[openssl/openssl] 8194b4: Add regression test for negative EVP_CIPHER_get_iv...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 8194b426f9a8a3e92723fb838157985001eed85f
      https://github.com/openssl/openssl/commit/8194b426f9a8a3e92723fb838157985001eed85f
  Author: Weidong Wang <[email protected]>
  Date:   2026-07-20 (Mon, 20 Jul 2026)

  Changed paths:
    M test/pbetest.c

  Log Message:
  -----------
  Add regression test for negative EVP_CIPHER_get_iv_length() in PKCS5_pbe2_set_scrypt

A malicious provider returning SIZE_MAX as IV length causes
evp_cipher_cache_constants() to store -1 via size_t->int truncation.
Without the ivlen > 0 guard, this leads to memcpy(iv[16], aiv, SIZE_MAX)
— a stack buffer overflow.

The test registers a fake provider with SIZE_MAX IV length, then calls
PKCS5_pbe2_set_scrypt() and asserts it returns NULL without crashing.

test for #30510

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Jul 20 11:15:18 2026
(Merged from https://github.com/openssl/openssl/pull/30615)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/437e09-8194b4%40github.com.