File openssl-CVE-2026-31790.patch of Package openssl-3

commit a6cea8781bf8fd53768a8ea3ff2d1120ec644b0d
Author: Nikola Pajkovsky <nikolap@openssl.org>
Date:   Thu Mar 19 12:16:08 2026 +0100

    rsa_kem: validate RSA_public_encrypt() result in RSASVE
    
    RSA_public_encrypt() returns the number of bytes written on success and
    -1 on failure. With the existing `if (ret)` check, a provider-side RSA KEM
    encapsulation can incorrectly succeed when the underlying RSA public
    encrypt operation fails. In that case the code reports success, returns
    lengths as if encapsulation completed normally, and leaves the freshly
    generated secret available instead of discarding it.
    
    Tighten the success condition so RSASVE only succeeds when
    RSA_public_encrypt() returns a positive value equal to the modulus-sized
    output expected for RSA_NO_PADDING. Any other return value is treated as
    failure, and the generated secret is cleansed before returning.
    
    Fixes CVE: CVE-2026-31790
    Fixes: https://github.com/openssl/srt/issues/95
    Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>

diff --git a/providers/implementations/kem/rsa_kem.c b/providers/implementations/kem/rsa_kem.c
index f7bf368a0d..74dfafddd9 100644
--- a/providers/implementations/kem/rsa_kem.c
+++ b/providers/implementations/kem/rsa_kem.c
@@ -316,17 +316,19 @@ static int rsasve_generate(PROV_RSA_CTX *prsactx,
         return 0;
 
     /* Step(3): out = RSAEP((n,e), z) */
-    ret = RSA_public_encrypt(nlen, secret, out, prsactx->rsa, RSA_NO_PADDING);
-    if (ret) {
-        ret = 1;
-        if (outlen != NULL)
-            *outlen = nlen;
-        if (secretlen != NULL)
-            *secretlen = nlen;
-    } else {
+    ret = RSA_public_encrypt((int)nlen, secret, out, prsactx->rsa,
+        RSA_NO_PADDING);
+    if (ret <= 0 || ret != (int)nlen) {
         OPENSSL_cleanse(secret, nlen);
+        return 0;
     }
-    return ret;
+
+    if (outlen != NULL)
+        *outlen = nlen;
+    if (secretlen != NULL)
+        *secretlen = nlen;
+
+    return 1;
 }
 
 /**