openssl/fuzz, branch openssl-3.5.6

Fix legitimate spelling errors

2025-12-21T08:18:02Z

Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29461)

3.5-POST-CLANG-FORMAT-WEBKIT

2025-12-09T09:40:50Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Reviewed-by: Nikola Pajkovsky (Merged from https://github.com/openssl/openssl/pull/29262)

Reduce Max number of commands handled per fuzzer pass in quic-lcidm.

2025-10-04T08:29:46Z

We've gotten a few recent reports of a hang in the quic-lcidm fuzzer: https://issues.oss-fuzz.com/issues/448510502 It looks pretty straightforward (I think). The fuzzer input buffer is used in this particular case to randomly issue commands to the lcidm hash table (add/delete/query/flush/etc). The loop for the command processing (based on the input buffer), is limited to 10k commands. However the fuzzer will on occasion provide very large buffers (500k) which easily saturate that limit. If the input buffer happens to do something like get biased toward mostly additions, we wind up with a huge hashtable that has to constantly grow and rehash, which we've seen leads to timeouts in the past. Most direct fix I think here, given that this is something of an artificial failure in the fuzzer, is to simply clamp the command limit more. Fixes openssl/project#1664 Reviewed-by: Kurt Roeckx Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/28724) (cherry picked from commit 01c7958f2359e951a95350affb6b178fb50fed03)

Copyright year updates

2025-08-05T12:07:41Z

Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Release: yes

fuzz/dtlsserver.c: Remove incorrect ifdef guard

2025-07-30T16:32:43Z

Reviewed-by: Kurt Roeckx Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/28102) (cherry picked from commit fd7fc90346306f49773866eddff90717e22b9181)

Copyright year updates

2025-03-12T13:35:59Z

Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Release: yes

fix slh-dsa incorrect prediction of result code

2025-02-25T21:04:02Z

The slh_dsa fuzzer predicts failure in EVP_message_sign_init in the event we pass a context_string param of more than 255 bytes. That makes for an accurate prediction, but only if we actually create the param. augment the setting of exepct_rc_init to be determined not only by our allocation of a > 255 byte message, but also on selector bit 1, which determines if we create the parameter at all. Fixes https://oss-fuzz.com/testcase-detail/4807793999937536 Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/26884)

fix: add OOM handler for x509 fuzz test

2025-02-25T10:58:48Z

CLA: trivial Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26830)

separate intval into separate variable in OSSL_PARAMS

2025-02-22T19:29:56Z

construction of int params holds a pointer to an int rather than an int value, so we need to use separate variables when constructing separate int params. Reviewed-by: Tomas Mraz Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/26851)

Fix slh-dsa fuzzer on invalid param inputs

2025-02-22T19:29:56Z

oss-fuzz issue: https://issues.oss-fuzz.com/issues/397734693 Fails because the fuzzer occasionaly provides inputs which drives the fuzzer to create an octet-string for the context_string param which violates the 255 byte constraint documented on that parameter. Fix it by detecting that condition, expecting failure in the call to EVP_sign_message_init, and bailing out when it occurs. Fixes openssl/project#1109 Reviewed-by: Tomas Mraz Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/26851)