diff options
| author | Jan Schaumann <[email protected]> | 2026-05-18 23:42:25 +0200 |
|---|---|---|
| committer | Eugene Syromiatnikov <[email protected]> | 2026-10-09 21:32:23 +0200 |
| commit | 2eb54ba743e7e5233f75b54ed99eb71407679d5a (patch) | |
| tree | 4e18baaf9a638cd0f0bfba325cb51c1f0bf6c16b | |
| parent | rsa_multiprime_keygen(): Fix leak of tmp if stack insertion fails (diff) | |
| download | openssl-2eb54ba743e7e5233f75b54ed99eb71407679d5a.tar.gz openssl-2eb54ba743e7e5233f75b54ed99eb71407679d5a.zip | |
EVP_MD_demo.c, tls13secretstest.c: avoid signed-to-unsigned integer conversion
Should EVP_MD_size() return -1, the size_t len variable would wrap,
causing any subsequent error checks to not trigger. Change to type
int (which is what EVP_MD_size() returns).
While this is just in test/demo code, that's the kind of code that
people might copy and reuse elsewhere, and that AI vuln scanners
trigger on, so might as well try to eliminate that noise.
Fixes: 7a7fbeb924a0 "fix all the warnings in our demos and make them enableable"
Fixes: 134bfe56c4fe "Add a test for the TLS1.3 secret generation"
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Merge-date: Fri Oct 9 19:19:13 2026
Merged-from: https://github.com/openssl/openssl/pull/31222
(cherry picked from commit 9f561c1c232786f8406173f4d09ccc49a33f8883)
| -rw-r--r-- | demos/digest/EVP_MD_demo.c | 6 | ||||
| -rw-r--r-- | test/tls13secretstest.c | 6 |
2 files changed, 9 insertions, 3 deletions
diff --git a/demos/digest/EVP_MD_demo.c b/demos/digest/EVP_MD_demo.c index a32794fe582..eb4954e951f 100644 --- a/demos/digest/EVP_MD_demo.c +++ b/demos/digest/EVP_MD_demo.c @@ -78,6 +78,7 @@ static int demonstrate_digest(void) const char *option_properties = NULL; EVP_MD *message_digest = NULL; EVP_MD_CTX *digest_context = NULL; + int sz = 0; unsigned int digest_length; unsigned char *digest_value = NULL; unsigned int j; @@ -100,11 +101,12 @@ static int demonstrate_digest(void) goto cleanup; } /* Determine the length of the fetched digest type */ - digest_length = EVP_MD_get_size(message_digest); - if (digest_length <= 0) { + sz = EVP_MD_get_size(message_digest); + if (sz <= 0) { fprintf(stderr, "EVP_MD_get_size returned invalid size.\n"); goto cleanup; } + digest_length = (unsigned int)sz; digest_value = OPENSSL_malloc(digest_length); if (digest_value == NULL) { diff --git a/test/tls13secretstest.c b/test/tls13secretstest.c index d5622f7cdfe..b4b4fc8bb35 100644 --- a/test/tls13secretstest.c +++ b/test/tls13secretstest.c @@ -290,6 +290,7 @@ static int test_handshake_secrets(void) SSL *ssl = NULL; SSL_CONNECTION *s; int ret = 0; + int sz; size_t hashsize; unsigned char out_master_secret[EVP_MAX_MD_SIZE]; size_t master_secret_length; @@ -328,7 +329,10 @@ static int test_handshake_secrets(void) handshake_secret, sizeof(handshake_secret))) goto err; - hashsize = EVP_MD_get_size(ssl_handshake_md(s)); + sz = EVP_MD_get_size(ssl_handshake_md(s)); + if (sz < 0) + goto err; + hashsize = (size_t)sz; if (!TEST_size_t_eq(sizeof(client_hts), hashsize)) goto err; if (!TEST_size_t_eq(sizeof(client_hts_key), KEYLEN)) |