diff options
| author | Neil Horman <nhorman@openssl.org> | 2023-12-09 19:40:01 +0100 |
|---|---|---|
| committer | Neil Horman <nhorman@openssl.org> | 2024-01-25 14:27:53 +0100 |
| commit | 6f22bcd631ab622c2436bc5b299ba2677c388375 (patch) | |
| tree | e62244a2a0e8f491ab3e3b582928dbc6383f7abf /crypto/pkcs12 | |
| parent | Fix a possible memory leak in req_main (diff) | |
| download | openssl-6f22bcd631ab622c2436bc5b299ba2677c388375.tar.xz openssl-6f22bcd631ab622c2436bc5b299ba2677c388375.zip | |
Add appropriate NULL checks in EVP_CIPHER api
The EVP_CIPHER api currently assumes that calls made into several APIs
have already initalized the cipher in a given context via a call to
EVP_CipherInit[_ex[2]]. If that hasnt been done, instead of an error,
the result is typically a SIGSEGV.
Correct that by adding missing NULL checks in the apropriate apis prior
to using ctx->cipher
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22995)
Diffstat (limited to 'crypto/pkcs12')
| -rw-r--r-- | crypto/pkcs12/p12_decr.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/crypto/pkcs12/p12_decr.c b/crypto/pkcs12/p12_decr.c index b916db0ab1..498632a0bc 100644 --- a/crypto/pkcs12/p12_decr.c +++ b/crypto/pkcs12/p12_decr.c @@ -26,6 +26,7 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor, int outlen, i; EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); int max_out_len, mac_len = 0; + int block_size; if (ctx == NULL) { ERR_raise(ERR_LIB_PKCS12, ERR_R_EVP_LIB); @@ -43,7 +44,14 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor, * It's appended to encrypted text on encrypting * MAC should be processed on decrypting separately from plain text */ - max_out_len = inlen + EVP_CIPHER_CTX_get_block_size(ctx); + block_size = EVP_CIPHER_CTX_get_block_size(ctx); + + if (block_size == 0) { + ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_NULL_PARAMETER); + goto err; + } + + max_out_len = inlen + block_size; if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC) != 0) { if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len) < 0) { |