Add a comment noting the padding oracle.

[openssl.git] / crypto / evp / evp_enc.c

diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
index 6da323077a2ac01bd7d325e9ccc223bff77426ee..757c5ae6f652aa592ca5e70a967ff1f5742c5856 100644 (file)
--- a/crypto/evp/evp_enc.c
+++ b/crypto/evp/evp_enc.c
@@ -174,7 +174,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                        {
                        const EVP_CIPHER *fcipher;
                        if (cipher)
-                               fcipher = FIPS_get_cipherbynid(EVP_CIPHER_type(cipher));
+                               fcipher = evp_get_fips_cipher(cipher);
                        if (fcipher)
                                cipher = fcipher;
                        return FIPS_cipherinit(ctx, cipher, key, iv, enc);
@@ -195,7 +195,8 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                        ctx->cipher_data = NULL;
                        }
                ctx->key_len = cipher->key_len;
-               ctx->flags = 0;
+               /* Preserve wrap enable flag, zero everything else */
+               ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW;
                if(ctx->cipher->flags & EVP_CIPH_CTRL_INIT)
                        {
                        if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL))
@@ -222,6 +223,13 @@ skip_to_init:
            || ctx->cipher->block_size == 8
            || ctx->cipher->block_size == 16);
 
+       if(!(ctx->flags & EVP_CIPHER_CTX_FLAG_WRAP_ALLOW)
+               && EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_WRAP_MODE)
+               {
+               EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_WRAP_MODE_NOT_ALLOWED);
+               return 0;
+               }
+
        if(!(EVP_CIPHER_CTX_flags(ctx) & EVP_CIPH_CUSTOM_IV)) {
                switch(EVP_CIPHER_CTX_mode(ctx)) {
 
@@ -255,6 +263,7 @@ skip_to_init:
                        break;
                }
        }
+               
 
        if(key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) {
                if(!ctx->cipher->init(ctx,key,iv,enc)) return 0;
@@ -540,6 +549,11 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
                        return(0);
                        }
                OPENSSL_assert(b <= sizeof ctx->final);
+
+               /*
+                * The following assumes that the ciphertext has been authenticated.
+                * Otherwise it provides a padding oracle.
+                */
                n=ctx->final[b-1];
                if (n == 0 || n > (int)b)
                        {
@@ -685,4 +699,3 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
                return in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out);
        return 1;
        }
-