Commit a1c7d645d5 for openssl.org

commit a1c7d645d527d4db8b28f375dc3282f71d0c3e45
Author: Hansaem Wi <hansaemw@gmail.com>
Date:   Sun Nov 1 11:29:12 2026 +0900

    providers: allocate the PBKDF1 derive_skey buffer without zeroing it

    kdf_pbkdf1_derive_skey() allocates the key buffer with OPENSSL_zalloc(),
    but nothing reads it before kdf_pbkdf1_derive() writes all keylen bytes,
    and on failure the buffer is cleared and freed without being read.
    Use OPENSSL_malloc().

    Suggested in the review of https://github.com/openssl/openssl/pull/33444.

    Assisted-by: Claude Code:claude-opus-5-5
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Merge-date: Wed Nov  4 04:14:50 2026
    Merged-from: https://github.com/openssl/openssl/pull/33476

diff --git a/providers/implementations/kdfs/pbkdf1.c b/providers/implementations/kdfs/pbkdf1.c
index c603a94c92..665a27bb97 100644
--- a/providers/implementations/kdfs/pbkdf1.c
+++ b/providers/implementations/kdfs/pbkdf1.c
@@ -303,7 +303,7 @@ static void *kdf_pbkdf1_derive_skey(void *vctx, const char *key_type ossl_unused
     if (import == NULL || keylen == 0)
         return NULL;

-    if ((key = OPENSSL_zalloc(keylen)) == NULL)
+    if ((key = OPENSSL_malloc(keylen)) == NULL)
         return NULL;

     if (kdf_pbkdf1_derive(vctx, key, keylen, params) == 0) {