Add a comment noting the padding oracle.
authorEmilia Kasper <emilia@openssl.org>
Wed, 17 Dec 2014 11:25:28 +0000 (12:25 +0100)
committerEmilia Kasper <emilia@openssl.org>
Wed, 17 Dec 2014 13:55:04 +0000 (14:55 +0100)
Reviewed-by: Andy Polyakov <appro@openssl.org>
crypto/evp/evp_enc.c

index 4314b43719f4954ddba0322932f211d771da2cbc..2b62bf64d22b62786212dc0991898e44e8ac9cef 100644 (file)
@@ -524,6 +524,11 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
                        return(0);
                        }
                OPENSSL_assert(b <= sizeof ctx->final);
+
+               /*
+                * The following assumes that the ciphertext has been authenticated.
+                * Otherwise it provides a padding oracle.
+                */
                n=ctx->final[b-1];
                if (n == 0 || n > (int)b)
                        {