Removing those memcpy()s also took away the possibility for in and out to

be the same.  Therefore, the removed memcpy()s need to be restored.

diff --git a/crypto/aes/aes_cbc.c b/crypto/aes/aes_cbc.c
index 0a28ab8d3437d424ce41bb55cd9d79abd924760f..1222a21002c1add66fcfbf5fe57c84475838102b 100644 (file)
--- a/crypto/aes/aes_cbc.c
+++ b/crypto/aes/aes_cbc.c
@@ -91,20 +91,21 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
                }                       
        } else {
                while (len >= AES_BLOCK_SIZE) {
                }                       
        } else {
                while (len >= AES_BLOCK_SIZE) {

+                       memcpy(tmp, in, AES_BLOCK_SIZE);

                        AES_decrypt(in, out, key);
                        for(n=0; n < AES_BLOCK_SIZE; ++n)
                                out[n] ^= ivec[n];
                        AES_decrypt(in, out, key);
                        for(n=0; n < AES_BLOCK_SIZE; ++n)
                                out[n] ^= ivec[n];

-                       memcpy(ivec, in, AES_BLOCK_SIZE);
+                       memcpy(ivec, tmp, AES_BLOCK_SIZE);

                        len -= AES_BLOCK_SIZE;
                        in += AES_BLOCK_SIZE;
                        out += AES_BLOCK_SIZE;
                }
                if (len) {
                        memcpy(tmp, in, AES_BLOCK_SIZE);
                        len -= AES_BLOCK_SIZE;
                        in += AES_BLOCK_SIZE;
                        out += AES_BLOCK_SIZE;
                }
                if (len) {
                        memcpy(tmp, in, AES_BLOCK_SIZE);

-                       AES_decrypt(in, tmp, key);
+                       AES_decrypt(tmp, tmp, key);

                        for(n=0; n < len; ++n)
                                out[n] = tmp[n] ^ ivec[n];
                        for(n=0; n < len; ++n)
                                out[n] = tmp[n] ^ ivec[n];

-                       memcpy(ivec, in, AES_BLOCK_SIZE);
+                       memcpy(ivec, tmp, AES_BLOCK_SIZE);

                }                       
        }
 }
                }                       
        }
 }