Commit f440c47133 for openssl.org

commit f440c4713305b905240232030a699045636a2ab3
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date:   Wed Sep 23 02:00:19 2026 +0200

    doc/man3/ASN1_STRING_length.pod: document ASN1_STRING_length_set()

    Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Tue Nov 10 15:06:58 2026
    Merged-from: https://github.com/openssl/openssl/pull/32937

diff --git a/doc/man3/ASN1_STRING_length.pod b/doc/man3/ASN1_STRING_length.pod
index 4f982f0a0f..3c7498ba97 100644
--- a/doc/man3/ASN1_STRING_length.pod
+++ b/doc/man3/ASN1_STRING_length.pod
@@ -12,7 +12,8 @@ ASN1_STRING_set1_data,
 ASN1_STRING_set1_string,
 ASN1_STRING_get_length,
 ASN1_STRING_set,
-ASN1_STRING_length
+ASN1_STRING_length,
+ASN1_STRING_length_set
 - ASN1_STRING utility functions

 =head1 SYNOPSIS
@@ -45,6 +46,12 @@ see L<openssl_user_macros(7)>:

  int ASN1_STRING_length(ASN1_STRING *x);

+The following functions have been deprecated since OpenSSL 3.0, and can be
+hidden entirely by defining B<OPENSSL_API_COMPAT> with a suitable version value,
+see L<openssl_user_macros(7)>:
+
+ void ASN1_STRING_length_set(ASN1_STRING *x, int n);
+
 =head1 DESCRIPTION

 These functions allow an B<ASN1_STRING> structure to be manipulated.
@@ -93,6 +100,9 @@ include the terminating NUL. The length of
 I<out> is returned or a negative error code. The buffer I<*out>
 should be freed using OPENSSL_free(). See L</WARNINGS> below.

+ASN1_STRING_length_set() allows setting the length of I<x> to an arbitrary value
+provided in I<n>.
+
 =head1 NOTES

 Almost all ASN1 types in OpenSSL are represented as an B<ASN1_STRING>
@@ -117,6 +127,14 @@ Similar care should be taken to ensure the data is in the correct
 format when calling ASN1_STRING_set(), ASN1_STRING_set1_data(), or
 ASN1_STRING_set1_string().

+ASN1_STRING_length_set() updates only the length attribute of a string
+and does not affect the stored data, which may lead to buffer overruns
+and invalid memory accesses, if an incorrect length value is supplied.
+It also does not perform any sanity checks and stores any supplied value
+as-is, including a negative one.
+For these reasons (and due to limited usefulness), this function is deprecated
+and should not be used.
+
 =head1 WARNINGS

 Although the buffer returned by ASN1_STRING_to_UTF8() is NUL terminated and
@@ -152,12 +170,16 @@ ASN1_STRING_type() returns the type of I<x>.
 ASN1_STRING_to_UTF8() returns the number of bytes in output string I<out> or a
 negative value if an error occurred.

+ASN1_STRING_length_set() does not return a value.
+
 =head1 SEE ALSO

 L<ERR_get_error(3)>

 =head1 HISTORY

+ASN1_STRING_length_set() was deprecated in OpenSSL 3.0.
+
 ASN1_STRING_set1_data(), ASN1_STRING_set1_string(), and ASN1_STRING_get_length()
 were added in OpenSSL 4.1.

diff --git a/util/missingcrypto.txt b/util/missingcrypto.txt
index 69fe684203..023ab4cd3d 100644
--- a/util/missingcrypto.txt
+++ b/util/missingcrypto.txt
@@ -83,7 +83,6 @@ ASN1_SEQUENCE_ANY_it(3)
 ASN1_SEQUENCE_it(3)
 ASN1_SET_ANY_it(3)
 ASN1_STRING_get_default_mask(3)
-ASN1_STRING_length_set(3)
 ASN1_STRING_set0(3)
 ASN1_STRING_set_by_NID(3)
 ASN1_STRING_set_default_mask(3)