Commit 36e619d7 authored by Guido Vranken's avatar Guido Vranken Committed by Pauli
Browse files

EVP_EncryptUpdate, EVP_EncryptFinal_ex: don't branch on uninitialized memory 



If ctx->cipher->cupdate/ctx->cipher->cfinal failed, 'soutl' is left
uninitialized.

This patch incorporates the same logic as present in EVP_DecryptUpdate and
EVP_DecryptFinal_ex: only branch on 'soutl' if the preceding call succeeded.

Bug found by OSS-Fuzz.

Signed-off-by: default avatarGuido Vranken <guidovranken@gmail.com>

Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8874)
parent 0dc6bf3c

crypto/evp/evp_enc.c

+13 −8
Original line number Original line Diff line number Diff line
@@ -590,11 +590,14 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, 
                               inl + (blocksize == 1 ? 0 : blocksize), in,

                               inl + (blocksize == 1 ? 0 : blocksize), in,

                               (size_t)inl);

                               (size_t)inl);





    if (ret) {

        if (soutl > INT_MAX) {

        if (soutl > INT_MAX) {

            EVPerr(EVP_F_EVP_ENCRYPTUPDATE, EVP_R_UPDATE_ERROR);

            EVPerr(EVP_F_EVP_ENCRYPTUPDATE, EVP_R_UPDATE_ERROR);

            return 0;

            return 0;

        }

        }

        *outl = soutl;

        *outl = soutl;

    }



    return ret;

    return ret;





    /* TODO(3.0): Remove legacy code below */

    /* TODO(3.0): Remove legacy code below */
@@ -640,11 +643,13 @@ int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) 
    ret = ctx->cipher->cfinal(ctx->provctx, out, &soutl,

    ret = ctx->cipher->cfinal(ctx->provctx, out, &soutl,

                              blocksize == 1 ? 0 : blocksize);

                              blocksize == 1 ? 0 : blocksize);





    if (ret) {

        if (soutl > INT_MAX) {

        if (soutl > INT_MAX) {

            EVPerr(EVP_F_EVP_ENCRYPTFINAL_EX, EVP_R_FINAL_ERROR);

            EVPerr(EVP_F_EVP_ENCRYPTFINAL_EX, EVP_R_FINAL_ERROR);

            return 0;

            return 0;

        }

        }

        *outl = soutl;

        *outl = soutl;

    }





    return ret;

    return ret;