openssl/include, branch openssl-4.0.0

Copyright year updates

2026-04-14T12:02:10Z

Reviewed-by: Neil Horman Reviewed-by: Matt Caswell MergeDate: Tue Apr 14 12:02:16 2026 Release: yes

include C++ extern in ech.h

2026-04-13T10:01:47Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Dmitry Belyavskiy Reviewed-by: Norbert Pocs Reviewed-by: Tim Hudson Reviewed-by: Nikola Pajkovsky MergeDate: Mon Apr 13 10:01:54 2026 (Merged from https://github.com/openssl/openssl/pull/30790)

quic: remove unused scid from port_default_packet_handler

2026-04-08T10:22:15Z

Remove the scid variable entirely from port_default_packet_handler() and all functions that accept it as a parameter. The scid was never used meaningfully — cur_remote_dcid is set later during the handshake. Remove scid parameter from: - port_bind_channel() - port_validate_token() - ossl_quic_channel_on_new_conn() - ossl_quic_bind_channel() - ch_on_new_conn_common() Remove the cur_remote_dcid = *peer_scid assignment in ch_on_new_conn_common() as it wrote dead data. CWE-457 Reported-by: Sunwoo Lee CLA: trivial Reviewed-by: Saša Nedvědický Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Tomas Mraz MergeDate: Wed Apr 8 10:21:55 2026 (Merged from https://github.com/openssl/openssl/pull/30611) (cherry picked from commit 275dab58f07deb08e148e954c096a6d005e2c548)

Make ext argument of X509V3_EXT_print_fp const

2026-04-08T09:15:22Z

Commit e75bd84ffc7 made the ext argument of 509V3_EXT_print const but did not give 509V3_EXT_print_fp which is essentially is a wrapper around X509V3_EXT_print the same treatment. This commit aligns the two functions again. Reviewed-by: Dmitry Belyavskiy Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Wed Apr 8 09:15:11 2026 (Merged from https://github.com/openssl/openssl/pull/30572) (cherry picked from commit a44081572e0cefccb951da28468e80bf535ca5d0)

Fix integer overflow in EVP_ENCODE_LENGTH and base64 encoding paths

2026-04-03T14:55:45Z

The EVP_ENCODE_LENGTH macro performs all arithmetic in the type of its argument. When the argument is int and exceeds approximately 1.6 billion, intermediate results overflow signed int, potentially wrapping to a smaller positive value rather than a negative one. In b64_write() (crypto/evp/bio_b64.c), this causes OPENSSL_malloc to allocate a buffer smaller than the actual encoded output size. EVP_EncodeUpdate then writes past the end of the undersized buffer. Changes: - Cast macro argument to size_t in EVP_ENCODE_LENGTH to prevent signed integer overflow - Change encoded_length in b64_write() from int to size_t and add an explicit overflow sanity check before allocation - Change return type of evp_encodeblock_int() and encode_base64_avx2() from int to size_t so that large encoded output lengths are not truncated - Update EVP_EncodeUpdate() to use size_t for the encoder return value accumulator (j), consistent with the existing size_t total - Add explicit (int) casts in EVP_EncodeBlock() and EVP_EncodeFinal() where the public API requires int return values Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz MergeDate: Fri Apr 3 14:55:29 2026 (Merged from https://github.com/openssl/openssl/pull/30321) (cherry picked from commit 3741076a34f4953ccbb6e1e131756ac206c8f27e)

Fix MINGW compilation

2026-03-25T14:13:17Z

This patch fixes undefined reference to `ossl_BIO_snprintf_msvc' Define it only if MSVC is used. Signed-off-by: Milan Broz Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Wed Mar 25 14:12:58 2026 (Merged from https://github.com/openssl/openssl/pull/30541) (cherry picked from commit 5f084f8a99d64db6936aaf0d868e78212bcfc421)

cmp_vfy.c,doc/,test/: when trying to use cached CMP message sender cert, no more check its revocation and chain

2026-03-25T09:55:38Z

Reviewed-by: Neil Horman Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/28973) (cherry picked from commit 525a4f1efbab0d3c2aff59ab8e671b8d9f35ddee)

include/openssl/macros.h: add missing #undef OPENSSL_NO_DEPRECATED_3_5

2026-03-17T17:20:06Z

Complements: 0bba82188186 "Deprecate all BIO_meth_get_*() functions" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Neil Horman MergeDate: Tue Mar 17 17:12:18 2026 (Merged from https://github.com/openssl/openssl/pull/30400) (cherry picked from commit 40f076965f154e307a0821088b6adcc447ceae01)

Copyright year updates

2026-03-10T14:37:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:37:54 2026 Release: yes

Revert "Constify X509_find_by_subject"

2026-03-06T21:29:23Z

This reverts commit 0da29907e7da "Constify X509_find_by_subject", as it operates on a stack of X509 (not const X509) objects, and returns a pointer to one of them. Fixes: 0da29907e7da "Constify X509_find_by_subject", Signed-off-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman MergeDate: Fri Mar 6 21:29:37 2026 (Merged from https://github.com/openssl/openssl/pull/30265)