openssl/apps/lib, branch master

apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()

2026-10-24T09:42:53Z

The issuer and the serialNumber are independently OPTIONAL in a CertTemplate. A component absent from the request cannot confirm a match with the reference cert, and ASN1_INTEGER_cmp() does not accept NULL, so require each component the reference cert has to be present in the request and to be equal. Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests" References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()" Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:19 2026 Merged-from: https://github.com/openssl/openssl/pull/33071

Fix set but unsued variable in lib/opt.c

2026-09-12T13:18:09Z

https://github.com/openssl/openssl/actions/runs/34494520852/job/102982686286 CI is failing because we have a varaible in opt.c that is set but never used. Just remove it. Reviewed-by: Andrew Dinh Reviewed-by: Frederik Wedel-Heinen MergeDate: Sat Sep 12 13:18:16 2026 (Merged from https://github.com/openssl/openssl/pull/32787)

Copyright year updates

2026-09-09T13:12:46Z

Reviewed-by: Daniel Kubec Reviewed-by: Eugene Syromiatnikov Merge-date: Wed Sep 9 13:12:46 2026 Release: yes

Don't treat a CRL distribution point URI as a NUL terminated string

2026-08-27T13:52:18Z

get_dp_url() returned the internal ASN1_STRING data of a DIST_POINT URI directly. That data has an explicit length and is not necessarily NUL terminated, yet load_crl() and the HTTP client it hands the URI to consume it as a C string, reading past the buffer for a certificate carrying a primitive-form IA5String URI in its CRL distribution points. Return an allocated NUL terminated copy of the URI and free it in load_crl_crldp(). Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Nikola Pajkovsky Merge-date: Thu Aug 27 13:52:39 2026 Merged-from: https://github.com/openssl/openssl/pull/32178

Replace strlen-then-snprintf preconditions with snprintf-return

2026-08-26T16:20:02Z

This restructureis the apps/lib/apps.c file-rotation helpers to use snprintf for truncation detection, since they now can. This also collapses the per-snprintf VMS ifdef into one SUFFIX_SEP macro because the ifdef-per-call shape was making my eyes bleed from all the copypasta'ed snprintf lines with only one character changed in the format string. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh MergeDate: Wed Aug 26 16:20:32 2026 (Merged from https://github.com/openssl/openssl/pull/31640)

Replace strlen-then-snprintf pattern in save_serial() with a single truncation check.

2026-08-26T16:20:02Z

This used to be necessary because BIO_snprintf() could not detect truncation but now this is silly, and this ends up tripping GCC's -Wformat-truncation Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh MergeDate: Wed Aug 26 16:20:30 2026 (Merged from https://github.com/openssl/openssl/pull/31640)

Convert BIO_snprintf() usage in describe_param_type()

2026-08-26T16:20:02Z

This adds the correct truncation check for snprintf() to each block that advances the index. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh MergeDate: Wed Aug 26 16:20:14 2026 (Merged from https://github.com/openssl/openssl/pull/31640)

Convert BIO_snprintf() callers whose existing checks already work

2026-08-26T16:20:02Z

under snprintf semantics. These call sites already guarded the result with the C99 truncation idiom, so they can simply use snprintf as a replacement as is. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh MergeDate: Wed Aug 26 16:20:09 2026 (Merged from https://github.com/openssl/openssl/pull/31640)

Convert BIO_snprintf() callers that ignore the return value to snprintf().

2026-08-26T16:20:02Z

Where the return value is discarded, BIO_snprintf() and snprintf() are interchangeable: both write the same bytes and NUL-terminate the buffer. The conversion is mechanical. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh MergeDate: Wed Aug 26 16:20:07 2026 (Merged from https://github.com/openssl/openssl/pull/31640)

Add a build target for MSVC 2013

2026-08-26T16:20:02Z

Apparently it is desired to keep this on life support. So we add a build target for this non-C99 platform, and provide internal versions of snprintf and vsnprintf for use only on this platform that match the C99 semantics. This allows us to use C99 semantics normally elsewhere. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh MergeDate: Wed Aug 26 16:20:04 2026 (Merged from https://github.com/openssl/openssl/pull/31640)