Commit 695eb4bd64 for openssl.org

commit 695eb4bd6488ea017fd35b32f70c7754aa81110a
Author: Loganaden Velvindron <logan@cyberstorm.mu>
Date:   Thu Jul 2 09:13:45 2026 +0400

    ml_kem: Add a check for shared_secret

    Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Tim Hudson <tjh@openssl.org>
    MergeDate: Mon Jul 20 11:21:15 2026
    (Merged from https://github.com/openssl/openssl/pull/31822)

diff --git a/crypto/ml_kem/ml_kem.c b/crypto/ml_kem/ml_kem.c
index 27fa15e246..89960dc105 100644
--- a/crypto/ml_kem/ml_kem.c
+++ b/crypto/ml_kem/ml_kem.c
@@ -2032,11 +2032,13 @@ int ossl_ml_kem_decap(uint8_t *shared_secret, size_t slen,
 #endif

     /* Need a private key here */
-    if (!ossl_ml_kem_have_prvkey(key))
+    if (!ossl_ml_kem_have_prvkey(key)
+        || shared_secret == NULL
+        || slen < ML_KEM_SHARED_SECRET_BYTES)
         return 0;
     vinfo = key->vinfo;

-    if (shared_secret == NULL || slen != ML_KEM_SHARED_SECRET_BYTES
+    if (slen != ML_KEM_SHARED_SECRET_BYTES
         || ctext == NULL || clen != vinfo->ctext_bytes
         || (mdctx = EVP_MD_CTX_new()) == NULL) {
         (void)RAND_bytes_ex(key->libctx, shared_secret,