Commit 0ddd6b6bcb for openssl.org

commit 0ddd6b6bcbdedbe2c8304af05771f8ab11939112
Author: Igor Ustinov <igus68@gmail.com>
Date:   Mon Jan 12 12:13:35 2026 +0100

    Correct handling of AEAD-encrypted CMS with inadmissibly long IV

    Fixes CVE-2025-15467

    Reviewed-by: Saša Nedvědický <sashan@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.org>
    MergeDate: Mon Jan 26 19:31:45 2026

diff --git a/crypto/evp/evp_lib.c b/crypto/evp/evp_lib.c
index f5a4d24e30..6c9421110b 100644
--- a/crypto/evp/evp_lib.c
+++ b/crypto/evp/evp_lib.c
@@ -214,10 +214,9 @@ int evp_cipher_get_asn1_aead_params(EVP_CIPHER_CTX *c, ASN1_TYPE *type,
     if (type == NULL || asn1_params == NULL)
         return 0;

-    i = ossl_asn1_type_get_octetstring_int(type, &tl, NULL, EVP_MAX_IV_LENGTH);
-    if (i <= 0)
+    i = ossl_asn1_type_get_octetstring_int(type, &tl, iv, EVP_MAX_IV_LENGTH);
+    if (i <= 0 || i > EVP_MAX_IV_LENGTH)
         return -1;
-    ossl_asn1_type_get_octetstring_int(type, &tl, iv, i);

     memcpy(asn1_params->iv, iv, i);
     asn1_params->iv_len = i;