparameters function

2026-10-18T15:40:31Z

Added EC_GROUP_get_ecpkparameters() function description and usage details. Complements: 60b350a3ef96 "RT3676: Expose ECgroup i2d functions" Reviewed-by: Jakub Zelenka Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Eugene Syromiatnikov Merge-date: Sun Oct 18 15:26:52 2026 Merged-from: https://github.com/openssl/openssl/pull/32169 (cherry picked from commit f7b2254eeebdc68bd4e57a3147606590b8188ab1)

Fix use-after-free in EC_GROUP_get_ecpkparameters()

2026-10-18T15:40:29Z

When a caller-supplied ECPKPARAMETERS object is passed in, the CHOICE member it already holds is released on entry, but the union pointer was left untouched. If a later step then failed, the error exit called ECPKPARAMETERS_free() on that object, which followed the still valid selector and freed the already released member a second time. Clear the pointer once it has been released, so that the error exit has nothing left to free. This does not change the fact that a caller supplied object is freed on error. That behaviour differs from the sibling function EC_GROUP_get_ecparameters(), which only frees the object it allocated itself, but it is left as-is here. The new test only fails on a sanitizer build; the ECPKPARAMETERS layout is private to ec_asn1.c, so the state cannot be inspected directly. The regression test and the pull request description were written with AI assistance. Fixes: 012c86ab74ae "move ECC ASN1 that is not specific to ECDSA into crypto/ec/, and make some appropriate changes to the EC library." Co-authored-by: Jakub Zelenka Assisted-by: Claude:claude-fable-5 Reviewed-by: Jakub Zelenka Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Eugene Syromiatnikov Merge-date: Sun Oct 18 15:26:51 2026 Merged-from: https://github.com/openssl/openssl/pull/32169 (cherry picked from commit 4c49f3f1103fc731cf1ec64fec5b744fa031241e)

test/cmp_vfy_test.c: prevent memory leak in test_msg_check_update_malicious_sender

2026-10-15T12:04:42Z

In test_msg_check_update_malicious_sender(), expected and actual were allocated via X509_NAME_new() prior to SETUP_TEST_FIXTURE(). If set_up() failed, SETUP_TEST_FIXTURE() returned early, leaking both allocated X509_NAME objects. Defer allocation until after SETUP_TEST_FIXTURE(), initialize both pointers to NULL, and allocate them safely within the TEST_ptr() validation chain. On setup or validation failure, both pointers and the test fixture are freed cleanly. Resolves: https://github.com/openssl/openssl/issues/33200 Fixes: 196a4b978499 "Add test for CVE-2026-63073" CLA: trivial Signed-off-by: jdymitarai Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Merge-date: Thu Oct 15 11:51:16 2026 Merged-from: https://github.com/openssl/openssl/pull/33203 (cherry picked from commit 6d76833d61fad07a171219d9cb1444bc37f88b8f)

Fix set but unsued variable in lib/opt.c

2026-10-12T08:02:08Z

https://github.com/openssl/openssl/actions/runs/34494520852/job/102982686286 CI is failing because we have a varaible in opt.c that is set but never used. Just remove it. Reviewed-by: Andrew Dinh Reviewed-by: Frederik Wedel-Heinen MergeDate: Sat Sep 12 13:18:16 2026 Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merged-from: https://github.com/openssl/openssl/pull/33194 (cherry picked from commit eadfce0e20dafd9a9bc8232caf84c4c9498ea667)

Correct PEM X509 docs regarding TRUSTED CERTIFICATE blocks

2026-10-11T21:44:05Z

The documentation stated that the X509 PEM functions also process trusted certificates, discarding the trust settings. In fact, they reject "TRUSTED CERTIFICATE" blocks; only the X509_AUX functions accept them. Update the text accordingly. Resolves: https://github.com/openssl/openssl/issues/33019 CLA: trivial Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Merge-date: Sun Oct 11 21:31:53 2026 Merged-from: https://github.com/openssl/openssl/pull/33166 (cherry picked from commit 22d309a11839d7c505af63c54880e657fc4bab5c)

cipher_aes_gcm_hw_vaes_avx512.inc: fix linux-x32 build failure

2026-10-09T22:49:30Z

The VAES GCM code is enabled by an ISA check (__x86_64__ & co), which the x32 ABI satisfies: x32 is a 64-bit platform with a 32-bit size_t. There, comparing the size_t ivlen against 2^61 is always false, which -Wtype-limits (via --strict-warnings) turns into a build failure. Only perform the check where size_t is wide enough to violate the limit. Fixes: 63b996e752ac "AES-GCM enabled with AVX512 vAES and vPCLMULQDQ." Assisted-by: Pi:moonshotai/kimi-k3 Reviewed-by: Matt Caswell Reviewed-by: Eugene Syromiatnikov Merge-date: Fri Oct 9 22:32:44 2026 Merged-from: https://github.com/openssl/openssl/pull/32926 (cherry picked from commit 04c2d1b7b37148808b5cdc9c2c029b2e9f13a783)

CONF: reject a NUL list separator in CONF_parse_list()

2026-10-09T21:38:29Z

CONF_parse_list() treated any integer separator that converts to NUL as a match for the input string terminator. After processing the final element, the loop advanced beyond the input and searched from that invalid pointer on the next iteration. Reject every NUL-equivalent separator before parsing and raise ERR_R_PASSED_INVALID_ARGUMENT. Add a regression test that verifies the direct NUL value and positive/negative integer aliases, confirms that no callback is invoked, checks the error queue, and checks that normal comma-separated parsing keeps working as expected. Resolves: https://github.com/openssl/openssl/issues/32667 Fixes: df5eaa8a5297 "default_algorithms option in ENGINE config." Reported-by: x-ray-z Assisted-by: OpenAI Codex:gpt-5.6-sol Reviewed-by: Mounir Idrassi Reviewed-by: Daniel Kubec Reviewed-by: Eugene Syromiatnikov Merge-date: Fri Oct 9 21:25:58 2026 Merged-from: https://github.com/openssl/openssl/pull/32684 (cherry picked from commit a502c66ce4d8784c2a1f3c195fd876f19fbe8392)