3 files changed, 37 insertions, 50 deletions

diff --git a/src/lib/libcrypto/cms/cms_pwri.c b/src/lib/libcrypto/cms/cms_pwri.c
index 1f64fc71f7..f64f4ab68c 100644
--- a/src/lib/libcrypto/cms/cms_pwri.c
+++ b/src/lib/libcrypto/cms/cms_pwri.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_pwri.c,v 1.32 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: cms_pwri.c,v 1.35 2025/09/30 12:51:16 tb Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -267,7 +267,7 @@ kek_unwrap_key(unsigned char *out, size_t *outlen, const unsigned char *in,
                 /* Check byte failure */
                 goto err;
         }
-        if (inlen < (size_t)(tmp[0] - 4)) {
+        if (inlen < 4 + (size_t)tmp[0]) {
                 /* Invalid length value */
                 goto err;
         }
@@ -368,13 +368,13 @@ cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
         kekcipher = EVP_get_cipherbyobj(kekalg->algorithm);
         if (!kekcipher) {
                 CMSerror(CMS_R_UNKNOWN_CIPHER);
-                return 0;
+                goto err;
         }
 
         kekctx = EVP_CIPHER_CTX_new();
         if (kekctx == NULL) {
                 CMSerror(ERR_R_MALLOC_FAILURE);
-                return 0;
+                goto err;
         }
         /* Fixup cipher based on AlgorithmIdentifier to set IV etc */
         if (!EVP_CipherInit_ex(kekctx, kekcipher, NULL, NULL, NULL, en_de))
@@ -389,8 +389,8 @@ cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
 
         /* Finish password based key derivation to setup key in "ctx" */
 
-        if (EVP_PBE_CipherInit(algtmp->algorithm, (char *)pwri->pass,
-            pwri->passlen, algtmp->parameter, kekctx, en_de) < 0) {
+        if (!EVP_PBE_CipherInit(algtmp->algorithm, (char *)pwri->pass,
+            pwri->passlen, algtmp->parameter, kekctx, en_de)) {
                 CMSerror(ERR_R_EVP_LIB);
                 goto err;
         }
diff --git a/src/lib/libcrypto/cms/cms_sd.c b/src/lib/libcrypto/cms/cms_sd.c
index f79d740482..abcac83e47 100644
--- a/src/lib/libcrypto/cms/cms_sd.c
+++ b/src/lib/libcrypto/cms/cms_sd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_sd.c,v 1.34 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: cms_sd.c,v 1.36 2025/07/31 02:24:21 tb Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -484,35 +484,6 @@ CMS_add1_signer(CMS_ContentInfo *cms, X509 *signer, EVP_PKEY *pk,
 }
 LCRYPTO_ALIAS(CMS_add1_signer);
 
-static int
-cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t)
-{
-        ASN1_TIME *tt;
-        int r = 0;
-
-        if (t)
-                tt = t;
-        else
-                tt = X509_gmtime_adj(NULL, 0);
-
-        if (!tt)
-                goto merr;
-
-        if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_signingTime,
-                                                tt->type, tt, -1) <= 0)
-                goto merr;
-
-        r = 1;
-
- merr:
-        if (!t)
-                ASN1_TIME_free(tt);
-        if (!r)
-                CMSerror(ERR_R_MALLOC_FAILURE);
-
-        return r;
-}
-
 EVP_PKEY_CTX *
 CMS_SignerInfo_get0_pkey_ctx(CMS_SignerInfo *si)
 {
@@ -778,6 +749,7 @@ cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain)
 int
 CMS_SignerInfo_sign(CMS_SignerInfo *si)
 {
+        ASN1_TIME *at = NULL;
         const EVP_MD *md;
         unsigned char *buf = NULL, *sig = NULL;
         int buf_len = 0;
@@ -788,7 +760,12 @@ CMS_SignerInfo_sign(CMS_SignerInfo *si)
                 goto err;
 
         if (CMS_signed_get_attr_by_NID(si, NID_pkcs9_signingTime, -1) < 0) {
-                if (!cms_add1_signingTime(si, NULL))
+                if ((at = X509_gmtime_adj(NULL, 0)) == NULL) {
+                        CMSerror(ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+                if (!CMS_signed_add1_attr_by_NID(si, NID_pkcs9_signingTime,
+                    at->type, at, -1))
                         goto err;
         }
 
@@ -828,6 +805,7 @@ CMS_SignerInfo_sign(CMS_SignerInfo *si)
         ret = 1;
 
  err:
+        ASN1_TIME_free(at);
         (void)EVP_MD_CTX_reset(si->mctx);
         freezero(buf, buf_len);
         freezero(sig, sig_len);
@@ -1012,6 +990,8 @@ LCRYPTO_ALIAS(CMS_add_smimecap);
  * Add AlgorithmIdentifier OID of type |nid| to the SMIMECapability attribute
  * set |*out_algs| (see RFC 3851, section 2.5.2). If keysize > 0, the OID has
  * an integer parameter of value |keysize|, otherwise parameters are omitted.
+ *
+ * See also PKCS7_simple_smimecap().
  */
 int
 CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **out_algs, int nid, int keysize)
diff --git a/src/lib/libcrypto/cms/cms_smime.c b/src/lib/libcrypto/cms/cms_smime.c
index 85a0e6f6e5..a4918643d2 100644
--- a/src/lib/libcrypto/cms/cms_smime.c
+++ b/src/lib/libcrypto/cms/cms_smime.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_smime.c,v 1.29 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: cms_smime.c,v 1.31 2025/11/28 06:07:09 tb Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -277,25 +277,32 @@ CMS_ContentInfo *
 CMS_EncryptedData_encrypt(BIO *in, const EVP_CIPHER *cipher,
     const unsigned char *key, size_t keylen, unsigned int flags)
 {
-        CMS_ContentInfo *cms;
+        CMS_ContentInfo *cms = NULL;
 
-        if (!cipher) {
+        if (cipher == NULL) {
                 CMSerror(CMS_R_NO_CIPHER);
-                return NULL;
+                goto err;
         }
-        cms = CMS_ContentInfo_new();
-        if (cms == NULL)
-                return NULL;
+
+        if ((cms = CMS_ContentInfo_new()) == NULL)
+                goto err;
+
         if (!CMS_EncryptedData_set1_key(cms, cipher, key, keylen))
-                return NULL;
+                goto err;
 
-        if (!(flags & CMS_DETACHED))
-                CMS_set_detached(cms, 0);
+        if ((flags & CMS_DETACHED) == 0) {
+                if (!CMS_set_detached(cms, 0))
+                        goto err;
+        }
 
-        if ((flags & (CMS_STREAM | CMS_PARTIAL)) ||
-            CMS_final(cms, in, NULL, flags))
-                return cms;
+        if ((flags & (CMS_STREAM | CMS_PARTIAL)) == 0) {
+                if (!CMS_final(cms, in, NULL, flags))
+                        goto err;
+        }
 
+        return cms;
+
+ err:
         CMS_ContentInfo_free(cms);
 
         return NULL;