Commit 7a2a125de1 for openssl.org

commit 7a2a125de11bf9aafbf48d93e98103dc45f4eccf
Author: Igor Ustinov <igus@openssl.foundation>
Date:   Fri Oct 23 12:04:43 2026 +0200

    doc: Fix the EVP_Cipher() return value description

    Drop the irrelevent EVP_CipherInit_ex2() reference, clarify
    EVP_Cipher()'r return value on error for EVP_CIPH_FLAG_CUSTOM_CIPHER
    ciphers,  articulate that 0 is a successful return value for
    EVP_CIPH_FLAG_CUSTOM_CIPHER, document the return value on NULL
    ctx/ctx->cipher.

    Assisted-by: Claude:claude-opus-5-5
    Reviewed-by: Richard Levitte <levitte@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Fri Oct 30 19:12:48 2026
    Merged-from: https://github.com/openssl/openssl/pull/33350

diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod
index 1b158f7fea..18d51d1e6f 100644
--- a/doc/man3/EVP_EncryptInit.pod
+++ b/doc/man3/EVP_EncryptInit.pod
@@ -1419,13 +1419,15 @@ success and 0 for failure.
 EVP_CipherFinal_ex() returns 0 for an encryption/decryption failure or 1 for
 success.

-EVP_Cipher() returns 1 on success and <= 0 on failure, if the flag
-B<EVP_CIPH_FLAG_CUSTOM_CIPHER> is not set for the cipher, or if the cipher has
-not been initialized via a call to B<EVP_CipherInit_ex2>.
-EVP_Cipher() returns the number of bytes written to I<out> for
-encryption/decryption, or the number of bytes authenticated in a call specifying
-AAD for an AEAD cipher, if the flag B<EVP_CIPH_FLAG_CUSTOM_CIPHER> is set for
-the cipher.
+If the flag B<EVP_CIPH_FLAG_CUSTOM_CIPHER> is set for the cipher, EVP_Cipher()
+returns the number of bytes written to I<out> for encryption/decryption, or the
+number of bytes authenticated in a call specifying AAD for an AEAD cipher, and
+a negative value on failure. Note that 0 is a successful return value in this
+case, for example when the operation is finalized by passing a NULL I<in>.
+If the flag B<EVP_CIPH_FLAG_CUSTOM_CIPHER> is not set for the cipher,
+EVP_Cipher() returns 1 on success and 0 on failure.
+Regardless of the B<EVP_CIPH_FLAG_CUSTOM_CIPHER> flag, EVP_Cipher() returns 0
+if I<ctx> is NULL or no cipher has been set in it.

 EVP_CIPHER_can_pipeline() returns 1 if the cipher can be used in a pipeline, 0 otherwise.