aboutsummaryrefslogtreecommitdiffstats
path: root/crypto
Commit message (Collapse)AuthorAgeFilesLines
* crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checksAdel-Ayoub2026-07-271-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value, so the "< 0" checks on the cipher-with-MAC path cannot detect any failure. A return of 0 means a failed or unsupported control, or for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is usable here. Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG check fixed by commit 674c23d2656e in this function. Follow-up to https://github.com/openssl/openssl/pull/30923. Fixes: ea0add4a8227 "New GOST PKCS12 standard support" CLA: trivial Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> MergeDate: Mon Jul 27 10:21:13 2026 (Merged from https://github.com/openssl/openssl/pull/31848)
* rand: factor out seed source creation and fix store raceJakub Zelenka2026-07-271-24/+52
| | | | | | | | | | | | | | | | | | | | | | | | | rand_get0_primary() created the seed source ahead of the primary DRBG and stored both under the write lock at the end. When two threads raced to create the primary DRBG and one of them failed after having created and stored the seed source, the other thread overwrote the stored seed source with its own instance, leaking the previous one. Factor the get-or-create logic out into rand_get0_seed() which rechecks the global under the write lock, so exactly one instance is kept and returned to every racing thread, and the seed source is stored independently of the primary DRBG creation outcome. Add a regression test checking that creating the primary DRBG creates and stores the seed source and that later use keeps returning the same instance. Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> MergeDate: Mon Jul 27 09:13:12 2026 (Merged from https://github.com/openssl/openssl/pull/32029)
* x509: keep RFC 3779 stacks hole-free after a failed canonizeMounir IDRASSI2026-07-272-36/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ASIdentifierChoice_canonize and IPAddressOrRanges_canonize left NULL slots in the live stack when a merge succeeded before a later failure (overlap, inverted range, or OOM). The NULLs were closed up only on the success path, so a failed X509v3_asid_canonize() / X509v3_addr_canonize() left the object poisonable: a retry of either function dereferences a NULL in the sort comparator during the re-sort, the i2r extension printers dereference the hole when printing (both in all builds), and on the asid side is_canonical trips extract_min_max's ossl_assert(aor != NULL), an abort in debug builds. This is a regression introduced by e59165a1e3 ("crypto/x509: replace O(N^2) RFC 3779 canonicalisation merge with linear sweep"): the previous delete-per-merge loop kept the stack hole-free at every step, so a failed canonize always left the object sorted, partially merged and structurally valid. Run the compaction pass unconditionally, whether the sweep succeeded or failed, restoring that contract: the stack is always left partially canonicalized but hole-free, safe to inspect, print, encode, free, or retry. In v3_addr.c this also routes the bare return-0 error paths through the done: cleanup label. New tests cover the crash vectors (is_canonical then retry) on both the asid and addr sides. The existing *_error_midsweep tests are strengthened with the same inspect/retry assertions. Fixes #31856 Assisted-by: ZCode:GLM-5.2 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 27 07:59:21 2026 (Merged from https://github.com/openssl/openssl/pull/31857)
* crypto: use void * in LoongArch SHA shimChristoph Müllner2026-07-231-4/+4
| | | | | | | | | | | | | The LoongArch SHA dispatch shim uses the same deprecated typed interfaces as the RISC-V shim. Switch its entry points to void * so it no longer depends on deprecated SHA context types. Signed-off-by: Christoph Müllner <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 23 15:43:31 2026 (Merged from https://github.com/openssl/openssl/pull/30763)
* crypto: use void * in RISC-V digest shimsChristoph Müllner2026-07-232-8/+8
| | | | | | | | | | | | | | | | | | | The RISC-V MD5 and SHA dispatch files use low-level digest context types that are hidden in no-deprecated builds. Switch their shim entry points to void * so they no longer depend on deprecated typed interfaces. Update the local MD5 declaration to match the untyped shim interface. Fixes: openssl/openssl#29357 Signed-off-by: Christoph Müllner <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 23 15:43:30 2026 (Merged from https://github.com/openssl/openssl/pull/30763)
* Added Nvidia/Olympus CPU dispatch for SHA3/EOR3 AES GCM on Vera CPUAlexander Nesterovskiy2026-07-231-1/+2
| | | | | | | | | | CLA: trivial Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Thu Jul 23 08:26:09 2026 (Merged from https://github.com/openssl/openssl/pull/31191)
* use safe_math on do_name_exNeil Horman2026-07-231-6/+25
| | | | | | | | | | | | | | | Coverity caught some potential overflows in do_name_ex. Seems unlikely to occur, but lets just do all the adds under safe_math to ensure we don't overflow our buffer length. Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695278 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jul 23 08:24:23 2026 (Merged from https://github.com/openssl/openssl/pull/31992)
* Add return check to OSSL_DECODER_up_refNeil Horman2026-07-231-1/+4
| | | | | | | | | | | | | | Coverity flagged a location where we didn't check this return code, fix it up. Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1696759 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jul 23 08:24:22 2026 (Merged from https://github.com/openssl/openssl/pull/31992)
* errors: fix stale string overrides in openssl.txt for renamed SSL error codesTodd Short2026-07-213-47/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3 error codes to TLS equivalents and updated the string descriptions in crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to "tls alert bad certificate"), but did not update the corresponding strings in crypto/err/openssl.txt. This caused a latent divergence: running mkerr.pl -rebuild would regenerate ssl_err.c with the old openssl.txt strings, undoing the intentional name cleanup. Similarly, adding any new SSL error code triggers a full SSL regeneration that would revert the strings and reorder entries to their correct alphabetical positions, producing spurious changes unrelated to the new code. Update openssl.txt to match the strings already in ssl_err.c, which also happen to be the auto-generated strings derived from the reason code names. Regenerate ssl_err.c and sslerr.h with the correct alphabetical ordering so that future make update runs are idempotent: adding and removing a new SSL error code now produces only the expected changes to the generated files, with no side-effect reordering or string reversions. Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents") Signed-off-by: Todd Short <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Jul 21 14:28:22 2026 (Merged from https://github.com/openssl/openssl/pull/31993)
* Guard against NULL data in empty ASN1_STRINGsNorbert Pocs2026-07-213-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | Since 28179061bf a zero-length ASN1_STRING has data == NULL in fuzzing builds instead of a 1-byte allocation. Several call sites did pointer arithmetic or memcpy on the data pointer before any length check, which is undefined behaviour for NULL even with a zero offset and aborts the fuzz targets under UBSan: - asn1_string_canon: skip canonicalisation of empty values - do_buf, do_hex_dump: return early on an empty buffer - i2d_ocsp_nonce: skip the memcpy for an empty nonce The loops at these sites were already no-ops for zero length, so there is no behaviour change outside sanitizer builds. Assisted-By: Claude:claude-fable-5 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Tue Jul 21 12:54:48 2026 (Merged from https://github.com/openssl/openssl/pull/31998)
* ml_kem: Add a check for shared_secretLoganaden Velvindron2026-07-201-2/+4
| | | | | | | | Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tim Hudson <[email protected]> MergeDate: Mon Jul 20 11:21:15 2026 (Merged from https://github.com/openssl/openssl/pull/31822)
* Make sure we always check return of CRYPTO_UP_REF which can fail.Frederik Wedel-Heinen2026-07-2032-49/+39
| | | | | | | Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Mon Jul 20 11:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31753)
* Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)John Claus2026-07-202-4/+10
| | | | | | | | | | | | | | | Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type. Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1. Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands. Fixes openssl#30432 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Mon Jul 20 11:10:47 2026 (Merged from https://github.com/openssl/openssl/pull/30655)
* Fix SM2 RISC-V64 crash from functions emitted into .rodataMounir IDRASSI2026-07-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The ecp_sm2p256-riscv64.pl generator switches to .section .rodata to emit constant data (.Lpoly, .Lord, .Lpoly_div_2, .Lord_div_2), but never switches back before emitting function code. As a result, the function symbols defined by this file are assembled into .rodata instead of executable .text. On systems enforcing NX for .rodata, calling the RISC-V64 SM2 assembly faults immediately. Fix this by adding .previous after the constant block, restoring the initial .text section before function emission. Verified with readelf: before the fix, .text is empty and the function symbols are in .rodata; after the fix, constants remain in .rodata and the function symbols are in executable .text. Introduced in commit 05301b100f (PR #25918). Reviewed-by: Paul Yang <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Mon Jul 20 09:47:35 2026 (Merged from https://github.com/openssl/openssl/pull/31874)
* Convert internal use of ASN1_STRING_set and ASN1_STRING_lengthBob Beck2026-07-1850-144/+281
| | | | | | | | | | | | | | to use their non-deprecated replacements. For "pretty-printing" applications and test code that use a length and require an int, size_t lengths are simply cast to an int. For writes and protocol level things size_t lengths are checked against INT_MAX and take the error path if the returned value is too large to be used for a funciton that takes an integer length. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Sat Jul 18 13:01:19 2026 (Merged from https://github.com/openssl/openssl/pull/31194)
* pass length in cmp_msg stuffBob Beck2026-07-183-5/+5
| | | | | | | | | | | ossl_cmp_sk_ASN1_UTF8STRING_push_str depended under the covers on passing a -1 to have strlen magically called in the setter. Don't depend on this and simply pass in the correct length Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Sat Jul 18 13:01:17 2026 (Merged from https://github.com/openssl/openssl/pull/31194)
* Prepare a now opaque ASN1_STRING for the size_t rapture.Bob Beck2026-07-182-34/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that ASN1_STRING is opaque, we can finally move away from an int for the length internally. The remaining problematic piece for this is that ASN1_STRING_length() returns an int and is public API. Therefore, we deprecate ASN1_STRING_length() and provide a replacement ASN1_STRING_length_ex() that returns a size_t length. We also provide setting functions that take size_t lengths, they are ASN1_STRING_set_data() which takes a uint8_t data pointer and a size_t length, and ASN1_STRING_set_string() which takes a argument that must be a c string and will use strlen to determine the length. (This replaces th previous arcane behaviour of calling "strlen" on a magical input length value of -1, which leads to bugs.) We then deprecate ASN1_STRING_set(). ASN1_STRING_set_string() requires a valid C string argument that may not be NULL - refer to the documentation. Both new functions do not magically add 0 bytes on the end of values, as ASN1_STRING has already been documented for a long time to not depend on this behaviour. Both new functions do not allow the setting of values on an ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that. Note that this does *NOT* yet change ASN1_STRING to use size_t internally, this must wait until the integer-returning ASN1_STRING_length() has been deprecated, and then removed in future major. Once ASN1_STRING_length() has been removed then ASN1_STRING internally can change to using a size_t for the length of the data. (And the setters will no longer return an error if the provided size_t length exceeds INT_MAX) Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Sat Jul 18 13:01:15 2026 (Merged from https://github.com/openssl/openssl/pull/31194)
* rand: fix jitter seed macro logicJakub Zelenka2026-07-171-8/+2
| | | | | | | | | | | | | | The seeding macro logic was mixed up and incompletely applied. The macro logic was also cleaned up. Co-authored-by: Paul Dale <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Fri Jul 17 04:47:07 2026 (Merged from https://github.com/openssl/openssl/pull/31970)
* keccak1600x4-avx512vl: fix undefined symbols on macOSRichard Levitte2026-07-141-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The one-shot SHAKE x4 wrappers call the incremental absorb and squeeze routines through call_internal(), which on non-Win64 emitted a call to the public global symbol by its bare name. These calls textually precede the callees' .globl declarations, so x86_64-xlate.pl never prepends the platform's leading underscore to the referenced symbol. On ELF (Linux) that is harmless since symbols carry no leading underscore, but on Mach-O (macOS) the call references the un-decorated SHA3_shake*_x4_inc_*_avx512vl while the defined symbol is _SHA3_shake*_x4_inc_*_avx512vl, leaving four undefined externals and breaking the darwin64-x86_64 link of libcrypto: SHA3_shake128_x4_inc_absorb_avx512vl SHA3_shake256_x4_inc_absorb_avx512vl SHA3_shake128_x4_inc_squeeze_avx512vl SHA3_shake256_x4_inc_squeeze_avx512vl Call the local .L_<name> entry label instead -- the same address as the public symbol and the pattern the finalize calls already use -- so the reference resolves locally and these internal routines cannot be interposed. The Win64 path is unchanged. Fixes: https://github.com/openssl/openssl/issues/31941 Fixes: a248ec771e ("ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integration") Assisted-by: Pi:z-ai/glm-5.2 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Tue Jul 14 12:33:50 2026 (Merged from https://github.com/openssl/openssl/pull/31942)
* Fix refcounting for ENCODER/DECODER/STORE methods without cachingNeil Horman2026-07-143-5/+37
| | | | | | | | | | | | | | | | | | https://github.com/openssl/openssl/pull/31782 Fixed method refcounting for EVP objects when the provider they are fetched from requests no-caching, but I neglected to add simmilar refcounting fixes for DECODERS/ENCODERS and STORE objects, who follow a different fetch path (these use inner_[decoder|encoder|loader]_fetch rather than inner_evp_generic_fetch. They got missed because the p_ossltest provider that we use to test these paths don't provide these objects, so the path never got exercised. Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Jul 14 05:21:36 2026 (Merged from https://github.com/openssl/openssl/pull/31844)
* ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integrationMarcel Cornu2026-07-1310-59/+2968
| | | | | | | | | | | | | | | | | | | | | | Changes: - Adds new SHAKE x4 API to perform 4 SHAKE operations in parallel when AVX512VL is supported. - Adds AVX512VL Keccak x4 assembly module (keccak1600x4-avx512vl). - Adds internal SHA3 x4 APIs/context in sha3.h and wrappers in sha3_x4.c modules. - Adds runtime dispatch for ML-DSA sample operations with an OSSL_ML_DSA_SAMPLE_OPS vtable. Callers obtain the correct implementation via ossl_ml_dsa_sample_ops(), which returns either the generic scalar ops functions, or the AVX512VL multi-buffer ops depending on the build and CPU capabilities. - Adds x86-64 multi-buffer function implementation into ml_dsa_sample_hw_x86_64.inc, included in ml_dsa_sample.c when KECCAK1600_ASM and x86_64 are defined. Co-authored-by: Tomasz Kantecki <[email protected]> Signed-off-by: Marcel Cornu <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Mon Jul 13 15:55:54 2026 (Merged from https://github.com/openssl/openssl/pull/31090)
* Fix nasm version check for sm3 & sm4 perlasm filesknut st. osmundsen2026-07-132-4/+4
| | | | | | | | | | Make the check correctly handle versions such as '3.00rc8'. It was incorrectly expecting major.minor.patch. Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> MergeDate: Mon Jul 13 15:48:03 2026 (Merged from https://github.com/openssl/openssl/pull/31420)
* Explain inconsistency in X25519 ladder copiesDavid Foster2026-07-131-0/+7
| | | | | | | | | Fixes #31560 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jul 13 15:03:15 2026 (Merged from https://github.com/openssl/openssl/pull/31812)
* FIPS: EC keygen - remove unnecessary self tests.slontis2026-07-131-52/+1
| | | | | | | | | | | | | | | | | | | | In FIPS mode EC keygen was doing 3 self tests. ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4. These tests covered both Keygen PCT for Key Agreement and Signatures. ossl_ec_key_pairwise_check() was also being called from within ec_gen(). The advice from Atsec (lab) is that the sign/verify test within ecdsa_keygen_pairwise_test() is sufficient according to the updated rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of the generated key is unknown at the time of key generation. Detected during testing of Jipher by Roshith Alankandy (Oracle). Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jul 13 14:47:00 2026 (Merged from https://github.com/openssl/openssl/pull/31761)
* s390x: Fix montgomery_multiplication_vectorizedTimo Keller2026-07-131-22/+37
| | | | | | | | | | | | | | | | | | | | Introduce `reduce_twice_signed` that reduces from `(-2q,q)` to `[0,q)`. Fix `montgomery_multiplication_vectorized` in `ml_dsa_ntt_vec128.c` by calling `reduce_twice_signed` at the end of the computation ensuring that the result is in `[0,q)` and not only in `(-2q,q)` or `(-q,q)`. Do not call `reduce_once_signed` in `ossl_poly_ntt_mult_scalar_vec128` and at the end of `ossl_ml_dsa_poly_ntt_inverse_vec128` anymore as it is not necessary anymore after `reduce_twice_signed`. Without this fix, keygen, sign or verify might fail or produce wrong results. Signed-off-by: Timo Keller <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> MergeDate: Mon Jul 13 14:45:11 2026 (Merged from https://github.com/openssl/openssl/pull/31744)
* cms: fix AuthEnvelopedData authAttrs tags and verify them as AEAD AADJakub Zelenka2026-07-134-4/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CMS_AuthEnvelopedData ASN.1 template used the implicit tags and the X509_ALGOR type copied from CMS_AuthenticatedData. Per RFC 5083 the authAttrs and unauthAttrs fields are [1] and [2] (not [2] and [3]) and are SET OF Attribute, so use X509_ATTRIBUTE with the correct tags, matching the STACK_OF(X509_ATTRIBUTE) members already declared in the structure. With the tags fixed, authEnvelopedData carrying authAttrs now parses, so the authenticated attributes must also be fed to the content cipher as the AEAD associated data required by RFC 5083 section 2.1. Encode their DER (with the universal SET OF tag) for both encryption and decryption; without this the GCM tag fails to verify against compliant senders such as BouncyCastle. RFC 5083 also requires that plaintext is not released until its integrity has been verified. The AEAD tag is only checked once all the ciphertext has been processed, so buffer the decrypted content and forward it to the output BIO only after that check succeeds; a tampered message then leaks nothing to -out. Add an interop test using a BouncyCastle-generated AES-128-GCM message with authenticated and unauthenticated attributes, plus a tampered copy that must fail the tag check and leave -out empty. Closes #31635 Closes #26101 Closes #31629 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jul 13 14:41:34 2026 (Merged from https://github.com/openssl/openssl/pull/31695)
* Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundaryMarc Gutman2026-07-131-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO. Callers commonly loop, decoding concatenated DER values until the call fails, and rely on a failure with no queued error to recognise a clean end of input. CPython's ssl module does this in _add_ca_certs() when loading the Windows certificate store via SSLContext.load_verify_locations(cadata=...); it re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as fatal. Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read() returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue. The rewrite in commit 35852da1d9 carried this behaviour forward. As a result Python 3 on Windows fails to initialise an SSLContext with: ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, on an EOF in the middle of an object (some bytes already buffered), or on an EOF while still inside an indefinite-length value awaiting its end-of-contents octets - all of which are genuine truncation. A clean EOF at a top-level object boundary again fails without queuing an error, restoring the long-standing behaviour that looping callers depend on. Add regression tests covering the clean-EOF, truncated, indefinite-length truncation and partial-header cases, and document the read behaviour in ASN1_item_d2i_bio(3). Fixes #31807 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Igor Ustinov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jul 13 08:05:03 2026 (Merged from https://github.com/openssl/openssl/pull/31818)
* Drop Windows-on-Itanium (VC-WIN64I) support.Bob Beck2026-07-101-2/+0
| | | | | | | | | | | | | | | | | | | Similar to Windows CE, Windows Itanium has not had a toolchain to work on it since VS 2010, and Windows server 2008 was the last thing that ran on it. This does *not* change the other (linux, HPUX) targets which have modern toolchain support, and likely even still run these days. While never letting go seems noble when you won't share the door you're floating on, the time has come. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Jul 10 17:39:39 2026 (Merged from https://github.com/openssl/openssl/pull/31913)
* x509: avoid NULL memcmp argument in nc_dn()Mounir IDRASSI2026-07-101-0/+6
| | | | | | | | | | | | | | | | | An empty directoryName constraint has canon_enc == NULL and canon_enclen == 0. nc_dn() must not pass that pointer to memcmp(), even with a zero length. Return X509_V_OK before comparing an empty base Name. This preserves current match semantics and avoids UBSan-visible undefined behaviour. Fixes #31687 Fixes #31688 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Fri Jul 10 15:51:01 2026 (Merged from https://github.com/openssl/openssl/pull/31814)
* pkcs12: free PKCS7 elements on error in PKCS12_unpack_authsafesNaveed Khan2026-07-101-1/+1
| | | | | | | | | Fixes: b536880c4572 "Add library context and property query support into the PKCS12 API" Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Fri Jul 10 15:48:37 2026 (Merged from https://github.com/openssl/openssl/pull/31862)
* Avoid undefined behavior adding or subtracting two BN_zero() valuesTomas Mraz2026-07-101-0/+7
| | | | | | | Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Fri Jul 10 14:54:48 2026 (Merged from https://github.com/openssl/openssl/pull/31916)
* Fix a bug in BN_ucmp() when comparing constant-time BIGNUMs of different lengthsIgor Ustinov2026-07-101-3/+21
| | | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Jul 10 12:08:43 2026 (Merged from https://github.com/openssl/openssl/pull/31717)
* We no longer need to test for GCC versions this oldBob Beck2026-07-1015-19/+19
| | | | | | | | | | | | | | The minimum gcc to compile our code appears to be version 9, and we are now C99. All these older checks become a tautology on anything that will build a modern OpenSSL tree, so clean this up. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Jul 10 11:47:17 2026 (Merged from https://github.com/openssl/openssl/pull/31677)
* Drop Watcom C compiler support.Bob Beck2026-07-101-7/+0
| | | | | | | | | | | | | | | The only Watcom-specific code in the tree was a <tchar.h> _vsntprintf mapping in crypto/cryptlib.c. There is no Watcom entry in Configurations/, no CI job builds with Watcom, and the tree has had no other Watcom-aware code in many years. The _vsntprintf symbol is supplied by <tchar.h> on every supported Windows toolchain (MSVC, MinGW), so the conditional fallback is dead. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Jul 10 11:47:15 2026 (Merged from https://github.com/openssl/openssl/pull/31677)
* EC: make the group the single source of the point conversion formViktor Dukhovni2026-07-106-17/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The point conversion form (compressed, uncompressed, or hybrid) was kept both on the key and on the group, and the two could disagree -- a key imported as compressed could re-encode as uncompressed. The group is now the single source of truth: encoding, parameter output, and the legacy lookup all read it from the group, and decoding (PEM, DER, or raw parameters) records it there, so the form round-trips faithfully. Generated keys are always uncompressed; the point-format option at key generation is now a documented no-op (it had had no effect for several releases), and the unused form field on the keygen context is dropped. Imported keys still keep their form, and the deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still work. EVP_PKEY_fromdata() and openssl pkey -text now report the form a loaded EC key actually has, and re-encoding via PEM or DER preserves it. Docs drop a stale note about a compile-time macro for compressed points on binary curves, and the EC tests now exercise both the affine and the compressed/hybrid binary formats unconditionally (fixing a latent bug in the compressed/hybrid form tests that were never exercised by CI). Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Fri Jul 10 09:21:29 2026 (Merged from https://github.com/openssl/openssl/pull/30940)
* Add BIO bss_dgram testJakub Zelenka2026-07-092-15/+15
| | | | | | | | | Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 9 17:39:21 2026 (Merged from https://github.com/openssl/openssl/pull/30788)
* Add BIO bss_acpt testJakub Zelenka2026-07-092-43/+43
| | | | | | | | | Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 9 17:39:20 2026 (Merged from https://github.com/openssl/openssl/pull/30788)
* Add BIO bss_conn testJakub Zelenka2026-07-092-39/+40
| | | | | | | | | Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 9 17:39:19 2026 (Merged from https://github.com/openssl/openssl/pull/30788)
* crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_count() in x509_object_dup()Nikola Pajkovsky2026-07-081-1/+6
| | | | | | | | | | | | | | | | | the return value of X509_OBJECT_up_ref_count() was ignored. If the reference count increment fails, x509_object_dup() still returned a duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL without a reference actually having been taken. Freeing that duplicate later drops a reference it never held, leading to a premature free and use-after-free of the shared object. Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed Jul 8 18:20:10 2026 (Merged from https://github.com/openssl/openssl/pull/31811)
* BIO_vprintf: fix off-by-one at 512-byte buffer boundaryMounir IDRASSI2026-07-081-1/+1
| | | | | | | | | | | | | | | | | | BIO_vprintf() first formats into a 512-byte stack buffer. Since vsnprintf() returns the required length excluding the NUL, a return value of 512 means truncation. The old strict greater-than check therefore wrote the truncated buffer for exactly 512-byte output. Use >= for the realloc path and add boundary coverage for 511-, 512- and 513-byte outputs. Fixes: a29d157fdb6d "Replace homebrewed implementation of *printf*() functions with libc" Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 11:24:31 2026 (Merged from https://github.com/openssl/openssl/pull/31842)
* Remove unused source files poly1305_ieee754.c and poly1305_base2_44.cFrederik Wedel-Heinen2026-07-082-649/+0
| | | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 11:16:22 2026 (Merged from https://github.com/openssl/openssl/pull/31737)
* Fix typosDimitri Papadopoulos2026-07-085-5/+5
| | | | | | | | | | | | | | | | Found by typos[1]. [1] https://github.com/crate-ci/typos CLA: trivial Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:46:01 2026 (Merged from https://github.com/openssl/openssl/pull/31858)
* Add parentheses around sizeof argumentsDimitri Papadopoulos2026-07-081-2/+2
| | | | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:18 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* Remove parentheses around return argumentsDimitri Papadopoulos2026-07-083-3/+3
| | | | | | | | | | | | | | Since return is an operator and not a function, parentheses are not required. Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:13 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* Eliminate/fix repeated word usageDimitri Papadopoulos2026-07-086-7/+7
| | | | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:11 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* BIO: avoid returning internal FILE * with UPLINK-enabled builds on Windowsolszomal2026-07-081-1/+7
| | | | | | | | | | | | | | | | On Windows with UPLINK enabled, BIO_get_fp() may return a FILE * pointer incompatible with the C runtime. Ensure that it returns NULL instead, preventing undefined behavior in applications. Update the documentation to include the missing return type for BIO_[gs]et_fp() and remove the mention that BIO_get_fp() never returns 0, as it does so now when NULL fp is returned. Signed-off-by: olszomal <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 09:47:40 2026 (Merged from https://github.com/openssl/openssl/pull/28172)
* Fix crash in EVP_MD_CTX_copy_ex on inconsistent contextIngo Franzki2026-07-081-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | EVP_MD_CTX_copy_ex() might crash on an NULL pointer access when an inconsistent context is copied. This happens when a context is copied where digest is set but algctx is NULL, i.e. due to an incomplete initialization. The copyctx shortcut for cases where the in and out contexts use the exact same digest call the copyctx function attempting to copy the algctx, but it does not check if algctx is NULL on the in or out contexts. Fix this by only taking the copyctx shortcut if algctx is non-NULL on both, in and out. Otherwise use the full copy path which will only duplicate the algctx if it is non-NULL. Closes: https://github.com/openssl/openssl/issues/31831 Signed-off-by: Ingo Franzki <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/31867)
* crypto/x509/x509_lu.c: fix memory leak in obj_ht_foreach_object()Nikola Pajkovsky2026-07-071-0/+1
| | | | | | | | | | | | | | | | | | | | when sk_X509_OBJECT_push() fails after x509_object_dup() has already allocated the duplicate, the dup is neither stored on the destination stack nor freed: the error path only pop_free()s the stack the dup was never pushed onto, so it is leaked. Set env ASAN_OPTIONS in test explicitly to detect_leaks=1 to force ASAN to fail the test. Otherwise, the test reports ok even with valid leak. Fixes: 08cecb4448e9 "Add X509_STORE_get1_objects" Fixes: https://github.com/openssl/openssl/issues/31771 Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Tue Jul 7 07:42:17 2026 (Merged from https://github.com/openssl/openssl/pull/31784)
* Replace use of CRYPTO_GET_REF in bio_libNeil Horman2026-07-041-12/+17
| | | | | | | | | | | | | | | | | | | | BIO_free_all makes use of CRYPTO_GET_REF to determine if there is another user of a BIO chain at some artibrary point within the chain. But CRYPTO_GET_REF is begging for a TOCTOU error, and so we're deprecating it. replace the use of GET_REF with an internal version of BIO_free that returns the value of the resultant ref count, and use that instead, so we are TOCTOU free Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Sat Jul 4 16:47:13 2026 (Merged from https://github.com/openssl/openssl/pull/31750)
* crypto/x509: replace O(N^2) RFC 3779 canonicalisation merge with linear sweepNiels Provos2026-07-032-130/+191
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ASIdentifierChoice_canonize and IPAddressOrRanges_canonize previously merged adjacent entries with an in-place loop that called sk_..._delete() after each merge, making the merge O(N^2) due to the per-merge stack shift. Replace the merge with a single linear sweep using a write index distinct from the read cursor: mergeable entries fold into the previous output's upper bound in O(1), non-mergeable entries are slid forward into the write slot, and the source slot is set to NULL so the ASN.1 free machinery cannot double-free on a subsequent abort. Canonicalisation is now O(N log N) overall, bounded by the existing sort. Mixed-state-on-error safety is provided by the caller's normal teardown path: OPENSSL_sk_pop unlinks without freeing, OPENSSL_sk_set replaces without freeing the displaced value, and ossl_asn1_item_embed_free no-ops on NULL slots, so returning early on an inner failure leaves the stack in a state that the choice's normal free path handles cleanly. New regression tests in test/v3ext.c at N=8192 cover the all-merge, no-merge, interleaved (slide-forward), range-merge, overlap-mid-sweep, and inverted-range-mid-sweep paths; the mixed-state teardown invariant is exercised under ASan + UBSan. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Fri Jul 3 19:20:01 2026 (Merged from https://github.com/openssl/openssl/pull/31147)
generated by cgit (git 2.51.2) at 2026-10-25 16:04:40 +0100