openbsd, branch OPENBSD_7_9

This commit was manufactured by cvs2git to create branch 'OPENBSD_7_9'.

2026-04-16T07:35:27+00:00

libtls: consistently handle allocation failures

2026-04-16T07:35:25+00:00

Use tls_set_errorx() or tls_error_setx() rather than the versions without x for TLS_ERROR_OUT_OF_MEMORY. ENOMEM adds no further info. From Michael Forney ok bcook

libtls: use TLS_ERROR_OUT_OF_MEMORY after malloc failure

2026-04-16T07:33:11+00:00

tls_config_load_file() hat a spot that used TLS_ERROR_UNKNOWN, so switch that to the usual error code. Use tls_error_setx() since strerror(ENOMEM) adds nothing. From Michael Forney ok bcook

libtls: use tls_error_setx() after BIO_new_mem_buf()

2026-04-16T07:29:53+00:00

This is the only place where tls_error_set() was used. While the new length check now guarantees that the failure is due to ENOMEM, this info does not add value. From Michael Forney ok bcook

libtls: prefer x version of error setting

2026-04-16T07:28:00+00:00

If a check fails and errno is not necessarily set by the previous API call use tls_set_errorx() or tls_error_setx() since turning an unrelated errno into an error string is unhelpful. From Michael Forney ok bcook

libtls: add missing length checks before BIO_new_mem_buf()

2026-04-16T05:16:48+00:00

Like all proper libcrypto APIs, BIO_new_mem_buf() takes an int as a length argument. Check the size_t passed in to be at most INT_MAX to avoid issues with truncation and overflow like it's done everywhere else. After release this should probably be clamped down further since legitimate files (certs and keys) are nowhere near this large. Prompted by a diff by Michael Forney ok jsing

keypairtest: zero out tls_error before running tests

2026-04-15T20:13:07+00:00

Otherwise tls_error_clear() (called e.g. via tls_error_vset()) will free the bad error->msg pointer. From Michael Forney

Prior to this we substring matched and allowed a leading .

2026-04-13T17:04:23+00:00

on a SAN DNSname constraint. This is not correct, as with a DNSname constraint, it may exacly match or match zero or more additional components on the front of the candidte to match. Spotted by Haruto Kimura ok tb@ kenjiro@

Bump LibreSSL version for the release

2026-04-08T05:30:20+00:00

ok deraadt

Rename labellen to label_len

2026-04-07T13:16:41+00:00

Requested by jsing, ok beck