Commit 3c0f3cf80e for openssl.org

commit 3c0f3cf80eba4112bc6abfc24f953d828b5e9a69
Author: Greensi7 <adam.tabak04@gmail.com>
Date:   Thu Jul 23 16:32:23 2026 +0200

    Add PKCS7_verify fuzzer

    Fuzz PKCS7_verify with PKCS7_NOVERIFY flag
    to exercise signature verification without
    requiring a trusted certificate store.

    Motivated by CVE-2026-45447.

    Assisted-by: ChatGPT:gpt-5.6

    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    MergeDate: Fri Aug  7 13:36:57 2026
    (Merged from https://github.com/openssl/openssl/pull/32093)

diff --git a/fuzz/build.info b/fuzz/build.info
index fcbb76234c..f749fb2954 100644
--- a/fuzz/build.info
+++ b/fuzz/build.info
@@ -10,6 +10,7 @@

 IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
   PROGRAMS{noinst}=asn1 asn1parse bignum bndiv client conf crl server smime
+  PROGRAMS{noinst}=pkcs7_verify
   PROGRAMS{noinst}=pkcs12 punycode pem decoder hashtable acert
   PROGRAMS{noinst}=v3name
   PROGRAMS{noinst}=provider
@@ -138,6 +139,10 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
   INCLUDE[smime]=../include {- $ex_inc -}
   DEPEND[smime]=../libcrypto ../libssl {- $ex_lib -}

+  SOURCE[pkcs7_verify]=pkcs7_verify.c driver.c
+  INCLUDE[pkcs7_verify]=../include {- $ex_inc -}
+  DEPEND[pkcs7_verify]=../libcrypto {- $ex_lib -}
+
   SOURCE[v3name]=v3name.c driver.c
   INCLUDE[v3name]=../include {- $ex_inc -}
   DEPEND[v3name]=../libcrypto.a {- $ex_lib -}
@@ -187,6 +192,7 @@ IF[{- !$disabled{tests} -}]
   $FUZZTESTSRC=test-corpus.c ../test/mfail/mfail.c

   PROGRAMS{noinst}=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test smime-test
+  PROGRAMS{noinst}=pkcs7_verify-test
   PROGRAMS{noinst}=pkcs12-test punycode-test pem-test decoder-test hashtable-test acert-test
   PROGRAMS{noinst}=v3name-test
   PROGRAMS{noinst}=provider-test
@@ -328,6 +334,10 @@ IF[{- !$disabled{tests} -}]
   INCLUDE[smime-test]=../include ../test/mfail
   DEPEND[smime-test]=../libcrypto.a ../libssl.a

+  SOURCE[pkcs7_verify-test]=pkcs7_verify.c $FUZZTESTSRC
+  INCLUDE[pkcs7_verify-test]=../include ../test/mfail
+  DEPEND[pkcs7_verify-test]=../libcrypto.a
+
   SOURCE[v3name-test]=v3name.c $FUZZTESTSRC
   INCLUDE[v3name-test]=../include ../test/mfail
   DEPEND[v3name-test]=../libcrypto.a
diff --git a/fuzz/pkcs7_verify.c b/fuzz/pkcs7_verify.c
new file mode 100644
index 0000000000..a167afb13d
--- /dev/null
+++ b/fuzz/pkcs7_verify.c
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * https://www.openssl.org/source/license.html
+ * or in the file LICENSE in the source distribution.
+ */
+#include <limits.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/pkcs7.h>
+#include "fuzzer.h"
+
+int FuzzerInitialize(int *argc, char ***argv)
+{
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len)
+{
+    BIO *indata = NULL;
+    BIO *out = NULL;
+    PKCS7 *p7 = NULL;
+    const unsigned char *in;
+    size_t consumed;
+    size_t remaining;
+
+    if (len > LONG_MAX)
+        return 0;
+
+    in = buf;
+    p7 = d2i_PKCS7(NULL, &in, (long)len);
+    if (p7 == NULL)
+        goto err;
+
+    consumed = (size_t)(in - buf);
+    remaining = len - consumed;
+    if (remaining > INT_MAX)
+        goto err;
+
+    if (consumed < len) {
+        indata = BIO_new_mem_buf(in, (int)remaining);
+        if (indata == NULL)
+            goto err;
+    }
+
+    out = BIO_new(BIO_s_null());
+    if (out == NULL)
+        goto err;
+
+    PKCS7_verify(p7, NULL, NULL, indata, out, PKCS7_NOVERIFY);
+
+err:
+    BIO_free(out);
+    PKCS7_free(p7);
+    BIO_free(indata);
+    ERR_clear_error();
+    return 0;
+}
+
+void FuzzerCleanup(void)
+{
+}
diff --git a/test/recipes/99-test_fuzz_pkcs7_verify.t b/test/recipes/99-test_fuzz_pkcs7_verify.t
new file mode 100644
index 0000000000..cbd50399f5
--- /dev/null
+++ b/test/recipes/99-test_fuzz_pkcs7_verify.t
@@ -0,0 +1,22 @@
+#!/usr/bin/env perl
+# Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+use strict;
+use warnings;
+
+use OpenSSL::Test qw/:DEFAULT srctop_file/;
+use OpenSSL::Test::Utils;
+
+my $fuzzer = "pkcs7_verify";
+setup("test_fuzz_${fuzzer}");
+
+plan tests => 2; # one more due to below require_ok(...)
+
+require_ok(srctop_file('test','recipes','fuzz.pl'));
+
+fuzz_ok($fuzzer);