Commit f8c7d65c6c for openssl.org

commit f8c7d65c6cea5710acf55e769ee37988c416217a
Author: Neil Horman <nhorman@openssl.org>
Date:   Mon Aug 17 13:50:37 2026 -0400

    Fix time_t / integer compares in tls13tickettest

    Coverity flagged a few instances of the above test calling
    SSL_SESSION_set_time_ex and casting the result to an int for comparison,
    but ints are smaller than time_t's so we may get faulty comparisons.

    Fix it by using the proper TEST_time_t_gt check instead of TEST_int_gt

    Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1700237
    Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1700236
    Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1700235
    Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1700234

    Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
    Reviewed-by: Bob Beck <beck@openssl.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Wed Aug 19 03:31:50 2026
    (Merged from https://github.com/openssl/openssl/pull/32410)

diff --git a/test/tls13tickettest.c b/test/tls13tickettest.c
index ab15ec73cb..8692d60dd1 100644
--- a/test/tls13tickettest.c
+++ b/test/tls13tickettest.c
@@ -964,7 +964,7 @@ static int test_tls13_ticket_client_age_mismatch_reject_early_data_retry(void)
         && TEST_uint_eq(initial.c.stats.ch_has_psk_kex_modes, 1)
         && TEST_uint_eq(initial.s.stats.ch_has_psk_kex_modes, 1)
         && TEST_ptr(sess = SSL_get1_session(initial.c.ssl))
-        && TEST_int_gt((int)SSL_SESSION_set_time_ex(sess, time(NULL) - 10), 0)
+        && TEST_time_t_gt(SSL_SESSION_set_time_ex(sess, time(NULL) - 10), 0)
         && TEST_true(tls_channel_init(c, s, &resumed))
         && TEST_true(SSL_set_session(resumed.c.ssl, sess))
         && TEST_true(tls_early_data_retry(&resumed))
@@ -1036,7 +1036,7 @@ static int test_tls13_ticket_server_age_mismatch_reject_early_data(void)
         && TEST_uint_eq(initial.c.stats.ch_has_psk_kex_modes, 1)
         && TEST_uint_eq(initial.s.stats.ch_has_psk_kex_modes, 1)
         && TEST_ptr(sess = SSL_get1_session(initial.c.ssl))
-        && TEST_int_gt((int)SSL_SESSION_set_time_ex(sess, time(NULL) - 10), 0)
+        && TEST_time_t_gt(SSL_SESSION_set_time_ex(sess, time(NULL) - 10), 0)
         && TEST_true(tls_channel_init(c, s, &resumed))
         && TEST_true(SSL_set_session(resumed.c.ssl, sess))
         && TEST_true(SSL_write_early_data(resumed.c.ssl, m, sizeof(m), &w))
@@ -1103,7 +1103,7 @@ static int test_tls13_ticket_client_age_mismatch_reject_early_data_outer(void)
         && TEST_uint_eq(initial.c.stats.ch_has_psk_kex_modes, 1)
         && TEST_uint_eq(initial.s.stats.ch_has_psk_kex_modes, 1)
         && TEST_ptr(sess = SSL_get1_session(initial.c.ssl))
-        && TEST_int_gt((int)SSL_SESSION_set_time_ex(sess, time(NULL) - 10), 0)
+        && TEST_time_t_gt(SSL_SESSION_set_time_ex(sess, time(NULL) - 10), 0)
         && TEST_true(tls_channel_init(c, s, &resumed))
         && TEST_true(SSL_set_session(resumed.c.ssl, sess))
         && TEST_true(tls_early_data_retry(&resumed))
@@ -1212,7 +1212,7 @@ static int test_tls13_aged_ticket_external_psk_early_data(void)
         && TEST_true(tls_shutdown(&initial))
         && TEST_ptr(sess = SSL_get1_session(initial.c.ssl))
         /* Retire the (0-RTT-capable) ticket so it is not offered at slot 0. */
-        && TEST_int_gt((int)SSL_SESSION_set_time_ex(sess, time(NULL) - 10), 0)
+        && TEST_time_t_gt(SSL_SESSION_set_time_ex(sess, time(NULL) - 10), 0)
         && TEST_true(tls_channel_init(c, s, &resumed))
         && TEST_true(SSL_set_session(resumed.c.ssl, sess))
         && TEST_true(enable_external_psk(resumed.c.ssl, resumed.s.ssl))