Commit 1222d273 authored by Bernd Edlinger's avatar Bernd Edlinger Committed by Matt Caswell
Browse files

Fix a crash in EVP_CIPHER_CTX_cleanup due to cipher_data may be NULL 


or EVP_CTRL_INIT/EVP_CTRL_COPY was not called or failed.
- if that happens set cipher = NULL.

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2149)
parent 748cb9a1

crypto/evp/evp_enc.c

+8 −1
Original line number Diff line number Diff line
@@ -182,6 +182,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, 
        if (ctx->cipher->ctx_size) {

            ctx->cipher_data = OPENSSL_malloc(ctx->cipher->ctx_size);

            if (!ctx->cipher_data) {

                ctx->cipher = NULL;

                EVPerr(EVP_F_EVP_CIPHERINIT_EX, ERR_R_MALLOC_FAILURE);

                return 0;

            }
@@ -193,6 +194,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, 
        ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW;

        if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) {

            if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL)) {

                ctx->cipher = NULL;

                EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);

                return 0;

            }
@@ -654,6 +656,7 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in) 
    if (in->cipher_data && in->cipher->ctx_size) {

        out->cipher_data = OPENSSL_malloc(in->cipher->ctx_size);

        if (!out->cipher_data) {

            out->cipher = NULL;

            EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, ERR_R_MALLOC_FAILURE);

            return 0;

        }
@@ -661,6 +664,10 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in) 
    }



    if (in->cipher->flags & EVP_CIPH_CUSTOM_COPY)

        return in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out);

        if (!in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out)) {

            out->cipher = NULL;

            EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, EVP_R_INITIALIZATION_ERROR);

            return 0;

        }

    return 1;

}