[openssl/openssl] 281790: Prepare a now opaque ASN1_STRING for the size_t ra...

[Bob Beck]

Branch: refs/heads/master
Home: https://github.com/openssl/openssl
Commit: 28179061bfcdfe579f63a129bf0b97766a5d90a7
https://github.com/openssl/openssl/commit/28179061bfcdfe579f63a129bf0b97766a5d90a7
Author: Bob Beck <be...@openssl.org>
Date: 2026-07-18 (Sat, 18 Jul 2026)

Changed paths:
M crypto/asn1/a_octet.c
M crypto/asn1/asn1_lib.c
M doc/man3/ASN1_STRING_length.pod
M include/openssl/asn1.h.in
M test/asn1_string_test.c
M util/libcrypto.num

Log Message:
-----------
Prepare a now opaque ASN1_STRING for the size_t rapture.

Now that ASN1_STRING is opaque, we can finally move away
from an int for the length internally. The remaining problematic
piece for this is that ASN1_STRING_length() returns an int
and is public API.

Therefore, we deprecate ASN1_STRING_length() and provide a
replacement ASN1_STRING_length_ex() that returns a size_t length.

We also provide setting functions that take size_t lengths,
they are ASN1_STRING_set_data() which takes a uint8_t data
pointer and a size_t length, and ASN1_STRING_set_string() which
takes a argument that must be a c string and will use strlen
to determine the length. (This replaces th previous arcane
behaviour of calling "strlen" on a magical input length value
of -1, which leads to bugs.) We then deprecate ASN1_STRING_set().

ASN1_STRING_set_string() requires a valid C string argument that
may not be NULL - refer to the documentation.

Both new functions do not magically add 0 bytes on the end of
values, as ASN1_STRING has already been documented for a long
time to not depend on this behaviour.

Both new functions do not allow the setting of values on an
ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that.

Note that this does *NOT* yet change ASN1_STRING to use size_t
internally, this must wait until the integer-returning ASN1_STRING_length()
has been deprecated, and then removed in future major. Once
ASN1_STRING_length() has been removed then ASN1_STRING internally
can change to using a size_t for the length of the data.
(And the setters will no longer return an error if the provided
size_t length exceeds INT_MAX)

Reviewed-by: Milan Broz <mb...@openssl.org>
Reviewed-by: Norbert Pocs <norb...@openssl.org>
MergeDate: Sat Jul 18 13:01:15 2026
(Merged from https://github.com/openssl/openssl/pull/31194)


Commit: 8d9fb09b9e7457346cd619779609c59ed0ee7ad9
https://github.com/openssl/openssl/commit/8d9fb09b9e7457346cd619779609c59ed0ee7ad9
Author: Bob Beck <be...@openssl.org>
Date: 2026-07-18 (Sat, 18 Jul 2026)

Changed paths:
M crypto/cmp/cmp_local.h
M crypto/cmp/cmp_msg.c
M crypto/cmp/cmp_util.c

Log Message:
-----------
pass length in cmp_msg stuff

ossl_cmp_sk_ASN1_UTF8STRING_push_str depended under the covers on
passing a -1 to have strlen magically called in the setter. Don't
depend on this and simply pass in the correct length

Reviewed-by: Milan Broz <mb...@openssl.org>
Reviewed-by: Norbert Pocs <norb...@openssl.org>
MergeDate: Sat Jul 18 13:01:17 2026
(Merged from https://github.com/openssl/openssl/pull/31194)


Commit: 0161fe45d1fce2247b0fe74b3e2524703cf337c5
https://github.com/openssl/openssl/commit/0161fe45d1fce2247b0fe74b3e2524703cf337c5
Author: Bob Beck <be...@openssl.org>
Date: 2026-07-18 (Sat, 18 Jul 2026)

Changed paths:
M CHANGES.md

Log Message:
-----------
Add a CHANGES.md entry

Reviewed-by: Milan Broz <mb...@openssl.org>
Reviewed-by: Norbert Pocs <norb...@openssl.org>
MergeDate: Sat Jul 18 13:01:18 2026
(Merged from https://github.com/openssl/openssl/pull/31194)


Commit: 9044e5f42556e5a3bdf49226406144d806123697
https://github.com/openssl/openssl/commit/9044e5f42556e5a3bdf49226406144d806123697
Author: Bob Beck <be...@openssl.org>
Date: 2026-07-18 (Sat, 18 Jul 2026)

Changed paths:
M apps/asn1parse.c
M apps/ca.c
M apps/cmp.c
M apps/cms.c
M apps/lib/apps.c
M apps/lib/cmp_mock_srv.c
M apps/pkcs12.c
M apps/s_client.c
M apps/spkac.c
M apps/ts.c
M crypto/asn1/a_bitstr.c
M crypto/asn1/a_int.c
M crypto/asn1/a_mbstr.c
M crypto/asn1/a_time.c
M crypto/asn1/asn1_gen.c
M crypto/asn1/asn1_lib.c
M crypto/asn1/asn1_local.h
M crypto/asn1/evp_asn1.c
M crypto/asn1/p5_scrypt.c
M crypto/asn1/p8_pkey.c
M crypto/asn1/tasn_dec.c
M crypto/cmp/cmp_protect.c
M crypto/cmp/cmp_status.c
M crypto/cmp/cmp_util.c
M crypto/cms/cms_dd.c
M crypto/cms/cms_dh.c
M crypto/cms/cms_ec.c
M crypto/cms/cms_env.c
M crypto/cms/cms_ess.c
M crypto/cms/cms_kemri.c
M crypto/cms/cms_rsa.c
M crypto/cms/cms_sd.c
M crypto/ct/ct_oct.c
M crypto/ec/ec_asn1.c
M crypto/ec/ecx_backend.c
M crypto/ocsp/ocsp_ext.c
M crypto/ocsp/ocsp_srv.c
M crypto/pkcs12/p12_mutl.c
M crypto/pkcs7/pk7_attr.c
M crypto/pkcs7/pk7_doit.c
M crypto/pkcs7/pk7_smime.c
M crypto/sm2/sm2_crypt.c
M crypto/ts/ts_asn1.c
M crypto/ts/ts_lib.c
M crypto/ts/ts_rsp_sign.c
M crypto/ts/ts_rsp_verify.c
M crypto/ts/ts_verify_ctx.c
M crypto/x509/t_x509.c
M crypto/x509/v3_addr.c
M crypto/x509/v3_akid.c
M crypto/x509/v3_cpols.c
M crypto/x509/v3_ia5.c
M crypto/x509/v3_ist.c
M crypto/x509/v3_lib.c
M crypto/x509/v3_prn.c
M crypto/x509/v3_san.c
M crypto/x509/v3_utf8.c
M crypto/x509/x509_att.c
M crypto/x509/x509name.c
M crypto/x509/x_x509a.c
M ssl/statem/statem_srvr.c
M test/asn1_string_test.c
M test/cmp_hdr_test.c
M test/helpers/pkcs12.c
M test/tls-provider.c
M test/v3nametest.c
M test/x509_internal_test.c

Log Message:
-----------
Convert internal use of ASN1_STRING_set and ASN1_STRING_length

to use their non-deprecated replacements. For "pretty-printing"
applications and test code that use a length and require an int, size_t lengths
are simply cast to an int. For writes and protocol level things
size_t lengths are checked against INT_MAX and take the error
path if the returned value is too large to be used for a funciton
that takes an integer length.

Reviewed-by: Milan Broz <mb...@openssl.org>
Reviewed-by: Norbert Pocs <norb...@openssl.org>
MergeDate: Sat Jul 18 13:01:19 2026
(Merged from https://github.com/openssl/openssl/pull/31194)


Commit: ba569d08ed7ba946aaa1285c9e540b91d451a5bd
https://github.com/openssl/openssl/commit/ba569d08ed7ba946aaa1285c9e540b91d451a5bd
Author: Bob Beck <be...@openssl.org>
Date: 2026-07-18 (Sat, 18 Jul 2026)

Changed paths:
A test/recipes/95-test_external_pkcs11_provider_data/patches/0002-Temporarily-disable-the-pem-encoder.patch

Log Message:
-----------
Add a patch disabling the pem_encoder test

This seems to have strange internal failures retrieving EC keys from
the kryoptic soft hsm. (based on reading the meson stuff this also
occurs on some linux distros and this is disabled there too)

The same test appears to work fine with RSA keys, but diagnosing
this is challenging with nothing int the voluminous output that
might say why it didn't work. So disable this for now

Reviewed-by: Milan Broz <mb...@openssl.org>
Reviewed-by: Norbert Pocs <norb...@openssl.org>
MergeDate: Sat Jul 18 13:01:21 2026
(Merged from https://github.com/openssl/openssl/pull/31194)


Compare: https://github.com/openssl/openssl/compare/d8bf6cdd4849...ba569d08ed7b

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications