Commit dde995f291 for openssl.org

commit dde995f2913bf825bbd0e9c25af4c75caf917a10
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Wed Aug 5 15:03:18 2026 +0200

    ssl: restore missing SSLfatal in keylog output

    Commit e077455e9e dropped the SSLfatal() call together with the
    ERR_R_MALLOC_FAILURE cleanup in nss_keylog_int(). Since then an
    allocation failure there propagates a plain zero return through
    ssl_log_secret() and ssl_log_rsa_client_key_exchange() callers whose
    "SSLfatal() already called" comments no longer hold, tripping the
    check_fatal assertion in the state machine on debug builds when a
    keylog callback is set.

    Commit 7d78cd722b papered over one symptom of this by calling SSLfatal()
    directly at the early exporter secret call site in
    tls13_change_cipher_state(). With the call restored at the source that
    would now invoke SSLfatal() twice, pushing a duplicate entry on the
    error queue, so revert that call site back to the
    "SSLfatal() already called" comment used by all the other callers.

    Assisted-by: Claude:claude-fable-5
    Reviewed-by: Matt Caswell <matt@openssl.foundation>
    Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
    Merge-date: Thu Aug 27 13:54:32 2026
    Merged-from: https://github.com/openssl/openssl/pull/32196

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 3b47c6cdfb..649a94cd8e 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -7445,8 +7445,10 @@ static int nss_keylog_int(const char *prefix,
      */
     prefix_len = strlen(prefix);
     out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;
-    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL)
+    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
+        SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
         return 0;
+    }

     memcpy(cursor, prefix, prefix_len);
     cursor += prefix_len;
diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c
index 661a195f94..4624e9ca05 100644
--- a/ssl/tls13_enc.c
+++ b/ssl/tls13_enc.c
@@ -694,7 +694,7 @@ int tls13_change_cipher_state(SSL_CONNECTION *s, int which)

             if (!ssl_log_secret(s, EARLY_EXPORTER_SECRET_LABEL,
                     s->early_exporter_master_secret, hashlen)) {
-                SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
+                /* SSLfatal() already called */
                 goto err;
             }
         } else if (which & SSL3_CC_HANDSHAKE) {