diff options
| author | Pauli <pauli@openssl.org> | 2022-07-26 11:46:45 +1000 |
|---|---|---|
| committer | Pauli <pauli@openssl.org> | 2022-08-19 20:12:24 +1000 |
| commit | 2e4b074800a293c5f3049286116a0a5030ea9312 (patch) | |
| tree | 569d77085e7f4eb416f59fdf5f5b48a0798cc28a /crypto/evp | |
| parent | 87ceff925f5f1d43dac0413f36c8b7bba94e4a41 (diff) | |
Fix bug in EVP_CIPHER_CTX_get_iv_length()
Out of range values could possibly be returned due to a lack of range checking.
Very unlikely to be exploitable for our provider because sensible values are
returned for all ciphers.
Also fixed the defaulting code so that the cipher's IV length is returned if
the cipher ctx doesn't support getting.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18995)
Diffstat (limited to 'crypto/evp')
| -rw-r--r-- | crypto/evp/evp_lib.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/crypto/evp/evp_lib.c b/crypto/evp/evp_lib.c index e0ad6cf93e..d88066d0a2 100644 --- a/crypto/evp/evp_lib.c +++ b/crypto/evp/evp_lib.c @@ -509,12 +509,17 @@ int EVP_CIPHER_CTX_get_iv_length(const EVP_CIPHER_CTX *ctx) size_t v = len; OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; - params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_IVLEN, &v); - rv = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->algctx, params); - if (rv != EVP_CTRL_RET_UNSUPPORTED) { - if (rv <= 0) + if (ctx->cipher->get_ctx_params != NULL) { + params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_IVLEN, + &v); + rv = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->algctx, params); + if (rv > 0) { + if (OSSL_PARAM_modified(params) + && !OSSL_PARAM_get_int(params, &len)) + return -1; + } else if (rv != EVP_CTRL_RET_UNSUPPORTED) { return -1; - len = (int)v; + } } /* Code below to be removed when legacy support is dropped. */ else if ((EVP_CIPHER_get_flags(ctx->cipher) |