openssl/providers/implementations, branch openssl-3.5.6

Copyright year updates

2026-04-07T12:24:29Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:24:30 2026 Release: yes

rsa_kem: validate RSA_public_encrypt() result in RSASVE

2026-04-06T19:51:02Z

RSA_public_encrypt() returns the number of bytes written on success and -1 on failure. With the existing `if (ret)` check, a provider-side RSA KEM encapsulation can incorrectly succeed when the underlying RSA public encrypt operation fails. In that case the code reports success, returns lengths as if encapsulation completed normally, and leaves the freshly generated secret available instead of discarding it. Tighten the success condition so RSASVE only succeeds when RSA_public_encrypt() returns a positive value equal to the modulus-sized output expected for RSA_NO_PADDING. Any other return value is treated as failure, and the generated secret is cleansed before returning. Fixes CVE-2026-31790 Signed-off-by: Nikola Pajkovsky Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz MergeDate: Mon Apr 6 19:51:30 2026

Apply clang-format to the source tree

2026-04-03T14:48:44Z

Ensure that all the source files are formatted with the current .clang-format configuration, to avoid spurious clang-format checker errors when arbitrary files are touched. Signed-off-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz MergeDate: Fri Apr 3 14:49:00 2026 (Merged from https://github.com/openssl/openssl/pull/29822)

Fix DSA sig dupctx pointer aliasing

2026-03-24T15:57:52Z

Same aliasing issue as with ECDSA in https://github.com/openssl/openssl/pull/30479 Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Tue Mar 24 15:58:02 2026 (Merged from https://github.com/openssl/openssl/pull/30529)

Fix ECDSA sig CTX dup "sig" aliasing, error paths

2026-03-20T18:25:27Z

- The context "sig" field ended up shared by both contexts after a dup, leading to a later double-free. Reported by Stanislav Fort and Pavel Kohout of Aisle Research. - Rare error paths could lead to a memory leak or to use-after-free and/or double-free. Reported by Kenaz Wang. Fixes: edd3b7a309f8 "Add ECDSA to providers" Fixes: f68ba38e1890 "Refactor OpenSSL 'ECDSA' EVP_SIGNATURE to also include ECDSA+hash composites" Reviewed-by: Tomas Mraz Reviewed-by: Shane Lontis Reviewed-by: Eugene Syromiatnikov MergeDate: Fri Mar 20 18:25:35 2026 (Merged from https://github.com/openssl/openssl/pull/30479)

Fix incorrect error return in ppc_aes_gcm_cipher_update decrypt path

2026-03-18T07:05:25Z

ppc_aes_gcm_cipher_update() returns 1 on success and 0 on failure. The decrypt pre-alignment path (line 122) incorrectly returned -1 instead of 0 when CRYPTO_gcm128_decrypt() failed. Since the caller checks `if (!hw->cipherupdate(...))`, and !(-1) evaluates to 0 (false) in C, the error was silently swallowed and GCM processing continued with potentially corrupt state. The encrypt path at line 98 correctly returns 0. This was likely a copy-paste error when the decrypt path was added. Fixes #30380 CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Mar 18 07:05:30 2026 (Merged from https://github.com/openssl/openssl/pull/30452)

Fix integer truncation in ppc_aes_gcm_crypt

2026-03-17T09:45:11Z

The assembly functions ppc_aes_gcm_encrypt and ppc_aes_gcm_decrypt return size_t, but their return values were stored in int variables, causing truncation on PPC64 where size_t is 64-bit. This could lead to incorrect results when processing inputs larger than 2GB via EVP_Cipher() which accepts unsigned int lengths. Change the types of s and ndone from int to size_t to match the function return type and the return type of ppc_aes_gcm_crypt itself. Tested on POWER8 S824 (ppc64le) — all EVP and cipher tests pass, AES-128-GCM benchmarks at 2.94 GB/s with hardware acceleration. CLA: trivial Reviewed-by: Nikola Pajkovsky Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Tue Mar 17 09:44:33 2026 (Merged from https://github.com/openssl/openssl/pull/30437) (cherry picked from commit e443447588640d099a3e2f1001cf67dab921f935)

ml-kem: wipe full seed buffer in ml_kem_gen_cleanup

2026-03-13T08:42:35Z

The gen ctx stores seed material in uint8_t seedbuf[ML_KEM_SEED_BYTES], where ML_KEM_SEED_BYTES = ML_KEM_RANDOM_BYTES * 2. When cleanup runs and gctx->seed != NULL, it wiped ML_KEM_RANDOM_BYTES so clearing only half of the seed buffer. This change wipes the entire buffer instead. CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov MergeDate: Fri Mar 13 08:42:41 2026 (Merged from https://github.com/openssl/openssl/pull/30355)

Fix stack buffer over-read in DES OFB/CFB64 via unchecked num parameter

2026-03-12T14:27:09Z

The `num` parameter in DES OFB64/CFB64 functions tracks the byte offset within an 8-byte DES block, so valid values are 0-7. However, neither the EVP set_params path nor the low-level DES functions validated this bound, allowing an out-of-range `num` to cause a stack buffer over-read when used as an array index into the 8-byte keystream buffer. Fix at two levels: 1. Provider layer: reject num >= blocksize in ossl_cipher_common_set_ctx_params() before it reaches the cipher. 2. Low-level DES: mask `*num` with `& 0x07` on entry to DES_ofb64_encrypt, DES_ede3_ofb64_encrypt, DES_cfb64_encrypt, and DES_ede3_cfb64_encrypt, consistent with how `n` is already masked at the end of these functions before being written back. Fixes #30284 Reviewed-by: Paul Dale Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz MergeDate: Thu Mar 12 14:24:12 2026 (Merged from https://github.com/openssl/openssl/pull/30332) (cherry picked from commit 134342e194a23b1d3cc0687b05d97cfdd0f31c4a)

Fix logic errors for HMAC-DRBG

2026-03-03T20:05:57Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale MergeDate: Tue Mar 3 20:06:04 2026 (Merged from https://github.com/openssl/openssl/pull/30232)