[openssl/openssl] 05b65f: crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl ...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 05b65fcb223cd3d899b595d3ec798e134f5f36d6
      https://github.com/openssl/openssl/commit/05b65fcb223cd3d899b595d3ec798e134f5f36d6
  Author: Adel-Ayoub <[email protected]>
  Date:   2026-07-27 (Mon, 27 Jul 2026)

  Changed paths:
    M crypto/pkcs12/p12_decr.c

  Log Message:
  -----------
  crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checks

EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD
and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value,
so the "< 0" checks on the cipher-with-MAC path cannot detect any
failure.  A return of 0 means a failed or unsupported control, or
for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is
usable here.

Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG
check fixed by commit 674c23d2656e in this function.

Follow-up to https://github.com/openssl/openssl/pull/30923.

Fixes: ea0add4a8227 "New GOST PKCS12 standard support"

CLA: trivial

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Jakub Zelenka <[email protected]>
MergeDate: Mon Jul 27 10:21:13 2026
(Merged from https://github.com/openssl/openssl/pull/31848)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/acddc9-05b65f%40github.com.