309679 2026-03-11 08:12:35 -0700 Missing initialization and error checks in OpenSSL HKDF function 2026-04-28 07:18:48 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 pulkomandy webkit-unassigned ap webkit-bug-importer oldest_to_newest 2189123 0 pulkomandy 2026-03-11 08:12:35 -0700 The HKDF() function is missing a call to EVP_PKEY_derive_init() as done in this example code: https://docs.openssl.org/master/man3/EVP_PKEY_CTX_set_hkdf_md/#examples (Also it hardcodes to SHA-256 instead of forwarding the algorithm parameter, and it doesn't check the return codes). 2189139 1 ap 2026-03-11 09:17:24 -0700 Thank you for the report! Could you please point to the specific place in WebKit code? Grepping for HKDF returns a lot of hits. 2189142 2 pulkomandy 2026-03-11 09:21:28 -0700 This is a ticket associated with the corresponding merge request: https://github.com/WebKit/WebKit/pull/60354 I initially associated it with another existing ticket but was asked to create a separate one. 2189146 3 ap 2026-03-11 09:33:33 -0700 Thank you, makes sense now! I expect that you are planning to update the commit message accordingly. 2191352 4 webkit-bug-importer 2026-03-18 08:13:11 -0700 <rdar://problem/172833329> 2205341 5 ews-feeder 2026-04-28 07:18:45 -0700 Committed 312198@main (e611c7f8a9ff): <https://commits.webkit.org/312198@main> Reviewed commits have been landed. Closing PR #60354 and removing active labels.