[openssl/openssl] e86673: Add regression test for negative EVP_CIPHER_get_iv...

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: e86673d347e7052f7b96e05cc489d8a174ef5768
      https://github.com/openssl/openssl/commit/e86673d347e7052f7b96e05cc489d8a174ef5768
  Author: Weidong Wang <[email protected]>
  Date:   2026-07-20 (Mon, 20 Jul 2026)

  Changed paths:
    M test/pbetest.c

  Log Message:
  -----------
  Add regression test for negative EVP_CIPHER_get_iv_length() in PKCS5_pbe2_set_scrypt

A malicious provider returning SIZE_MAX as IV length causes
evp_cipher_cache_constants() to store -1 via size_t->int truncation.
Without the ivlen > 0 guard, this leads to memcpy(iv[16], aiv, SIZE_MAX)
— a stack buffer overflow.

The test registers a fake provider with SIZE_MAX IV length, then calls
PKCS5_pbe2_set_scrypt() and asserts it returns NULL without crashing.

test for #30510

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Jul 20 11:15:33 2026
(Merged from https://github.com/openssl/openssl/pull/30615)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/ab4940-e86673%40github.com.