openssl/crypto/modes
Richard Godbee e6abba3ad6 CRYPTO_128_unwrap(): Fix refactoring damage
crypto/modes/wrap128.c was heavily refactored to support AES Key Wrap
with Padding, and four bugs were introduced into CRYPTO_128_unwrap() at
that time:

- crypto_128_unwrap_raw()'s return value ('ret') is checked incorrectly,
  and the function immediately returns 'ret' in (almost) all cases.
  This makes the IV checking code later in the function unreachable, but
  callers think the IV check succeeded since CRYPTO_128_unwrap()'s
  return value is non-zero.

  FIX: Return 0 (error) if crypto_128_unwrap_raw() returned 0 (error).

- crypto_128_unwrap_raw() writes the IV to the 'got_iv' buffer, not to
  the first 8 bytes of the output buffer ('out') as the IV checking code
  expects.  This makes the IV check fail.

  FIX: Compare 'iv' to 'got_iv', not 'out'.

- The data written to the output buffer ('out') is "cleansed" if the IV
  check fails, but the code passes OPENSSL_cleanse() the input buffer
  length ('inlen') instead of the number of bytes that
  crypto_128_unwrap_raw() wrote to the output buffer ('ret').  This
  means that OPENSSL_cleanse() could potentially write past the end of
  'out'.

  FIX: Change 'inlen' to 'ret' in the OPENSSL_cleanse() call.

- CRYPTO_128_unwrap() is returning the length of the input buffer
  ('inlen') instead of the number of bytes written to the output buffer
  ('ret').  This could cause the caller to read past the end of 'out'.

  FIX: Return 'ret' instead of 'inlen' at the end of the function.

PR#3749

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-03-20 23:22:17 +00:00
..
asm ARMv4 assembly pack: add Cortex-A15 performance data. 2015-03-08 14:09:32 +01:00
cbc128.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
ccm128.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
cfb128.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
ctr128.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
cts128.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
gcm128.c Dead code: crypto/dh,modes,pkcs12,ripemd,rsa,srp 2015-02-03 11:20:56 -05:00
Makefile Remove fipscanister build functionality from makefiles. 2014-12-08 13:23:45 +00:00
modes_lcl.h Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
modes.h Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
ocb128.c Fix warning on some compilers where variable index shadows a global 2015-01-28 10:57:14 +00:00
ofb128.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
wrap128.c CRYPTO_128_unwrap(): Fix refactoring damage 2015-03-20 23:22:17 +00:00
xts128.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00