/* Provenance: openssl/openssl PKCS12_item_decrypt_d2i_ex (vuln).
 * repo: openssl/openssl
 * commit: ea8fc4c345fbd749048809c9f7c881ea656b0b94
 * parent: ea8fc4c345fbd749048809c9f7c881ea656b0b94
 * commit_url: https://github.com/openssl/openssl/commit/2c13bf15286328641a805eb3b7c97e27d42881fb
 * cve: CVE-2025-69421
 * license: Apache-2.0
 * function: PKCS12_item_decrypt_d2i_ex
 * relpath: crypto/pkcs12/p12_decr.c
 */

void *PKCS12_item_decrypt_d2i_ex(const X509_ALGOR *algor, const ASN1_ITEM *it,
    const char *pass, int passlen,
    const ASN1_OCTET_STRING *oct, int zbuf,
    OSSL_LIB_CTX *libctx,
    const char *propq)
{
    unsigned char *out = NULL;
    const unsigned char *p;
    void *ret;
    int outlen = 0;

    if (!PKCS12_pbe_crypt_ex(algor, pass, passlen, oct->data, oct->length,
            &out, &outlen, 0, libctx, propq))
        return NULL;
    p = out;
    OSSL_TRACE_BEGIN(PKCS12_DECRYPT)
    {
        BIO_printf(trc_out, "\n");
        BIO_dump(trc_out, out, outlen);
        BIO_printf(trc_out, "\n");
    }
    OSSL_TRACE_END(PKCS12_DECRYPT);
    ret = ASN1_item_d2i(NULL, &p, outlen, it);
    if (zbuf)
        OPENSSL_cleanse(out, outlen);
    if (!ret)
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
    OPENSSL_free(out);
    return ret;
}