Commit 91ae3fe14c for openssl.org

commit 91ae3fe14c59bf10f68bd50f1aaee0bc9fd597aa
Author: Kazuki Yamaguchi <k@rhe.jp>
Date:   Wed Aug 26 20:43:32 2026 +0900

    CMS/PKCS7: do not leave stale errors on the queue

    EVP_{CIPHER,MD}_fetch() raise an error when the requested algorithm is
    not available, unlike EVP_get_{cipher,digest}bynid().

    These are used here only to probe whether particular algorithms are
    available in the currently active providers. Remove the error queue
    entries so they are not exposed to the user.

    Fixes: 02d0f65c9f85 "CMS/PKCS7: use EVP_CIPHER_fetch() for SMIMECapabilities"
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Merge-date: Thu Sep  3 09:22:38 2026
    Merged-from: https://github.com/openssl/openssl/pull/32513

diff --git a/crypto/cms/cms_sd.c b/crypto/cms/cms_sd.c
index fd9bd5497d..8d1bf722cc 100644
--- a/crypto/cms/cms_sd.c
+++ b/crypto/cms/cms_sd.c
@@ -1614,8 +1614,11 @@ int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs,
 static int cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg,
     OSSL_LIB_CTX *libctx, const char *propq)
 {
-    EVP_CIPHER *cipher = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), propq);
+    EVP_CIPHER *cipher;

+    ERR_set_mark();
+    cipher = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), propq);
+    ERR_pop_to_mark();
     if (cipher != NULL) {
         EVP_CIPHER_free(cipher);
         return CMS_add_simple_smimecap(sk, nid, arg);
@@ -1626,8 +1629,11 @@ static int cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg,
 static int cms_add_digest_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg,
     OSSL_LIB_CTX *libctx, const char *propq)
 {
-    EVP_MD *md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), propq);
+    EVP_MD *md;

+    ERR_set_mark();
+    md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), propq);
+    ERR_pop_to_mark();
     if (md != NULL) {
         EVP_MD_free(md);
         return CMS_add_simple_smimecap(sk, nid, arg);
diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c
index b595ebe026..7ff5682e57 100644
--- a/crypto/pkcs7/pk7_smime.c
+++ b/crypto/pkcs7/pk7_smime.c
@@ -100,8 +100,11 @@ err:
 static int add_cipher_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg,
     OSSL_LIB_CTX *libctx, const char *propq)
 {
-    EVP_CIPHER *cipher = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), propq);
+    EVP_CIPHER *cipher;

+    ERR_set_mark();
+    cipher = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), propq);
+    ERR_pop_to_mark();
     if (cipher != NULL) {
         EVP_CIPHER_free(cipher);
         return PKCS7_simple_smimecap(sk, nid, arg);
@@ -112,8 +115,11 @@ static int add_cipher_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg,
 static int add_digest_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg,
     OSSL_LIB_CTX *libctx, const char *propq)
 {
-    EVP_MD *md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), propq);
+    EVP_MD *md;

+    ERR_set_mark();
+    md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), propq);
+    ERR_pop_to_mark();
     if (md != NULL) {
         EVP_MD_free(md);
         return PKCS7_simple_smimecap(sk, nid, arg);
diff --git a/test/cmsapitest.c b/test/cmsapitest.c
index c91f777f1f..a0624646bc 100644
--- a/test/cmsapitest.c
+++ b/test/cmsapitest.c
@@ -296,7 +296,8 @@ static int test_CMS_add_standard_smimecap_ex(void)
     STACK_OF(X509_ALGOR) *smcap = NULL;
     int ret = 0;

-    if (!TEST_true(CMS_add_standard_smimecap_ex(&smcap, NULL, NULL)))
+    if (!TEST_true(CMS_add_standard_smimecap_ex(&smcap, NULL, NULL))
+        || !TEST_int_eq(ERR_peek_error(), 0))
         goto end;

     /* AES ciphers must be present with the default provider */
diff --git a/test/pkcs7_test.c b/test/pkcs7_test.c
index eafd699284..ea0f2fa5e3 100644
--- a/test/pkcs7_test.c
+++ b/test/pkcs7_test.c
@@ -42,7 +42,8 @@ static int test_pkcs7_smimecap(void)
         || !TEST_true(PKCS7_set_type(p7, NID_pkcs7_signed))
         || !TEST_true(PKCS7_content_new(p7, NID_pkcs7_data))
         || !TEST_ptr(si = PKCS7_sign_add_signer(p7, smimecap_cert,
-                         smimecap_privkey, NULL, 0)))
+                         smimecap_privkey, NULL, 0))
+        || !TEST_int_eq(ERR_peek_error(), 0))
         goto end;

     if (!TEST_ptr(smcap = PKCS7_get_smimecap(si)))