Commit 02047ece21 for openssl.org

commit 02047ece21cf8f6126fdf4119a463ef4d950b1cc
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Wed Jul 22 00:11:18 2026 +0200

    apps: fail skeyutl -genkey on bad -skeyopt

    app_params_new_from_opts() returns NULL when a key option cannot be
    converted, either because the key management does not settle the
    parameter or because the opt:value separator is missing.  skeyutl
    ignored that and generated the key without the requested options, only
    printing the parameter error to stderr and still exiting successfully.

    Bail out instead, the way the mac, kdf and enc applications do.  A NULL
    return is only an error when key options were actually given, as
    app_params_new_from_opts() also returns NULL for an empty option list.

    Assisted-by: Claude:claude-opus-4-8

    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
    MergeDate: Mon Jul 27 09:06:03 2026
    (Merged from https://github.com/openssl/openssl/pull/32036)

diff --git a/apps/skeyutl.c b/apps/skeyutl.c
index 46461781ff..cb9a8131de 100644
--- a/apps/skeyutl.c
+++ b/apps/skeyutl.c
@@ -102,6 +102,9 @@ int skeyutl_main(int argc, char **argv)
             goto end;
         params = app_params_new_from_opts(skeyopts,
             EVP_SKEYMGMT_get0_gen_settable_params(mgmt));
+        /* A NULL return is an error only if key options were given */
+        if (skeyopts != NULL && params == NULL)
+            goto end;

         skey = EVP_SKEY_generate(app_get0_libctx(),
             skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),