Security fixes brought forward from 0.9.7.

[openssl.git] / apps / enc.c

diff --git a/apps/enc.c b/apps/enc.c
index e53cf3b415cb156e204d46b0c73f7079376f6b14..eff5c5610e9a3f9a26c4695cf825b502acd49045 100644 (file)
--- a/apps/enc.c
+++ b/apps/enc.c
@@ -66,11 +66,7 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/rand.h>
-#ifndef NO_MD5
-#include <openssl/md5.h>
-#endif
 #include <openssl/pem.h>
-#include <openssl/engine.h>
 #include <ctype.h>
 
 int set_hex(char *in,unsigned char *out,int size);
@@ -82,7 +78,7 @@ int set_hex(char *in,unsigned char *out,int size);
 #define BSIZE  (8*1024)
 #define        PROG    enc_main
 
-void show_ciphers(const OBJ_NAME *name,void *bio_)
+static void show_ciphers(const OBJ_NAME *name,void *bio_)
        {
        BIO *bio=bio_;
        static int n;
@@ -106,11 +102,12 @@ int MAIN(int argc, char **argv)
        {
        ENGINE *e = NULL;
        static const char magic[]="Salted__";
-       char mbuf[8];   /* should be 1 smaller than magic */
+       char mbuf[sizeof magic-1];
        char *strbuf=NULL;
        unsigned char *buff=NULL,*bufsize=NULL;
        int bsize=BSIZE,verbose=0;
        int ret=1,inl;
+       int nopad = 0;
        unsigned char key[EVP_MAX_KEY_LENGTH],iv[EVP_MAX_IV_LENGTH];
        unsigned char salt[PKCS5_SALT_LEN];
        char *str=NULL, *passarg = NULL, *pass = NULL;
@@ -120,8 +117,8 @@ int MAIN(int argc, char **argv)
        const EVP_CIPHER *cipher=NULL,*c;
        char *inf=NULL,*outf=NULL;
        BIO *in=NULL,*out=NULL,*b64=NULL,*benc=NULL,*rbio=NULL,*wbio=NULL;
-#define PROG_NAME_SIZE  16
-       char pname[PROG_NAME_SIZE];
+#define PROG_NAME_SIZE  39
+       char pname[PROG_NAME_SIZE+1];
        char *engine = NULL;
 
        apps_startup();
@@ -130,8 +127,11 @@ int MAIN(int argc, char **argv)
                if ((bio_err=BIO_new(BIO_s_file())) != NULL)
                        BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 
+       if (!load_config(bio_err, NULL))
+               goto end;
+
        /* first check the program name */
-       program_name(argv[0],pname,PROG_NAME_SIZE);
+       program_name(argv[0],pname,sizeof pname);
        if (strcmp(pname,"base64") == 0)
                base64=1;
 
@@ -174,6 +174,8 @@ int MAIN(int argc, char **argv)
                        printkey=1;
                else if (strcmp(*argv,"-v") == 0)
                        verbose=1;
+               else if (strcmp(*argv,"-nopad") == 0)
+                       nopad=1;
                else if (strcmp(*argv,"-salt") == 0)
                        nosalt=0;
                else if (strcmp(*argv,"-nosalt") == 0)
@@ -214,7 +216,7 @@ int MAIN(int argc, char **argv)
                                goto bad;
                                }
                        buf[0]='\0';
-                       fgets(buf,128,infile);
+                       fgets(buf,sizeof buf,infile);
                        fclose(infile);
                        i=strlen(buf);
                        if ((i > 0) &&
@@ -282,23 +284,7 @@ bad:
                argv++;
                }
 
-       if (engine != NULL)
-               {
-               if((e = ENGINE_by_id(engine)) == NULL)
-                       {
-                       BIO_printf(bio_err,"invalid engine \"%s\"\n",
-                               engine);
-                       goto end;
-                       }
-               if(!ENGINE_set_default(e, ENGINE_METHOD_ALL))
-                       {
-                       BIO_printf(bio_err,"can't use that engine\n");
-                       goto end;
-                       }
-               BIO_printf(bio_err,"engine \"%s\" set.\n", engine);
-               /* Free our "structural" reference. */
-               ENGINE_free(e);
-               }
+        e = setup_engine(bio_err, engine, 0);
 
        if (bufsize != NULL)
                {
@@ -404,7 +390,7 @@ bad:
        if (outf == NULL)
                {
                BIO_set_fp(out,stdout,BIO_NOCLOSE);
-#ifdef VMS
+#ifdef OPENSSL_SYS_VMS
                {
                BIO *tmpbio = BIO_new(BIO_f_linebuffer());
                out = BIO_push(tmpbio, out);
@@ -456,12 +442,12 @@ bad:
                        else {
                                if(enc) {
                                        if(hsalt) {
-                                               if(!set_hex(hsalt,salt,PKCS5_SALT_LEN)) {
+                                               if(!set_hex(hsalt,salt,sizeof salt)) {
                                                        BIO_printf(bio_err,
                                                                "invalid hex salt value\n");
                                                        goto end;
                                                }
-                                       } else if (RAND_pseudo_bytes(salt, PKCS5_SALT_LEN) < 0)
+                                       } else if (RAND_pseudo_bytes(salt, sizeof salt) < 0)
                                                goto end;
                                        /* If -P option then don't bother writing */
                                        if((printkey != 2)
@@ -469,14 +455,14 @@ bad:
                                                         sizeof magic-1) != sizeof magic-1
                                               || BIO_write(wbio,
                                                            (char *)salt,
-                                                           PKCS5_SALT_LEN) != PKCS5_SALT_LEN)) {
+                                                           sizeof salt) != sizeof salt)) {
                                                BIO_printf(bio_err,"error writing output file\n");
                                                goto end;
                                        }
                                } else if(BIO_read(rbio,mbuf,sizeof mbuf) != sizeof mbuf
                                          || BIO_read(rbio,
                                                      (unsigned char *)salt,
-                                   PKCS5_SALT_LEN) != PKCS5_SALT_LEN) {
+                                   sizeof salt) != sizeof salt) {
                                        BIO_printf(bio_err,"error reading input file\n");
                                        goto end;
                                } else if(memcmp(mbuf,magic,sizeof magic-1)) {
@@ -504,6 +490,14 @@ bad:
                        BIO_printf(bio_err,"invalid hex iv value\n");
                        goto end;
                        }
+               if ((hiv == NULL) && (str == NULL))
+                       {
+                       /* No IV was explicitly set and no IV was generated
+                        * during EVP_BytesToKey. Hence the IV is undefined,
+                        * making correct decryption impossible. */
+                       BIO_printf(bio_err, "iv undefined\n");
+                       goto end;
+                       }
                if ((hkey != NULL) && !set_hex(hkey,key,sizeof key))
                        {
                        BIO_printf(bio_err,"invalid hex key value\n");
@@ -513,6 +507,12 @@ bad:
                if ((benc=BIO_new(BIO_f_cipher())) == NULL)
                        goto end;
                BIO_set_cipher(benc,cipher,key,iv,enc);
+               if (nopad)
+                       {
+                       EVP_CIPHER_CTX *ctx;
+                       BIO_get_cipher_ctx(benc, &ctx);
+                       EVP_CIPHER_CTX_set_padding(ctx, 0);
+                       }
                if (debug)
                        {
                        BIO_set_callback(benc,BIO_debug_callback);
@@ -524,7 +524,7 @@ bad:
                        if (!nosalt)
                                {
                                printf("salt=");
-                               for (i=0; i<PKCS5_SALT_LEN; i++)
+                               for (i=0; i<sizeof salt; i++)
                                        printf("%02X",salt[i]);
                                printf("\n");
                                }
@@ -585,6 +585,7 @@ end:
        if (benc != NULL) BIO_free(benc);
        if (b64 != NULL) BIO_free(b64);
        if(pass) OPENSSL_free(pass);
+       apps_shutdown();
        EXIT(ret);
        }