C++ OpenSSL (1.1.1) EVP_BytesToKey -> CryptoJS.PBKDF2. Why different key and iv?

Question

JavaScript

Please tell me where is the mistake. I'm trying to get the same key/iv from password/salt.
In c++:

typedef uchar aes_salt_t[8];
typedef uchar aes_key_t[32];
typedef uchar aes_iv_t[32];
int m_count = 1000;
const string pass = "password";
aes_key_t   m_key;
aes_iv_t    m_iv;
aes_salt_t  m_salt = "12345678";
bzero(m_key, sizeof(m_key));
bzero(m_iv, sizeof(m_iv));
OpenSSL_add_all_algorithms();
const EVP_CIPHER* cipher = EVP_get_cipherbyname("aes-256-cbc");
const EVP_MD*     digest = EVP_get_digestbyname("sha256");
int ks = EVP_BytesToKey(cipher,    // cipher type
        digest,    // message digest
        m_salt,    // 8 bytes
        (uchar*)m_pass.c_str(), // pass value
        m_pass.length(),
        m_count,   // number of rounds
        m_key,
        m_iv);
cout << encode_base64(m_key, 32) << endl;
cout << encode_base64(m_iv, 16) << endl;

In CryptoJS (web):

var password = "password";
var salt = "12345678";
var saltWA = CryptoJS.enc.Utf8.parse(salt);
var keyIvWA = CryptoJS.PBKDF2(
            password,
            saltWA, {
                keySize: (32 + 16) / 4,   // Верно?
                iterations: 1000,
                hasher: CryptoJS.algo.SHA256
            }
        );
var keyWA = CryptoJS.lib.WordArray.create(keyIvWA.words.slice(0, 32 / 4));
var ivWA = CryptoJS.lib.WordArray.create(keyIvWA.words.slice(32 / 4, (32 + 16) / 4));

console.log(keyWA.toString(CryptoJS.enc.Base64))
console.log(ivWA.toString(CryptoJS.enc.Base64))

Why different output? Why doesn't CryptoJS ask anything about cipher, only about digest, while OpenSSL uses both?

Answer 1

The issue was resolved by rolling back to CryptoJS 3.3.0 (it was the last one, 4.0)