Commit 9f561c1c23 for openssl.org

commit 9f561c1c232786f8406173f4d09ccc49a33f8883
Author: Jan Schaumann <jschauma@akamai.com>
Date:   Mon May 18 17:42:25 2026 -0400

    EVP_MD_demo.c, tls13secretstest.c: avoid signed-to-unsigned integer conversion

    Should EVP_MD_size() return -1, the size_t len variable would wrap,
    causing any subsequent error checks to not trigger. Change to type
    int (which is what EVP_MD_size() returns).

    While this is just in test/demo code, that's the kind of code that
    people might copy and reuse elsewhere, and that AI vuln scanners
    trigger on, so might as well try to eliminate that noise.

    Fixes: 7a7fbeb924a0 "fix all the warnings in our demos and make them enableable"
    Fixes: 134bfe56c4fe "Add a test for the TLS1.3 secret generation"
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Fri Oct  9 19:19:13 2026
    Merged-from: https://github.com/openssl/openssl/pull/31222

diff --git a/demos/digest/EVP_MD_demo.c b/demos/digest/EVP_MD_demo.c
index f24bec75fd..92c5f8d193 100644
--- a/demos/digest/EVP_MD_demo.c
+++ b/demos/digest/EVP_MD_demo.c
@@ -78,6 +78,7 @@ static int demonstrate_digest(void)
     const char *option_properties = NULL;
     EVP_MD *message_digest = NULL;
     EVP_MD_CTX *digest_context = NULL;
+    int sz = 0;
     unsigned int digest_length;
     unsigned char *digest_value = NULL;
     unsigned int j;
@@ -100,11 +101,12 @@ static int demonstrate_digest(void)
         goto cleanup;
     }
     /* Determine the length of the fetched digest type */
-    digest_length = EVP_MD_get_size(message_digest);
-    if (digest_length <= 0) {
+    sz = EVP_MD_get_size(message_digest);
+    if (sz <= 0) {
         fprintf(stderr, "EVP_MD_get_size returned invalid size.\n");
         goto cleanup;
     }
+    digest_length = (unsigned int)sz;

     digest_value = OPENSSL_malloc(digest_length);
     if (digest_value == NULL) {
diff --git a/test/tls13secretstest.c b/test/tls13secretstest.c
index 098e80c5c1..3ac98cc14c 100644
--- a/test/tls13secretstest.c
+++ b/test/tls13secretstest.c
@@ -322,6 +322,7 @@ static int test_handshake_secrets(void)
     SSL *ssl = NULL;
     SSL_CONNECTION *s;
     int ret = 0;
+    int sz;
     size_t hashsize;
     unsigned char out_master_secret[EVP_MAX_MD_SIZE];
     size_t master_secret_length;
@@ -360,7 +361,10 @@ static int test_handshake_secrets(void)
             handshake_secret, sizeof(handshake_secret)))
         goto err;

-    hashsize = EVP_MD_get_size(ssl_handshake_md(s));
+    sz = EVP_MD_get_size(ssl_handshake_md(s));
+    if (sz < 0)
+        goto err;
+    hashsize = (size_t)sz;
     if (!TEST_size_t_eq(sizeof(client_hts), hashsize))
         goto err;
     if (!TEST_size_t_eq(sizeof(client_hts_key), KEYLEN))