Commit 2fa266a443 for openssl.org

commit 2fa266a4430da52654f612381bdb44e094841113
Author: Alberto Maschietto <albertomaschietto9@gmail.com>
Date:   Fri Aug 21 00:13:34 2026 +0400

    providers/implementations/digests/cshake_prov.c: accept 512-byte customization

    The cSHAKE customization boundary check rejected the documented 512-byte
    maximum by using >= instead of >.  Accept the 512-byte boundary value
    and keep larger inputs rejected; also, check the encoding helpers'
    return values during initialization.  Add a test that checks
    for the usage of 511-, 512-, and 513-byte customization strings.

    Resolves: https://github.com/openssl/openssl/issues/32446
    Fixes: 9c738431411e "Add support for CSHAKE."
    Assisted-by: Claude Code:claude-opus-5
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Tue Nov  3 03:19:38 2026
    Merged-from: https://github.com/openssl/openssl/pull/32449

diff --git a/providers/implementations/digests/cshake_prov.c b/providers/implementations/digests/cshake_prov.c
index 7dd9c58940..7f4bf076ff 100644
--- a/providers/implementations/digests/cshake_prov.c
+++ b/providers/implementations/digests/cshake_prov.c
@@ -151,7 +151,7 @@ static int cshake_set_encode_string(const char *in,
      */
     if (inlen == 0)
         return 1;
-    if (inlen >= CSHAKE_MAX_STRING)
+    if (inlen > CSHAKE_MAX_STRING)
         return 0;
     return ossl_sp800_185_encode_string(out, outmax, outlen,
         (const unsigned char *)in, inlen);
@@ -270,8 +270,10 @@ static int cshake_init(void *vctx, const OSSL_PARAM params[])
         return 0;
     ctx->inited = 0;
     ctx->xoflen = (ctx->bitlen == 128) ? 32 : 64; /* Set default values here */
-    cshake_set_func_encode_string(NULL, &ctx->func, &ctx->funclen);
-    cshake_set_encode_string(NULL, ctx->custom, sizeof(ctx->custom), &ctx->customlen);
+    if (!cshake_set_func_encode_string(NULL, &ctx->func, &ctx->funclen)
+        || !cshake_set_encode_string(NULL, ctx->custom, sizeof(ctx->custom),
+            &ctx->customlen))
+        return 0;
     return cshake_set_ctx_params(vctx, params);
 }

diff --git a/test/evp_xof_test.c b/test/evp_xof_test.c
index ab86e29a7b..57f19982b7 100644
--- a/test/evp_xof_test.c
+++ b/test/evp_xof_test.c
@@ -613,6 +613,54 @@ err:
     return ret;
 }

+static const struct {
+    size_t len;
+    int should_pass;
+} customization_boundary_test_data[] = {
+    { 511, 1 },
+    { 512, 1 },
+    { 513, 0 }
+};
+
+static int xof_customization_boundary_test(int tstid)
+{
+    int ret = 0;
+    EVP_MD *md = NULL;
+    EVP_MD_CTX *ctx = NULL;
+    char custom[514];
+    unsigned char out[32];
+    size_t len = customization_boundary_test_data[tstid].len;
+    OSSL_PARAM params[2];
+
+    if (!TEST_ptr(md = EVP_MD_fetch(NULL, "CSHAKE128", NULL))
+        || !TEST_ptr(ctx = EVP_MD_CTX_new()))
+        goto err;
+
+    memset(custom, 'A', len);
+    custom[len] = '\0';
+    params[0] = OSSL_PARAM_construct_utf8_string(
+        OSSL_DIGEST_PARAM_CUSTOMIZATION, custom, 0);
+    params[1] = OSSL_PARAM_construct_end();
+
+    if (customization_boundary_test_data[tstid].should_pass) {
+        if (!TEST_true(EVP_DigestInit_ex2(ctx, md, params))
+            || !TEST_true(EVP_DigestFinalXOF(ctx, out, sizeof(out))))
+            goto err;
+    } else {
+        ERR_set_mark();
+        if (!TEST_false(EVP_DigestInit_ex2(ctx, md, params))) {
+            ERR_clear_last_mark();
+            goto err;
+        }
+        ERR_pop_to_mark();
+    }
+    ret = 1;
+err:
+    EVP_MD_CTX_free(ctx);
+    EVP_MD_free(md);
+    return ret;
+}
+
 static int xof_fail_test(void)
 {
     int ret;
@@ -634,6 +682,7 @@ int setup_tests(void)
     ADD_ALL_TESTS(xof_squeeze_kat_test, OSSL_NELEM(stride_test_data));
     ADD_ALL_TESTS(xof_squeeze_large_test, OSSL_NELEM(stride_test_data));
     ADD_ALL_TESTS(xof_squeeze_dup_test, OSSL_NELEM(dupoffset_test_data));
+    ADD_ALL_TESTS(xof_customization_boundary_test, OSSL_NELEM(customization_boundary_test_data));
     ADD_TEST(xof_fail_test);
     return 1;
 }