Commit 3be64e3d80 for openssl.org

commit 3be64e3d8016161c19ebd86012936d121e208cc1
Author: Daniel Kubec <kubec@openssl.foundation>
Date:   Wed Aug 26 18:03:15 2026 +0200

    CI: skip rejection-path test under fuzzing builds

    Assisted-by: Claude:claude-fable-5
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Thu Aug 27 07:09:00 2026
    Merged-from: https://github.com/openssl/openssl/pull/32521

diff --git a/test/cmp_extracerts_dos_test.c b/test/cmp_extracerts_dos_test.c
index bf77c3655c..edb2dc8c4a 100644
--- a/test/cmp_extracerts_dos_test.c
+++ b/test/cmp_extracerts_dos_test.c
@@ -46,6 +46,13 @@

 #include "helpers/cmp_testlib.h"

+#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+/*
+ * In fuzzing builds ossl_cmp_msg_check_update() deliberately lets invalid
+ * messages pass (see cmp_vfy.c), so the rejection path under test here
+ * cannot be exercised.
+ */
+
 #define NUM_REJECTED_REQUESTS 25 /* "attacker" sends this many distinct certs */

 typedef struct test_fixture {
@@ -330,9 +337,13 @@ static int test_no_unbounded_growth_on_rejected_requests(void)
     return result;
 }

+#endif
+
 int setup_tests(void)
 {
+#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
     ADD_TEST(test_single_rejected_request_leaves_no_residue);
     ADD_TEST(test_no_unbounded_growth_on_rejected_requests);
+#endif
     return 1;
 }