Commit 799252f3b6 for openssl.org

commit 799252f3b67d0429e64736f922a3c2860135facb
Author: dannyward630 <djwarding888@gmail.com>
Date:   Mon Jun 15 19:46:57 2026 +0200

    Document trailing data handling for DER input

    Commands that read a single DER object may stop after decoding that object and leave trailing input unchecked. Document that successful decoding is therefore not a full-input validity check.

    Fixes #31495

    CLA: trivial

    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    (Merged from https://github.com/openssl/openssl/pull/31524)

diff --git a/doc/man1/openssl-format-options.pod b/doc/man1/openssl-format-options.pod
index 2da9bef5ef..1bdb82efad 100644
--- a/doc/man1/openssl-format-options.pod
+++ b/doc/man1/openssl-format-options.pod
@@ -60,6 +60,11 @@ is described in each command documentation.
 A binary format, encoded or parsed according to Distinguished Encoding Rules
 (DER) of the ASN.1 data language.

+When a command reads a single DER object, it may stop after successfully
+decoding that object. Any trailing data in the input is not necessarily
+examined or rejected. Therefore, a successful command does not by itself
+confirm that the entire input consists of one valid DER object.
+
 =item B<P12>

 A DER-encoded file containing a PKCS#12 object.
@@ -124,7 +129,7 @@ Note that the parsing is simple and might fail to parse some legal data.

 =head1 COPYRIGHT

-Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2026 The OpenSSL Project Authors. All Rights Reserved.

 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy