openssl/apps, branch openssl-3.3.7

Copyright year updates

2026-04-07T12:38:24Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:38:26 2026 Release: yes

Don't eat a NULL if a queryfile is not provided

2026-03-31T09:55:23Z

Fixes: 18cd23df8a8f2 "Remove "noise" comments from TS files." Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 31 09:55:27 2026 (Merged from https://github.com/openssl/openssl/pull/30608)

x509: remove OCSP_TRUSTOTHER from stapled response and issuer fallback paths

2026-03-24T17:51:05Z

This is backport of 8a630915c045 "x509: remove OCSP_TRUSTOTHER from stapled response and issuer fallback paths" that includes only parts pertaining the openssl ocsp command. Original commit message: check_cert_ocsp_resp() verified stapled OCSP responses with OCSP_TRUSTOTHER while passing the peer-provided chain (ctx->chain), which allowed certificates from that chain to be treated as trusted OCSP responder signers. similarly, the ocsp CLI issuer fallback path unconditionally used OCSP_TRUSTOTHER, making certificates given via -issuer implicitly trusted regardless of verify_flags. remove OCSP_TRUSTOTHER from both paths so that responder authorization is validated against the trust store. Link: https://github.com/openssl/openssl/pull/30323 References: 8a630915c045 "x509: remove OCSP_TRUSTOTHER from stapled response and issuer fallback paths" Fixes: c6724060e267f "RT2206: Add -issuer flag to ocsp command" Reviewed-by: David von Oheimb Reviewed-by: Tomas Mraz MergeDate: Tue Mar 24 17:50:48 2026 (Merged from https://github.com/openssl/openssl/pull/30527) (cherry picked from commit a046f95e1d09d65b65d9ab14fb086707fe6b9bad)

apps/cmp.c: fix leak of out_trusted in setup_verification_ctx()

2026-03-24T17:35:34Z

setup_verification_ctx() allocates out_trusted via load_trusted() and passes it to OSSL_CMP_CTX_set_certConf_cb_arg(). Since the argument is not consumed, it must be freed on failure. The fix is to free out_trusted if OSSL_CMP_CTX_set_certConf_cb_arg() fails. Fixes #30377 Signed-off-by: huanghuihui0904 <625173@qq.com> Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Tue Mar 24 17:34:49 2026 (Merged from https://github.com/openssl/openssl/pull/30392) (cherry picked from commit 6f01df42cd0fff76dc789e50f5f86addd6103192)

apps/cmp_mock_srv: fix resource leak in process_genm()

2026-03-16T11:19:37Z

If pushing the generated rsp ITAV object into the out stack fails, the error path frees the stack container but permanently abandons the newly allocated rsp object. Explicitly free the rsp structure if it exists and was not pushed successfully to prevent this memory leak. Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Eugene Syromiatnikov MergeDate: Mon Mar 16 11:16:02 2026 (Merged from https://github.com/openssl/openssl/pull/30374) (cherry picked from commit b4a964f6c1313d386c45a747820d82a1a5ec4573)

apps: unload provider on app_provider_load() failure

2026-03-13T08:11:27Z

CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Fri Mar 13 08:11:38 2026 (Merged from https://github.com/openssl/openssl/pull/30314)

Fix a one byte buffer overflow in s_client

2026-03-12T17:57:08Z

The buffer used to process user commands when using advanced mode ("-adv") can overflow the buffer by one byte if the the read buffer is exactly BUFSIZZ bytes in length (16k). When processing the buffer we add a NUL terminator to the buffer, so if the buffer is already full then we overwrite by one byte when we add the NUL terminator. This does not represent a security issue because this is entirely local and would be "self-inflicted", i.e. not under attacker control. This issue was reported to use by Igor Morgenstern from AISLE. Reviewed-by: Paul Dale Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz MergeDate: Thu Mar 12 17:56:37 2026 (Merged from https://github.com/openssl/openssl/pull/30376) (cherry picked from commit 440ac348bf7ad86aaed3eb6a18c7ce587dccb350)

fix NULL pointer dereference when pass1 is NULL

2026-03-12T11:33:32Z

Resolves: https://scan5.scan.coverity.com/#/project-view/62622/10222?selectedIssue=1684201 Complements: #adc8e4abd96 Fix Memory leak in app_passwd Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale MergeDate: Thu Mar 12 11:33:37 2026 (Merged from https://github.com/openssl/openssl/pull/30365)

Fix Memory leak in app_passwd

2026-03-10T17:50:53Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Yang Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale MergeDate: Tue Mar 10 17:42:48 2026 (Merged from https://github.com/openssl/openssl/pull/30325) (cherry picked from commit adc8e4abd962b448354756fef24be499278875ae)

Fix const qualifiers from strchr where discarded

2026-02-25T11:07:59Z

This patch fixes several const qualifiers byu adding where required. warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] Since glibc-2.43 and ISO C23, the functions bsearch, memchr, strchr, strpbrk, strrchr, strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr that return pointers into their input arrays now have definitions as macros that return a pointer to a const-qualified type when the input argument is a pointer to a const-qualified type. Signed-off-by: Rudi Heitbaum Reviewed-by: Dmitry Belyavskiy Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Neil Horman MergeDate: Wed Feb 25 11:04:09 2026 (Merged from https://github.com/openssl/openssl/pull/30136) (cherry picked from commit 2af8d3b6400ba5f7133cbbd48a557d10af21c6a6)