Commit b2cd01d299 for openssl.org

commit b2cd01d29910926eaff8497de2918b8d10df6095
Author: Bob Beck <beck@openssl.org>
Date:   Wed Jun 17 19:00:28 2026 -0600

    Convert BIO_snprintf() to snprintf() in ossl_asn1_time_from_tm()

    Ensure that we verify the snprintf() result before storing it as the
    length. The function assigned the BIO_snprintf() return value directly
    to tmps->length, which would store -1 on truncation with BIO_snprintf().

    Likely not a serious issue as most callers bound the values, but this
    is still reachable via some public API.

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Wed Aug 26 16:20:11 2026
    (Merged from https://github.com/openssl/openssl/pull/31640)

diff --git a/crypto/asn1/a_time.c b/crypto/asn1/a_time.c
index 564df4dd8c..d5f69d547b 100644
--- a/crypto/asn1/a_time.c
+++ b/crypto/asn1/a_time.c
@@ -251,6 +251,7 @@ ASN1_TIME *ossl_asn1_time_from_tm(ASN1_TIME *s, struct tm *ts, int type)
     char *p;
     ASN1_TIME *tmps = NULL;
     const int len = 20;
+    int ret;

     if (type == V_ASN1_UNDEF) {
         if (is_utc(ts->tm_year))
@@ -283,16 +284,19 @@ ASN1_TIME *ossl_asn1_time_from_tm(ASN1_TIME *s, struct tm *ts, int type)
     if (type == V_ASN1_GENERALIZEDTIME) {
         if (ts->tm_year > INT_MAX - 1900)
             goto err;
-        tmps->length = BIO_snprintf(p, len, "%04d%02d%02d%02d%02d%02dZ",
+        ret = snprintf(p, len, "%04d%02d%02d%02d%02d%02dZ",
             ts->tm_year + 1900, ts->tm_mon + 1,
             ts->tm_mday, ts->tm_hour, ts->tm_min,
             ts->tm_sec);
     } else {
-        tmps->length = BIO_snprintf(p, len, "%02d%02d%02d%02d%02d%02dZ",
+        ret = snprintf(p, len, "%02d%02d%02d%02d%02d%02dZ",
             ts->tm_year % 100, ts->tm_mon + 1,
             ts->tm_mday, ts->tm_hour, ts->tm_min,
             ts->tm_sec);
     }
+    if (ret < 0 || ret >= len)
+        goto err;
+    tmps->length = ret;

 #ifdef CHARSET_EBCDIC
     ebcdic2ascii(tmps->data, tmps->data, tmps->length);