diff options
author | Matt Caswell <matt@openssl.org> | 2014-11-18 12:56:26 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2014-11-27 21:58:31 +0000 |
commit | 6ff76b334786a9e356ee1c731b2f233f4470f6e6 (patch) | |
tree | 5d2fc16aee46c00d49f935182d9eae33583f6daa /ssl | |
parent | 3b125151809e4da36f2535848572d6adaf37f729 (diff) |
Add checks to the return value of EVP_Cipher to prevent silent encryption failure.
PR#1767
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 244d0955adc027c0f41a3251e55d145bf940f9ce)
Diffstat (limited to 'ssl')
-rw-r--r-- | ssl/d1_enc.c | 3 | ||||
-rw-r--r-- | ssl/d1_pkt.c | 2 | ||||
-rw-r--r-- | ssl/s3_enc.c | 3 | ||||
-rw-r--r-- | ssl/s3_pkt.c | 3 |
4 files changed, 6 insertions, 5 deletions
diff --git a/ssl/d1_enc.c b/ssl/d1_enc.c index 712c4647f2..3da2b4c8c2 100644 --- a/ssl/d1_enc.c +++ b/ssl/d1_enc.c @@ -241,7 +241,8 @@ int dtls1_enc(SSL *s, int send) return 0; } - EVP_Cipher(ds,rec->data,rec->input,l); + if(EVP_Cipher(ds,rec->data,rec->input,l) < 1) + return -1; #ifdef KSSL_DEBUG { diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c index 3615423f69..8004528275 100644 --- a/ssl/d1_pkt.c +++ b/ssl/d1_pkt.c @@ -1511,7 +1511,7 @@ int do_dtls1_write(SSL *s, int type, const unsigned char *buf, unsigned int len, wr->length += bs; } - s->method->ssl3_enc->enc(s,1); + if(s->method->ssl3_enc->enc(s,1) < 1) goto err; /* record length after mac and block padding */ /* if (type == SSL3_RT_APPLICATION_DATA || diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index 9a494f3063..2ba52c45a1 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -534,7 +534,8 @@ int ssl3_enc(SSL *s, int send) /* otherwise, rec->length >= bs */ } - EVP_Cipher(ds,rec->data,rec->input,l); + if(EVP_Cipher(ds,rec->data,rec->input,l) < 1) + return -1; if (EVP_MD_CTX_md(s->read_hash) != NULL) mac_size = EVP_MD_CTX_size(s->read_hash); diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index 504b468ec8..92a65c38bf 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -816,8 +816,7 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf, wr->data=p; } - /* ssl3_enc can only have an error on read */ - s->method->ssl3_enc->enc(s,1); + if(s->method->ssl3_enc->enc(s,1)<1) goto err; /* record length after mac and block padding */ s2n(wr->length,plen); |