openssl/crypto, branch openssl-3.4.5

Copyright year updates

2026-04-07T12:31:52Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:31:53 2026 Release: yes

Avoid possible buffer overflow in buf2hex conversion

2026-04-06T19:40:20Z

Fixes CVE-2026-31789 Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz MergeDate: Mon Apr 6 19:39:23 2026 (cherry picked from commit 3244aa4b9d6ea0220cc14fd97d951c67b5052837)

Fix NULL Dereference When Delta CRL Lacks CRL Number Extension

2026-04-06T19:33:16Z

Fixes CVE-2026-28388 Co-authored-by: Igor Morgenstern Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz MergeDate: Mon Apr 6 19:27:16 2026 (cherry picked from commit d6ad8595e86dc96ca8771f0a1714b31794befa75)

Fix NULL deref in rsa_cms_decrypt

2026-04-06T19:07:07Z

Very simmilar to CVE-2026-28389, ensure that if we are missing parameters in RSA-OAEP SourceFunc in CMS KeyTransportRecipientInfo, we don't segfault when decrypting. Co-authored-by: Tomas Mraz Fixes CVE-2026-28390 Reviewed-by: Saša Nedvědický Reviewed-by: Nikola Pajkovsky MergeDate: Mon Apr 6 19:07:44 2026

Fix NULL deref in [ec]dh_cms_set_shared_info

2026-04-06T19:07:07Z

Multiple independent reports indicated a SIGSEGV was possible in CMS processing when a crafted CMS EnvelopedData message using A Key Agreement Recipient Info field. If the KeyEncryptionAlgorithmIdentifier omits the optional parameter field, the referenced functions above will attempt to dereference the alg->parameter data prior to checking if the parameter field is NULL. Confirmed to resolve the issues using the reproducers provided in the security reports. Co-authored-by: Tomas Mraz Fixes CVE-2026-28389 Reviewed-by: Saša Nedvědický Reviewed-by: Nikola Pajkovsky MergeDate: Mon Apr 6 19:07:41 2026

crypto/err/err_all.c: load SM2 error strings

2026-04-03T15:33:10Z

The function ossl_err_load_SM2_strings() exists, but wasn't called in ossl_err_load_crypto_strings(). Rescind this omission. Fixes: 3d328a445c2a "Add SM2 signature and ECIES schemes" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Fri Apr 3 15:32:47 2026 (Merged from https://github.com/openssl/openssl/pull/30625) (cherry picked from commit 6830f6281303b7c4ddb6957f4a90734a0ca82b8e)

EVP_MD_CTX_gettable_params(): Add NULL check before dereference

2026-04-03T15:25:09Z

Found by Linux Verification Center (linuxtesting.org) with SVACE. CLA:trivial Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov MergeDate: Fri Apr 3 15:24:39 2026 (Merged from https://github.com/openssl/openssl/pull/30589) (cherry picked from commit 9ac50d2d7bdf207c2e408bed79641169f5c69894)

Updated broken documentation links in various files

2026-04-03T15:19:14Z

Reviewed-by: Saša Nedvědický Reviewed-by: Eugene Syromiatnikov MergeDate: Fri Apr 3 15:18:46 2026 (Merged from https://github.com/openssl/openssl/pull/30516) (cherry picked from commit 6f5b5acd65050d7a5a5534f27911b7b1fddcf754)

crypto/x509/pcy_tree.c: fix leak of tree in X509_policy_check()

2026-04-03T15:04:10Z

When init_ret indicates both X509_PCY_TREE_EXPLICIT and X509_PCY_TREE_EMPTY, the function returns without freeing the initialized policy tree. Free the tree before returning, consistent with the earlier TREE_EMPTY branch. Also defer *ptree = tree assignment and free the tree when user policies are empty to avoid returning invalid memory. Fixes #30435 Signed-off-by: huanghuihui0904 <625173@qq.com> Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Eugene Syromiatnikov MergeDate: Fri Apr 3 15:03:37 2026 (Merged from https://github.com/openssl/openssl/pull/30436) (cherry picked from commit c3d24d9121ef12d8b1f2615e7655e07b5a624358)

Apply clang-format to the source tree

2026-04-03T14:50:46Z

Ensure that all the source files are formatted with the current .clang-format configuration, to avoid spurious clang-format checker errors when arbitrary files are touched. Signed-off-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz MergeDate: Fri Apr 3 14:51:03 2026 (Merged from https://github.com/openssl/openssl/pull/29823)