Commit b8997895c2 for openssl.org

commit b8997895c2e8eb0f3f39189f6c0861c1aa51c268
Author: Norbert Pocs <norbertp@openssl.org>
Date:   Wed Oct 28 14:04:53 2026 +0400

    Reject unsupported IV lengths for AES-GCM-SIV

    AES-GCM-SIV only supports a 12 byte nonce, but the IV length was not
    among its settable parameters.  EVP_CTRL_AEAD_SET_IVLEN therefore
    reported success, while the provider ignored the value,
    and the subsequent init copied 12 bytes from the caller's IV buffer.
    A shorter IV buffer was over-read, and a longer one was silently
    truncated.

    Accept the IV length parameter and fail with PROV_R_INVALID_IV_LENGTH
    unless it is 12, as ChaCha20-Poly1305 already does.

    Fixes: CVE-2026-95692
    Co-Authored-by: Billy Bob Brumley <bbb.iki.fi>
    Signed-off-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Merge-date: Sun Nov  8 12:50:49 2026
    Merged-from: https://github.com/openssl/openssl/pull/33512

diff --git a/providers/implementations/ciphers/cipher_aes_gcm_siv.c b/providers/implementations/ciphers/cipher_aes_gcm_siv.c
index aecaa7d8b7..560dd239bd 100644
--- a/providers/implementations/ciphers/cipher_aes_gcm_siv.c
+++ b/providers/implementations/ciphers/cipher_aes_gcm_siv.c
@@ -272,6 +272,20 @@ static int ossl_aes_gcm_siv_set_ctx_params(void *vctx, const OSSL_PARAM params[]
             return 0;
         }
     }
+
+    if (p.ivlen != NULL) {
+        size_t iv_len;
+
+        if (!OSSL_PARAM_get_size_t(p.ivlen, &iv_len)) {
+            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
+            return 0;
+        }
+        /* The nonce length can not be modified */
+        if (iv_len != sizeof(ctx->nonce)) {
+            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
+            return 0;
+        }
+    }
     return 1;
 }

diff --git a/providers/implementations/ciphers/cipher_aes_gcm_siv.inc.in b/providers/implementations/ciphers/cipher_aes_gcm_siv.inc.in
index 891d3b976d..b1edc27eb0 100644
--- a/providers/implementations/ciphers/cipher_aes_gcm_siv.inc.in
+++ b/providers/implementations/ciphers/cipher_aes_gcm_siv.inc.in
@@ -21,4 +21,5 @@ use OpenSSL::paramnames qw(produce_param_decoder);
                          (['OSSL_CIPHER_PARAM_KEYLEN',      'keylen', 'size_t'],
                           ['OSSL_CIPHER_PARAM_SPEED',       'speed',  'uint'],
                           ['OSSL_CIPHER_PARAM_AEAD_TAG',    'tag',    'octet_string'],
+                          ['OSSL_CIPHER_PARAM_AEAD_IVLEN',  'ivlen',  'size_t'],
                          )); -}