summaryrefslogtreecommitdiffstats
path: root/freebsd/crypto/openssl/crypto/evp
diff options
context:
space:
mode:
Diffstat (limited to 'freebsd/crypto/openssl/crypto/evp')
-rw-r--r--freebsd/crypto/openssl/crypto/evp/e_aes.c9
-rw-r--r--freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c2
-rw-r--r--freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c6
-rw-r--r--freebsd/crypto/openssl/crypto/evp/e_des3.c2
-rw-r--r--freebsd/crypto/openssl/crypto/evp/evp_enc.c9
-rw-r--r--freebsd/crypto/openssl/crypto/evp/pmeth_lib.c2
6 files changed, 27 insertions, 3 deletions
diff --git a/freebsd/crypto/openssl/crypto/evp/e_aes.c b/freebsd/crypto/openssl/crypto/evp/e_aes.c
index cf137644..116bb390 100644
--- a/freebsd/crypto/openssl/crypto/evp/e_aes.c
+++ b/freebsd/crypto/openssl/crypto/evp/e_aes.c
@@ -1122,6 +1122,8 @@ BLOCK_CIPHER_generic_pack(NID_aes, 128, EVP_CIPH_FLAG_FIPS)
static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
{
EVP_AES_GCM_CTX *gctx = c->cipher_data;
+ if (gctx == NULL)
+ return 0;
OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
if (gctx->iv != c->iv)
OPENSSL_free(gctx->iv);
@@ -1237,10 +1239,15 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
{
unsigned int len = c->buf[arg - 2] << 8 | c->buf[arg - 1];
/* Correct length for explicit IV */
+ if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
+ return 0;
len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
/* If decrypting correct for tag too */
- if (!c->encrypt)
+ if (!c->encrypt) {
+ if (len < EVP_GCM_TLS_TAG_LEN)
+ return 0;
len -= EVP_GCM_TLS_TAG_LEN;
+ }
c->buf[arg - 2] = len >> 8;
c->buf[arg - 1] = len & 0xff;
}
diff --git a/freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c b/freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c
index 4d9bf63b..2aaf8a62 100644
--- a/freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c
+++ b/freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c
@@ -861,6 +861,8 @@ static int aesni_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
key->payload_length = len;
if ((key->aux.tls_ver =
p[arg - 4] << 8 | p[arg - 3]) >= TLS1_1_VERSION) {
+ if (len < AES_BLOCK_SIZE)
+ return 0;
len -= AES_BLOCK_SIZE;
p[arg - 2] = len >> 8;
p[arg - 1] = len;
diff --git a/freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c b/freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c
index 4ecd28ee..1a683da2 100644
--- a/freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c
+++ b/freebsd/crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha256.c
@@ -827,15 +827,19 @@ static int aesni_cbc_hmac_sha256_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
case EVP_CTRL_AEAD_TLS1_AAD:
{
unsigned char *p = ptr;
- unsigned int len = p[arg - 2] << 8 | p[arg - 1];
+ unsigned int len;
if (arg != EVP_AEAD_TLS1_AAD_LEN)
return -1;
+ len = p[arg - 2] << 8 | p[arg - 1];
+
if (ctx->encrypt) {
key->payload_length = len;
if ((key->aux.tls_ver =
p[arg - 4] << 8 | p[arg - 3]) >= TLS1_1_VERSION) {
+ if (len < AES_BLOCK_SIZE)
+ return 0;
len -= AES_BLOCK_SIZE;
p[arg - 2] = len >> 8;
p[arg - 1] = len;
diff --git a/freebsd/crypto/openssl/crypto/evp/e_des3.c b/freebsd/crypto/openssl/crypto/evp/e_des3.c
index ed96c437..d19667b8 100644
--- a/freebsd/crypto/openssl/crypto/evp/e_des3.c
+++ b/freebsd/crypto/openssl/crypto/evp/e_des3.c
@@ -214,6 +214,8 @@ static int des_ede3_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
size_t n;
unsigned char c[1], d[1];
+ if (!EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS))
+ inl *= 8;
for (n = 0; n < inl; ++n) {
c[0] = (in[n / 8] & (1 << (7 - n % 8))) ? 0x80 : 0;
DES_ede3_cfb_encrypt(c, d, 1, 1,
diff --git a/freebsd/crypto/openssl/crypto/evp/evp_enc.c b/freebsd/crypto/openssl/crypto/evp/evp_enc.c
index c87918bf..ea2b36ad 100644
--- a/freebsd/crypto/openssl/crypto/evp/evp_enc.c
+++ b/freebsd/crypto/openssl/crypto/evp/evp_enc.c
@@ -184,6 +184,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
if (ctx->cipher->ctx_size) {
ctx->cipher_data = OPENSSL_malloc(ctx->cipher->ctx_size);
if (!ctx->cipher_data) {
+ ctx->cipher = NULL;
EVPerr(EVP_F_EVP_CIPHERINIT_EX, ERR_R_MALLOC_FAILURE);
return 0;
}
@@ -195,6 +196,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW;
if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) {
if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL)) {
+ ctx->cipher = NULL;
EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
}
@@ -656,6 +658,7 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
if (in->cipher_data && in->cipher->ctx_size) {
out->cipher_data = OPENSSL_malloc(in->cipher->ctx_size);
if (!out->cipher_data) {
+ out->cipher = NULL;
EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, ERR_R_MALLOC_FAILURE);
return 0;
}
@@ -663,6 +666,10 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
}
if (in->cipher->flags & EVP_CIPH_CUSTOM_COPY)
- return in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out);
+ if (!in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out)) {
+ out->cipher = NULL;
+ EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, EVP_R_INITIALIZATION_ERROR);
+ return 0;
+ }
return 1;
}
diff --git a/freebsd/crypto/openssl/crypto/evp/pmeth_lib.c b/freebsd/crypto/openssl/crypto/evp/pmeth_lib.c
index 0189dfad..5b170cf2 100644
--- a/freebsd/crypto/openssl/crypto/evp/pmeth_lib.c
+++ b/freebsd/crypto/openssl/crypto/evp/pmeth_lib.c
@@ -190,6 +190,7 @@ static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)
if (pmeth->init) {
if (pmeth->init(ret) <= 0) {
+ ret->pmeth = NULL;
EVP_PKEY_CTX_free(ret);
return NULL;
}
@@ -317,6 +318,7 @@ EVP_PKEY_CTX *EVP_PKEY_CTX_dup(EVP_PKEY_CTX *pctx)
if (pctx->pmeth->copy(rctx, pctx) > 0)
return rctx;
+ rctx->pmeth = NULL;
EVP_PKEY_CTX_free(rctx);
return NULL;
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-04 14:06:58 +0000