同步社区pr 修复rust-openssl 漏洞 RUSTSEC-2025-0022

Signed-off-by: ljy9810 <longjianyin@h-partners.com>

openssl/src/cipher.rs

@@ -146,7 +146,7 @@ impl Cipher {
             let ptr = cvt_p(ffi::EVP_CIPHER_fetch(
                 ctx.map_or(ptr::null_mut(), ForeignTypeRef::as_ptr),
                 algorithm.as_ptr(),
-                properties.map_or(ptr::null_mut(), |s| s.as_ptr()),
+                properties.as_ref().map_or(ptr::null_mut(), |s| s.as_ptr()),
             ))?;
 
             Ok(Cipher::from_ptr(ptr))
@@ -534,3 +534,15 @@ impl CipherRef {
         unsafe { EVP_CIPHER_block_size(self.as_ptr()) as usize }
     }
 }
+
+#[cfg(test)]
+mod test {
+    #[cfg(ossl300)]
+    use super::Cipher;
+
+    #[test]
+    #[cfg(ossl300)]
+    fn test_cipher_fetch_properties() {
+        assert!(Cipher::fetch(None, "AES-128-GCM", Some("provider=gibberish")).is_err());
+    }
+}

openssl/src/lib.rs

@@ -56,12 +56,12 @@
 //! override the automatic detection logic.
 //!
 //! * `OPENSSL_DIR` - If specified, the directory of an OpenSSL installation. The directory should contain `lib` and
-//!     `include` subdirectories containing the libraries and headers respectively.
+//!    `include` subdirectories containing the libraries and headers respectively.
 //! * `OPENSSL_LIB_DIR` and `OPENSSL_INCLUDE_DIR` - If specified, the directories containing the OpenSSL libraries and
-//!     headers respectively. This can be used if the OpenSSL installation is split in a nonstandard directory layout.
+//!    headers respectively. This can be used if the OpenSSL installation is split in a nonstandard directory layout.
 //! * `OPENSSL_STATIC` - If set, the crate will statically link to OpenSSL rather than dynamically link.
 //! * `OPENSSL_LIBS` - If set, a `:`-separated list of library names to link to (e.g. `ssl:crypto`). This can be used
-//!     if nonstandard library names were used for whatever reason.
+//!    if nonstandard library names were used for whatever reason.
 //! * `OPENSSL_NO_VENDOR` - If set, always find OpenSSL in the system, even if the `vendored` feature is enabled.
 //!
 //! Additionally, these variables can be prefixed with the upper-cased target architecture (e.g.

openssl/src/md.rs

@@ -107,7 +107,7 @@ impl Md {
             let ptr = cvt_p(ffi::EVP_MD_fetch(
                 ctx.map_or(ptr::null_mut(), ForeignTypeRef::as_ptr),
                 algorithm.as_ptr(),
-                properties.map_or(ptr::null_mut(), |s| s.as_ptr()),
+                properties.as_ref().map_or(ptr::null_mut(), |s| s.as_ptr()),
             ))?;
 
             Ok(Md::from_ptr(ptr))
@@ -233,3 +233,15 @@ impl MdRef {
         unsafe { Nid::from_raw(ffi::EVP_MD_type(self.as_ptr())) }
     }
 }
+
+#[cfg(test)]
+mod test {
+    #[cfg(ossl300)]
+    use super::Md;
+
+    #[test]
+    #[cfg(ossl300)]
+    fn test_md_fetch_properties() {
+        assert!(Md::fetch(None, "SHA-256", Some("provider=gibberish")).is_err());
+    }
+}