Commit b99f1023 authored Apr 24, 2017 by Rich Salz

check length sanity before correcting in EVP_CTRL_AEAD_TLS1_AAD



Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3276)

parent fb2345a1

crypto/evp/e_aes.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -1237,10 +1237,15 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX c, int type, int arg, void ptr)
		{
		unsigned int len = c->buf[arg - 2] << 8 \| c->buf[arg - 1];
		/* Correct length for explicit IV */
		if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
		return 0;
		len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
		/* If decrypting correct for tag too */
		if (!c->encrypt)
		if (!c->encrypt) {
		if (len < EVP_GCM_TLS_TAG_LEN)
		return 0;
		len -= EVP_GCM_TLS_TAG_LEN;
		}
		c->buf[arg - 2] = len >> 8;
		c->buf[arg - 1] = len & 0xff;
		}

crypto/evp/e_aes_cbc_hmac_sha1.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -859,6 +859,8 @@ static int aesni_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
		key->payload_length = len;
		if ((key->aux.tls_ver =
		p[arg - 4] << 8 \| p[arg - 3]) >= TLS1_1_VERSION) {
		if (len < AES_BLOCK_SIZE)
		return 0;
		len -= AES_BLOCK_SIZE;
		p[arg - 2] = len >> 8;
		p[arg - 1] = len;

crypto/evp/e_aes_cbc_hmac_sha256.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -836,6 +836,8 @@ static int aesni_cbc_hmac_sha256_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
		key->payload_length = len;
		if ((key->aux.tls_ver =
		p[arg - 4] << 8 \| p[arg - 3]) >= TLS1_1_VERSION) {
		if (len < AES_BLOCK_SIZE)
		return 0;
		len -= AES_BLOCK_SIZE;
		p[arg - 2] = len >> 8;
		p[arg - 1] = len;