openssl/providers/implementations/ciphers/cipher_sm4_hw.c
Shane Lontis f75abcc0f0 Fix Use after free when copying cipher ctx
Fixes #10438
issue found by clusterfuzz/ossfuzz

The dest was getting a copy of the src structure which contained a pointer that should point to an offset inside itself - because of the copy it was pointing to the original structure.

The setup for a ctx is mainly done by the initkey method in the PROV_CIPHER_HW structure. Because of this it makes sense that the structure should also contain a copyctx method that is use to resolve any pointers that need to be setup.

A dup_ctx has been added to the cipher_enc tests in evp_test. It does a dup after setup and then frees the original ctx. This detects any floating pointers in the duplicated context that were pointing back to the freed ctx.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10443)
2019-11-18 13:13:05 +10:00

47 lines
1.8 KiB
C

/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "cipher_sm4.h"
static int cipher_hw_sm4_initkey(PROV_CIPHER_CTX *ctx,
const unsigned char *key, size_t keylen)
{
PROV_SM4_CTX *sctx = (PROV_SM4_CTX *)ctx;
SM4_KEY *ks = &sctx->ks.ks;
SM4_set_key(key, ks);
ctx->ks = ks;
if (ctx->enc
|| (ctx->mode != EVP_CIPH_ECB_MODE
&& ctx->mode != EVP_CIPH_CBC_MODE))
ctx->block = (block128_f)SM4_encrypt;
else
ctx->block = (block128_f)SM4_decrypt;
return 1;
}
IMPLEMENT_CIPHER_HW_COPYCTX(cipher_hw_sm4_copyctx, PROV_SM4_CTX)
# define PROV_CIPHER_HW_sm4_mode(mode) \
static const PROV_CIPHER_HW sm4_##mode = { \
cipher_hw_sm4_initkey, \
cipher_hw_chunked_##mode, \
cipher_hw_sm4_copyctx \
}; \
const PROV_CIPHER_HW *PROV_CIPHER_HW_sm4_##mode(size_t keybits) \
{ \
return &sm4_##mode; \
}
PROV_CIPHER_HW_sm4_mode(cbc)
PROV_CIPHER_HW_sm4_mode(ecb)
PROV_CIPHER_HW_sm4_mode(ofb128)
PROV_CIPHER_HW_sm4_mode(cfb128)
PROV_CIPHER_HW_sm4_mode(ctr)