Commit 87af1458a7 for openssl.org

commit 87af1458a7dcc94556aad5691305d429605dbad2
Author: Daniel Kubec <kubec@openssl.foundation>
Date:   Mon Oct 5 17:00:56 2026 +0200

    apps/x509.c: fail on X509_VERIFY_PARAM_new() failure under -checkend

    The allocation failure was reported on the output BIO and then skipped
    the certificate, so the command exited with status zero without having
    checked anything. Report it on stderr and reach err: like every other
    failure path, as deferred by commit 8da3880874ac "apps/x509.c: failing
    exit status on every failure path reaching err:".

    Fixes: 4036f4b0e324 "Add new public API for checking certificate times."
    Complements: 8da3880874ac "apps/x509.c: failing exit status on every failure path reaching err:"
    Assisted-by: Claude:claude-fable-5-1
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Tue Oct 27 17:10:46 2026
    Merged-from: https://github.com/openssl/openssl/pull/33104

diff --git a/apps/x509.c b/apps/x509.c
index 77ed03c548..cfad10b96c 100644
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -1215,8 +1215,8 @@ cert_loop:
         int error;

         if ((vpm = X509_VERIFY_PARAM_new()) == NULL) {
-            BIO_puts(out, "Malloc failed\n");
-            goto end_cert_loop;
+            BIO_puts(bio_err, "Malloc failed\n");
+            goto err;
         }
         X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_USE_CHECK_TIME);
         X509_VERIFY_PARAM_set_time(vpm, tcheck);