mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

CMS_decrypt_set1_*(): fix NULL deref on unsuitable content type

Browse Source 
Fixes #19975
for CMS_decrypt_set1_pkey_and_peer() in the obvious way,
and a related potential crash in CMS_decrypt_set1_password().

The point is that the input might have an unexpected content type,
so a guard is needed at both places after `ec` is obtained.

Note that in CMS_decrypt_set1_pkey_and_peer() there was
no such ec != NULL guard for
```
    if (ris != NULL)
        debug = ec->debug;
```
maybe because it is implied here by ris != NULL.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19981)
This commit is contained in:
Dr. David von Oheimb 2023-01-02 13:05:08 +01:00 committed by Tomas Mraz
parent b1ce6a23f8
commit 69b995c6fb
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
crypto/cms/cms_smime.c
View File

@ -710,11 +710,13 @@ int CMS_decrypt_set1_pkey_and_peer(CMS_ContentInfo *cms, EVP_PKEY *pk,
CMS_EncryptedContentInfo *ec = ossl_cms_get0_env_enc_content(cms);
/* Prevent mem leak on earlier CMS_decrypt_set1_{pkey_and_peer,password} */
OPENSSL_clear_free(ec->key, ec->keylen);
ec->key = NULL;
ec->keylen = 0;
if (ec != NULL) {
OPENSSL_clear_free(ec->key, ec->keylen);
ec->key = NULL;
ec->keylen = 0;
}
if (ris != NULL)
if (ris != NULL && ec != NULL)
debug = ec->debug;
cms_pkey_ri_type = ossl_cms_pkey_get_ri_type(pk);
@ -828,9 +830,11 @@ int CMS_decrypt_set1_password(CMS_ContentInfo *cms,
CMS_EncryptedContentInfo *ec = ossl_cms_get0_env_enc_content(cms);
/* Prevent mem leak on earlier CMS_decrypt_set1_{pkey_and_peer,password} */
OPENSSL_clear_free(ec->key, ec->keylen);
ec->key = NULL;
ec->keylen = 0;
if (ec != NULL) {
OPENSSL_clear_free(ec->key, ec->keylen);
ec->key = NULL;
ec->keylen = 0;
}
for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++) {
ri = sk_CMS_RecipientInfo_value(ris, i);