Add a comment noting the padding oracle.

[openssl.git] / crypto / evp / evp_enc.c

diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
index 84a3f864daba2e8f8f779014a4ee40446f66ec12..757c5ae6f652aa592ca5e70a967ff1f5742c5856 100644 (file)
--- a/crypto/evp/evp_enc.c
+++ b/crypto/evp/evp_enc.c
@@ -549,6 +549,11 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
                        return(0);
                        }
                OPENSSL_assert(b <= sizeof ctx->final);
+
+               /*
+                * The following assumes that the ciphertext has been authenticated.
+                * Otherwise it provides a padding oracle.
+                */
                n=ctx->final[b-1];
                if (n == 0 || n > (int)b)
                        {
@@ -694,4 +699,3 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
                return in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out);
        return 1;
        }
-