Commit 05b65fcb22 for openssl.org
commit 05b65fcb223cd3d899b595d3ec798e134f5f36d6
Author: Adel-Ayoub <adelayoub.maaziz@gmail.com>
Date: Fri Jul 3 17:47:50 2026 +0100
crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checks
EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD
and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value,
so the "< 0" checks on the cipher-with-MAC path cannot detect any
failure. A return of 0 means a failed or unsupported control, or
for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is
usable here.
Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG
check fixed by commit 674c23d2656e in this function.
Follow-up to https://github.com/openssl/openssl/pull/30923.
Fixes: ea0add4a8227 "New GOST PKCS12 standard support"
CLA: trivial
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
MergeDate: Mon Jul 27 10:21:13 2026
(Merged from https://github.com/openssl/openssl/pull/31848)
diff --git a/crypto/pkcs12/p12_decr.c b/crypto/pkcs12/p12_decr.c
index 535481cdfe..5b51f69027 100644
--- a/crypto/pkcs12/p12_decr.c
+++ b/crypto/pkcs12/p12_decr.c
@@ -57,7 +57,8 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor,
if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx))
& EVP_CIPH_FLAG_CIPHER_WITH_MAC)
!= 0) {
- if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len) < 0) {
+ if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len)
+ <= 0) {
ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
goto err;
}
@@ -72,7 +73,7 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor,
inlen -= mac_len;
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
(int)mac_len, (unsigned char *)in + inlen)
- < 0) {
+ <= 0) {
ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
goto err;
}