cms encrypt, better OBJ_nid2obj() return check

Fixes #22225

In OBJ_nid2obj(), if the NID does not have an OID, then a pointer to
the special "undefined" ASN1_OBJECT is returned.  Check for the
undefined-ASN1_OBJECT and return an error.  Also, add a test for this
in 80-test_cms.t.

Testing:

  #!/bin/bash -x

  shopt -s expand_aliases

  alias openssl="LD_LIBRARY_PATH=~/git/openssl ~/git/openssl/apps/openssl"

  echo "This is a confidential message.  It should be encrypted." > msg.txt

  ## this should fail b/c there is no OID for aes-256-ctr
  openssl cms -encrypt -in msg.txt -aes-256-ctr -out msg.txt.cms -recip demos/cms/signer.pem
  echo $?

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22392)

diff --git a/crypto/cms/cms_enc.c b/crypto/cms/cms_enc.c
index c9a5cfc69bbfbec07acabf2a0bcc71ef4a16f0e7..3f1328c04130614df2fd29270b55278d71b717cf 100644 (file)
--- a/crypto/cms/cms_enc.c
+++ b/crypto/cms/cms_enc.c
@@ -81,7 +81,7 @@ BIO *ossl_cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec,
 
     if (enc) {
         calg->algorithm = OBJ_nid2obj(EVP_CIPHER_CTX_get_type(ctx));
-        if (calg->algorithm == NULL) {
+        if (calg->algorithm == NULL || calg->algorithm->nid == NID_undef) {
             ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM);
             goto err;
         }

diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
index 385791610577e1a9a315769a034a25e4cf1996bb..0e1ebc50cd90485828917e25f92b2efb17a4a477 100644 (file)
--- a/test/recipes/80-test_cms.t
+++ b/test/recipes/80-test_cms.t
@@ -50,7 +50,7 @@ my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib)
 
 $no_rc2 = 1 if disabled("legacy");
 
-plan tests => 21;
+plan tests => 22;
 
 ok(run(test(["pkcs7_test"])), "test pkcs7");
 
@@ -1154,3 +1154,14 @@ with({ exit_checker => sub { return shift == 3; } },
             "issue#21986");
         }
     });
+
+# Test for problem reported in #22225
+with({ exit_checker => sub { return shift == 3; } },
+    sub {
+       ok(run(app(['openssl', 'cms', '-encrypt',
+                   '-in', srctop_file("test", "smcont.txt"),
+                   '-aes-256-ctr', '-recip',
+                   catfile($smdir, "smec1.pem"),
+                  ])),
+          "Check for failure when cipher does not have an assigned OID (issue#22225)");
+     });