[libraries/qca] plugins/qca-ossl: qca-ossl: load the default OpenSSL provider explicitly

Git commit a818965a3e67f1212ee5fed1d70a9a8b4ced8dcc by Nekto Oleg.
Committed on 02/08/2026 at 05:15.
Pushed by aacid into branch 'master'.

qca-ossl: load the default OpenSSL provider explicitly

Activating any provider disables OpenSSL 3's implicit loading of the
default one. Qt unloads the default provider while setting up its TLS
backend, so loading only the legacy provider afterwards leaves the
library context without the algorithms DH key generation needs.
DH_generate_key() then fails silently and PrivateKey::deriveKey()
dereferences the resulting null key.

Applications reach this through the Secret Service API: ksecretd
segfaults in deriveKey() whenever a client opens a session using the
dh-ietf1024-sha256-aes128-cbc-pkcs7 algorithm, which is what every
libsecret-based client requests.

Loading the default provider is a no-op when it is already present, so
setups that were never affected keep their current behaviour.

BUG: 482819
FIXED-IN: 2.3.11

M  +5    -0    plugins/qca-ossl/qca-ossl.cpp

https://invent.kde.org/libraries/qca/-/commit/a818965a3e67f1212ee5fed1d70a9a8b4ced8dcc

diff --git a/plugins/qca-ossl/qca-ossl.cpp b/plugins/qca-ossl/qca-ossl.cpp
index 7ab1b47d..becfcc31 100644
--- a/plugins/qca-ossl/qca-ossl.cpp
+++ b/plugins/qca-ossl/qca-ossl.cpp
@@ -6667,6 +6667,11 @@ public:
         openssl_initted = false;
 // OPENSSL_VERSION_MAJOR is only defined in openssl3
 #ifdef OPENSSL_VERSION_MAJOR
+        /* Activating a provider explicitly disables the implicit loading of
+           the default one, so make sure it is present before asking for the
+           legacy provider below. Loading it again is a no-op. */
+        OSSL_PROVIDER_try_load(nullptr, "default", 1);
+
         /* Load the legacy providers into the default (NULL) library context */
         if (OSSL_PROVIDER_try_load(nullptr, "legacy", 1)) {
             s_legacyProviderAvailable = true;