14561 Commits

Author	SHA1	Message	Date
DONGGEUN YOO	8cfb565117	ts_conf: fix memory leak in TS_CONF_set_policies ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28686) (cherry picked from commit 1f3a6602a1)	2025-10-01 17:55:18 +02:00
Ryan Hooper	b5ab449e26	Fix Memory leak in CMS_EncryptedData_set1_key ... When CMS_EncryptedData_set1_key is called repeatedly it will leak data on the second call. This was because cms->d.encryptedData was already set and needed to be cleared before the call to M_ASN1_new_of. Fixes: #28606 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28668) (cherry picked from commit 7de825efa2)	2025-10-01 17:49:39 +02:00
openssl-machine	486805eb19	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Release: yes	2025-09-30 13:03:21 +00:00
Tomas Mraz	89e790ac43	use_proxy(): Add missing terminating NUL byte ... Fixes CVE-2025-9232 There is a missing terminating NUL byte after strncpy() call. Issue and a proposed fix reported by Stanislav Fort (Aisle Research). Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 6bca15039e)	2025-09-29 12:04:39 +02:00
Tomas Mraz	ce9179e711	ecp_sm2p256.c: Remove unused code ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 56c89cd2de)	2025-09-29 12:02:46 +02:00
Tomas Mraz	cba616c26a	SM2: Use constant time modular inversion ... Fixes CVE-2025-9231 Issue and a proposed fix reported by Stanislav Fort (Aisle Research). Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit dff94dba75)	2025-09-29 12:02:45 +02:00
Viktor Dukhovni	b5282d6775	kek_unwrap_key(): Fix incorrect check of unwrapped key size ... Fixes CVE-2025-9230 The check is off by 8 bytes so it is possible to overread by up to 8 bytes and overwrite up to 4 bytes. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit 9c462be2ce)	2025-09-29 11:59:42 +02:00
Eugene Syromiatnikov	71b94f07ed	crypto/evp/ctrl_params_translate.c: fix a typo in the error message ... The ERR_raise_data() call on failure to find ctx->p2 in str_value_map erroneously refers to ctx->p1 instead; fix that but supplying the correct field and casting it to the supposed const char * type. Fixes: 9a1c4e41e8 "EVP: Implement data-driven translation between known ctrl and OSSL_PARAMs" Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665427 References: https://github.com/openssl/project/issues/1432 Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28648) (cherry picked from commit a53013196c)	2025-09-25 17:00:40 +02:00
Eugene Syromiatnikov	35f00f7971	crypto/bio/bss_file.c: add missing cast in format arg in ERR_raise_data() ... "%s" conversion specifier requires a "char *" argument, so ptr needs to be cast to it there, as Coverity has noted. Fixes: ff988500c2 "Replace FUNCerr with ERR_raise_data" Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665423 References: https://github.com/openssl/project/issues/1432 Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28648) (cherry picked from commit d575fa897d)	2025-09-25 17:00:39 +02:00
Eugene Syromiatnikov	5cbc462a15	crypto/x509/t_x509.c: check i2d_X509_NAME() return value in X509_ocspid_print() ... There is little reason for this call to fail, but there is also little reason for not to check for it, and, since Coverity noticed that the check is missing, just add it. Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665420 References: https://github.com/openssl/project/issues/1432 Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28648) (cherry picked from commit 19b3dcbbc2)	2025-09-25 17:00:37 +02:00
Daniel Kubec	1e2061548e	Fix EVP_PKEY_can_sign() handling of NULL from query_operation_name() ... EVP_PKEY_can_sign() assumed query_operation_name(OSSL_OP_SIGNATURE) always returns a non-NULL string. According to the documentation, query_operation_name() may return NULL, in which case EVP_KEYMGMT_get0_name() should be used as a fallback. Fixes #27790 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28641) (cherry picked from commit 0c2d67f417)	2025-09-25 15:29:10 +02:00
Tomas Mraz	5c3602ca5c	Fix doublefree after failure in ossl_siv128_init() ... The issue was reported by Ronald Crane from Zippenhop LLC. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28644) (cherry picked from commit 3185e27624)	2025-09-25 10:45:53 +02:00
Bernd Edlinger	51992d03f4	Do not use RW mutexes on RISC-V arch ... For unknown reasons using RW mutexes on RISC-V arch seems to be broken, at least with glibc. Fixes #28550 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28635) (cherry picked from commit 728d5cf9e1)	2025-09-24 10:33:02 -04:00
Neil Horman	d0307fefac	disable rwlocks on nonstop klt model ... It appears nonstops new threading model defines some level of rwlock pthread api, but its not working properly. Disable rwlocks for _KLT_MODEL_ for now Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28635) (cherry picked from commit d8ecbb37dc)	2025-09-24 10:32:59 -04:00
Bernd Edlinger	0bf9e3ebfc	Print PowerPC CPUINFO ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28535) (cherry picked from commit 03a9584499)	2025-09-24 08:50:57 -04:00
Nikola Pajkovsky	fc6d1cbe20	x509: fix mem leak on error path ... The x509_store_add() creates X509_OBJECT wrapping either X509 or X509_CRL. However, if you set the type to X509_LU_NONE before X509_OBJECT_free then it skips the free on the wrapped type and just calls OPENSSL_free on the object itself. Hence, leaking wrapped object. Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28631) (cherry picked from commit 8a4ef31f3a)	2025-09-23 16:43:39 +02:00
Luigino Camastra	192ac44aaf	bio_ok.c: Integer Overflow in BIO_f_reliable record parser leads to Out-of-Bounds Read ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28504) (cherry picked from commit 312904b216)	2025-09-23 12:02:01 +02:00
Viktor Dukhovni	9a3ba04de5	Harden property put_str() helper corner case ... The put_str() helper of the internal ossl_property_list_to_string() function failed to correctly check the remaining buffer length in a corner case in which a property name or string value needs quoting, and exactly one byte of unused space remained in the output buffer. The only potentially affected calling code is conditionally compiled (disabled by default) provider "QUERY" tracing that is executed only when also requested at runtime. An initial fragment of the property list encoding would need to use up exactly 511 bytes, leaving just 1 byte for the next string which requires quoting. Bug reported by Aniruddhan Murali (@ashamedbit) Noble Saji Mathews (@NobleMathews) both from the University of Waterloo. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/28624) (cherry picked from commit c6e44fa347)	2025-09-23 11:57:50 +02:00
Viktor Dukhovni	05c3778af4	Harden RSA public encrypt ... Check the that the indicated output buffer length is large enough. Fix EVP_SealInit() to initialise the output buffer length to the RSA modulus length, not the input KEK length. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28538)	2025-09-16 10:36:56 -04:00
Eugene Syromiatnikov	1a97cbcc21	crypto/rand/randfile.c: avoid signed integer overflow in RAND_load_file ... If a file supplied to RAND_load_file is too big (more than INT_MAX bytes), it is possible to trigger a signer integer overflow during ret calculation. Avoid it by returning early when we are about to hit it on the next iteration. Reported-by: Liu-Ermeng <liuermeng2@huawei.com> Resolves: https://github.com/openssl/openssl/issues/28375 Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28379) (cherry picked from commit 35db6a15d4)	2025-09-09 20:22:44 +02:00
David Benjamin	4855bca399	Add a helper function to delete the extension list ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28398) (cherry picked from commit 9e8898b6b6)	2025-09-09 11:13:48 +02:00
David Benjamin	e32015b8f4	Clear the extension list when removing the last extension ... The extensions list in a certificate, CRL, and CRL entry is defined as: ... extensions [3] EXPLICIT Extensions OPTIONAL ... ... crlEntryExtensions Extensions OPTIONAL ... ... crlExtensions [0] EXPLICIT Extensions OPTIONAL ... Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension This means that a present but empty extensions list is actually invalid. Rather, if you have no extensions to encode, you are meant to omit the list altogether. Fix the delete_ext functions to handle this correctly. This would mostly be moot, as an application adding extensions only to delete them all would be unusual. However, #13658 implemented a slightly roundabout design where, to omit SKID/AKID, the library first puts them in and then the command-line tool detects some placeholder values and deletes the extension again. Fixes #28397 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28398) (cherry picked from commit 9a8d7dc142)	2025-09-09 11:13:46 +02:00
Eugene Syromiatnikov	3b83a7183c	crypto/x509/t_req.c: avoid exts leaking on error paths ... If an error occurred and jump to the "err" label is performed after exts has been allocated, it can leak. Avoid that by adding sk_X509_EXTENSION_pop_free() on the error path and setting exts to NULL after sk_X509_EXTENSION_pop_free() in the normal handling. Fixes: ae880ae671 "Fix error handling in X509_REQ_print_ex" Fixes: 87c49f622e "Support for parsing of certificate extensions in PKCS#10 requests: these are" Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665161 References: https://github.com/openssl/project/issues/1362 Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28408)	2025-09-06 10:11:45 -04:00
Dr. David von Oheimb	3205daf5b6	X509_VERIFY_PARAM_get0(): add check to defend on out-of-bound table access ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28404) (cherry picked from commit 4ed6cfce58)	2025-09-03 17:57:13 +02:00
Holger Dengler	e0bdd5faa8	aes-s390x.pl: Initialize reserved and unused memory ... The reserved bytes in the parameter block (bytes 0-11) for the KMA instruction should be set to zero to be compatible in case of future architecture changes. While at it, also the following unused parts of the parameter block (bytes 48-63) are also cleared to avoid false positives with various memory checkers like valgrind. As it makes - performance wise - no difference to process 12, 48 or 64 bytes with one XC call, but two XC calls are slower than one call, the first 64 bytes of the parameter block will be cleared with a single XC call. This will also initialize the counter in the parameter block (bytes 12-15), although it is not strictly necessary. Co-developed-by: Juergen Christ <jchrist@linux.ibm.com> Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28315) (cherry picked from commit 899623b29c)	2025-08-29 10:40:06 -04:00
ritoban23	1aa1863056	Fix null pointer check in pkey_dh_derive to ensure both keys are set ... CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/28259) (cherry picked from commit fc84d46d72) (cherry picked from commit 0163c6ad1f) (cherry picked from commit 257c3dd6cd) (cherry picked from commit eb1e036728)	2025-08-22 11:30:03 -04:00
Niels Dossche	9e8eaa2cfc	Make error checks on RSA_public_decrypt() consistent ... Some are only checking for a value < 0, some for <= 0, some for == 0, etc. The documentation tells us that -1 is returned on error, so at least the == 0 ones are wrong. In general, the return values are checked inconsistently. This patch makes the return value checks consistent to the form that seems to occur most. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28306) (cherry picked from commit 3e2f54a718)	2025-08-21 20:05:26 +02:00
Matt Caswell	f0c9ea7843	Fix a race in by_store_subject ... When looking in the stack of objects in the store we need to ensure we are holding a read lock for the store. Issue detected via thread sanitizer after the test from the previous commit was added. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28198) (cherry picked from commit 07f65e16c2)	2025-08-21 14:46:29 +02:00
Matt Caswell	2374efa321	Don't keep the store open in by_store_ctrl_ex ... Previously #27529 made a change to `by_store_ctrl_ex` in order to open the OSSL_STORE early. The reason given in that PR is: "This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded" That PR then kept the store open until cache_objects is called and then reused it. Unfortunately by the time cache_objects() is called we could be in a multi-threaded scenario where the X509_STORE is being shared by multiple threads. We then get a race condition where multiple threads are all using (and ultimately closing) the same `OSSL_STORE_CTX`. The purpose of keeping the `OSSL_STORE` object between by_store_ctrl_ex() and `cache_objects` is presumably an optimisation to avoid having to open the store twice. But this does not work because of the above issue. We just take the hit and open it again. Fixes #28171 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28198) (cherry picked from commit 08951fb273)	2025-08-21 14:42:17 +02:00
Eugene Syromiatnikov	f015c74c56	crypto/sleep.c: avoid returning early due to signal ... On POSIX systems, sleep/usleep/nanosleep may return early due to arrival of a signal, and OSSL_sleep does not report that, so it is assumed that it cannot return early. Fix that by introducing a loop that checks the remaining time and sleep some more if the time has not passed; that also solves the issue of limited sleeping time on some systems. Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28197)	2025-08-21 14:06:04 +02:00
Nikolas Gauder	8adfc5ff0d	BIO_dgram: Fix BIO_CTRL_DGRAM_QUERY_MTU for IPv4-mapped IPv6 addresses ... Ensure the correct IP header size is subtracted by reusing dgram_get_mtu_overhead(), which handles address families properly. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28088) (cherry picked from commit a71b4fae43)	2025-08-18 18:06:22 +02:00
Dr. David von Oheimb	301069e6a5	fix asn1_write_micalg() in asn_mime.c on GostR3411 and SHAKE ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27567) (cherry picked from commit e4c515833d)	2025-08-18 18:03:50 +02:00
Bernd Edlinger	9197d8f8ed	DH private key size was one bit too large ... In the case when no q parameter was given, the function generate_key in dh_key.c did create one bit too much, so the priv_key value was exceeding the DH group size q = (p-1)/2. When the length is used in this case the limit is also one bit too high, but for backward compatibility this limit was left as is, instead we have to silently reduce the value by one. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27870) (cherry picked from commit d6510d99ae)	2025-08-13 11:25:23 +02:00
77tiann	38dfa2cee2	Fix memory leak on EVP_CIPHER_param_to_asn1 failure ... When EVP_CIPHER_param_to_asn1() fails, xalg->parameter was not freed, leading to a memory leak. This patch adds proper cleanup for that case. CLA: trivial Signed-off-by: 77tiann <27392025k@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28131) (cherry picked from commit bda2473a44)	2025-08-11 16:55:22 +02:00
Richard Levitte	c3ce4adb91	Fix OSSL_STORE to consider cached info in the EOF check. ... OSSL_STORE_load() called OSSL_STORE_eof() before checking if there is cached OSSL_STORE_INFO to consider. To fix this issue, the cached info check is moved to OSSL_STORE_eof(), as that seems to make most common sense. This solves an issue with PKCS#12 files, where the cached info was never considered because the underlying file IO layer signaled that EOF is reached. Fixes #28010 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/28016) (cherry picked from commit 1f3af48c31)	2025-07-26 11:36:08 +02:00
AntonMoryakov	93bf938cba	sm2: sm2_sign.c: check EC_KEY_get0_private_key() for NULL in sm2_sig_gen() ... Static analysis revealed that sm2_sig_gen() dereferences the return value of EC_KEY_get0_private_key() without checking for NULL. This could lead to a crash if the private key is unset. This patch adds a NULL check and raises ERR_R_PASSED_NULL_PARAMETER if the key is missing. Issue found by static analyzer: > Return value of EC_KEY_get0_private_key() is dereferenced without checking for NULL (11/12 checked) CLA: trivial Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27741) (cherry picked from commit c108ead284)	2025-07-25 12:07:44 +02:00
openssl-machine	e9d98629ed	Copyright year updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2025-07-01 12:04:53 +00:00
Christian Vögl	15ddbf5b18	Fix nullpointer dereference in OSSL_PARAM_merge ... OSSL_PARAM_merge contained an error, where a nullpointer was dereferenced when both parameter arrays ended with the same key Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27910) (cherry picked from commit 63cb8f99a1)	2025-06-30 11:14:33 +01:00
Viktor Dukhovni	974f8bb198	Allow keygen after dup of minimal PKEY ctx ... It should be possible to repeatedly duplicate a PKEY CTX created via EVP_PKEY_CTX_new_from_name() that has not yet been assigned an "operation" (e.g. via EVP_PKEY_CTX_keygen_init()), and then perform keygen_init() and keygen() on the duplicated copies. When the operation is not yet set, all that's needed is to not try to use the key if one isn't set yet. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27662) (cherry picked from commit 2c74a8d1ef)	2025-06-10 19:44:27 +02:00
Daniel Van Geest	b482ce42e4	Fix SHAKE AlgorithmIdentifier encodings ... NIST CSOR specifies that the id-shake128 and id-shake256 algorithm identifiers, like the SHA-3 ones, do not carry any parameters. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27190) (cherry picked from commit bef03c6a24)	2025-06-10 19:42:31 +02:00
Pauli	98056c1df4	rand: add argument error checking to EVP_RAND_nonce() ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27766) (cherry picked from commit a2cd7ecd75)	2025-06-09 10:27:59 +02:00
Pauli	f60b527812	rand: produce correct return from EVP_RAND_nonce ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27766) (cherry picked from commit a2b9120d15)	2025-06-09 10:27:58 +02:00
Neil Horman	6429c55c40	Allow for reuse of thread_local keys in threads_none ... If openssl is configured with no-threads, the implementation has a hard limit of 256 LIB_CTX values, as each LIB_CTX allocates a thread local key, and we never reuse them (like libc does when using pthread_key_create/destroy. Improve the situation by allowing for marking freed keys as unsued and searching for an available key when allocating Fixes #27757 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27775) (cherry picked from commit b6d01d1b1f)	2025-06-06 14:13:45 -04:00
Frederik Wedel-Heinen	aa33fc08c5	Handle 0 return values from DH key computations as errors ... Returned 0 from ossl_dh_compute_key(), DH_compute_key_padded() and DH_compute_key() needs to be treated as an error. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27673) (cherry picked from commit 1c1ce2a6ee)	2025-06-03 14:28:47 +02:00
JiashengJiang	54e738bdcb	crypto/property/property.c: Free impl->method to avoid memory leak ... After ossl_method_up_ref() succeeds, impl_free() should be called to free impl->method. Fixes: 860ecfd ("property: check return values from the property locking calls.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27564) (cherry picked from commit 00c531a5e3)	2025-05-29 16:40:42 +02:00
Viktor Dukhovni	66c043e5cc	Note finished state in cipher BIO EOF ... When the cipher BIO encounters a non-retriable EOF (or error), mark the state as "finished", else a subsequent BIO_flush() or attempted read may attempt to finalise the crypto state again, and fail, leading, for example, to users seeing erroneous apparent decryption failure. This is not a new problem, the fix should be backported to all supported releases. It was made more apparent by recent changes to the base64 BIO, which returns a non-retriable EOF when padding is seen at the end of the base64 data, even if the underlying next BIO is "retriable". Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27680) (cherry picked from commit 005fa3e00e)	2025-05-29 16:03:11 +02:00
JiashengJiang	a381691377	crypto/pkcs7/pk7_smime.c: Add BIO_free() to avoid memory leak ... Add BIO_free() to free tmpout if OPENSSL_malloc() fails to avoid memory leak. Fixes: 8e70485 ("RT3955: Reduce some stack usage") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27631) (cherry picked from commit 9882d389df)	2025-05-27 19:49:43 +02:00
widneve	976a771cb9	Fix memory leaks after failure of PKCS7_add_signed_attribute() ... If PKCS7_add_signed_attribute fails, seq never escapes out of the callee and will therefore result in a memory leak. This is similar to ed3d277127. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27670) (cherry picked from commit 6543f34dda)	2025-05-23 17:37:23 +02:00
Richard Levitte	6a379f6f68	Drop "by store"'s by_store_subject_ex() ... It was used to pass libctx and propq, which would override the corresponding values passed to by_store_ctrl_ex(). This wasn't really reasonable to do either way, as it could potentially be a surprise to the user, who can reasonably expect that the URI is opened with the libctx and propq that was passed with the URI, and not with those passed later. (cherry picked from commit af5952d533) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27551) (cherry picked from commit 8bc0f6757d)	2025-05-20 14:09:14 +02:00
Richard Levitte	1432e8596e	Rework the "by store" X509_LOOKUP method to open the given URI early ... The cached X509_LOOKUP method data is no longer just the URI, but now includes the OSSL_STORE_CTX pointer, and required parameters to reopen the URI at any time. cache_objects() is modified to handle this, and only (re)open the URI when it wasn't previously opened, or when it was closed by an earlier call. This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded. This assumes that if the URI could be opened once, it can be opened again. Fixes #27461 (cherry picked from commit 0c48ee2bf5) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27551) (cherry picked from commit 08220efd4a)	2025-05-20 14:09:14 +02:00