[openssl/openssl] ebfcd4: Fix false success on zero BIO write

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: ebfcd4cfd4b7f85bfdc8464b66bf8e5e291d9208
      https://github.com/openssl/openssl/commit/ebfcd4cfd4b7f85bfdc8464b66bf8e5e291d9208
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M ssl/record/methods/tls_common.c
    M test/helpers/ssltestlib.c
    M test/helpers/ssltestlib.h
    M test/sslapitest.c

  Log Message:
  -----------
  Fix false success on zero BIO write

The TLS record layer treated BIO_write returning 0 as success unless
the BIO retry flag was set. For a write with data pending in the write
buffer, this could report success to the application while leaving record
data pending internally.

Capture the pending buffer length before the transport write. If a
positive length write returns zero, return retry when the BIO retry flag
is set and fatal otherwise. Do not queue an SSL reason for the fatal
zero-without-retry case: a custom BIO can return zero without retry
without this implying an SSL library or protocol error, so SSL_get_error()
reports SSL_ERROR_SYSCALL with an empty error queue.

Preserve the KTLS empty fragment case where the pending length is already
zero and a zero byte write is expected to succeed.

For DTLS, the same zero return without retry condition is now treated as
fatal; the failed buffer is still dropped in the existing DTLS write error
path. This intentionally tightens the previous behavior, which could treat
the zero return as success.

Add regression coverage with a custom BIO that returns 0 without setting
retry for a positive length write.

Fixes #31009

Reviewed-by: Jakub Zelenka <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Mon Aug  3 12:39:18 2026
(Merged from https://github.com/openssl/openssl/pull/31021)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/d8c510-ebfcd4%40github.com.