Commit 05b65fcb22 for openssl.org

commit 05b65fcb223cd3d899b595d3ec798e134f5f36d6
Author: Adel-Ayoub <adelayoub.maaziz@gmail.com>
Date:   Fri Jul 3 17:47:50 2026 +0100

    crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checks

    EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD
    and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value,
    so the "< 0" checks on the cipher-with-MAC path cannot detect any
    failure.  A return of 0 means a failed or unsupported control, or
    for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is
    usable here.

    Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG
    check fixed by commit 674c23d2656e in this function.

    Follow-up to https://github.com/openssl/openssl/pull/30923.

    Fixes: ea0add4a8227 "New GOST PKCS12 standard support"

    CLA: trivial

    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    MergeDate: Mon Jul 27 10:21:13 2026
    (Merged from https://github.com/openssl/openssl/pull/31848)

diff --git a/crypto/pkcs12/p12_decr.c b/crypto/pkcs12/p12_decr.c
index 535481cdfe..5b51f69027 100644
--- a/crypto/pkcs12/p12_decr.c
+++ b/crypto/pkcs12/p12_decr.c
@@ -57,7 +57,8 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor,
     if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx))
             & EVP_CIPH_FLAG_CIPHER_WITH_MAC)
         != 0) {
-        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len) < 0) {
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len)
+            <= 0) {
             ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
             goto err;
         }
@@ -72,7 +73,7 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor,
             inlen -= mac_len;
             if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
                     (int)mac_len, (unsigned char *)in + inlen)
-                < 0) {
+                <= 0) {
                 ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
                 goto err;
             }