Commit 525913f5a9 for openssl.org

commit 525913f5a9e208d180fc70659cfee61002871019
Author: Bob Beck <beck@openssl.org>
Date:   Wed Jun 17 19:42:20 2026 -0600

    Fix latent bugs from unchecked BIO_snprintf() returns.

    ts_rsp_sign.c and qlog.c advanced their cursors by the BIO_snprintf()
    return without checking it.  Stage the result in a local, reject on
    failure or truncation, then advance.

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Wed Aug 26 16:20:24 2026
    (Merged from https://github.com/openssl/openssl/pull/31640)

diff --git a/crypto/ts/ts_rsp_sign.c b/crypto/ts/ts_rsp_sign.c
index ed58845254..27a4455fcb 100644
--- a/crypto/ts/ts_rsp_sign.c
+++ b/crypto/ts/ts_rsp_sign.c
@@ -846,6 +846,7 @@ static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
     char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];
     char *p = genTime_str;
     char *p_end = genTime_str + sizeof(genTime_str);
+    int n;

     if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
         goto err;
@@ -860,10 +861,13 @@ static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
      * meet the rfc3161 requirement: "GeneralizedTime syntax can include
      * fraction-of-second details".
      */
-    p += BIO_snprintf(p, p_end - p,
+    n = snprintf(p, p_end - p,
         "%04d%02d%02d%02d%02d%02d",
         tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
         tm->tm_hour, tm->tm_min, tm->tm_sec);
+    if (n < 0 || n >= p_end - p)
+        goto err;
+    p += n;
     if (precision > 0) {
         snprintf(p, 2 + precision, ".%06ld", usec);
         p += strlen(p);
diff --git a/ssl/quic/qlog.c b/ssl/quic/qlog.c
index 9b3cdd2f56..659a981df8 100644
--- a/ssl/quic/qlog.c
+++ b/ssl/quic/qlog.c
@@ -8,6 +8,7 @@
  */

 #include <stdbool.h>
+#include <stdio.h>
 #include "internal/qlog.h"
 #include "internal/json_enc.h"
 #include "internal/common.h"
@@ -131,12 +132,21 @@ QLOG *ossl_qlog_new_from_env(const QLOG_TRACE_INFO *info)
     if (qlogdir_sep != '\0')
         filename[l++] = qlogdir_sep;

-    for (i = 0; i < info->odcid.id_len; ++i)
-        l += BIO_snprintf(filename + l, strl - l, "%02x", info->odcid.id[i]);
+    for (i = 0; i < info->odcid.id_len; ++i) {
+        int n = snprintf(filename + l, strl - l, "%02x", info->odcid.id[i]);

-    l += BIO_snprintf(filename + l, strl - l, "_%s.sqlog",
+        if (n < 0 || (size_t)n >= strl - l)
+            goto err;
+        l += n;
+    }
+
+    int n = snprintf(filename + l, strl - l, "_%s.sqlog",
         info->is_server ? "server" : "client");

+    if (n < 0 || (size_t)n >= strl - l)
+        goto err;
+    l += n;
+
     qlog = ossl_qlog_new(info);
     if (qlog == NULL)
         goto err;