Fix double free in d2i_PrivateKey().

[openssl.git] / crypto / evp / e_aes_cbc_hmac_sha256.c

diff --git a/crypto/evp/e_aes_cbc_hmac_sha256.c b/crypto/evp/e_aes_cbc_hmac_sha256.c
index 075a8e8cf70f42b8f2f0b6c1268d6b3dcc8bee46..3ac59abc34da8b34ad76fed3605e5f9d7d59f792 100644 (file)
--- a/crypto/evp/e_aes_cbc_hmac_sha256.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha256.c
@@ -59,6 +59,7 @@
 #include <openssl/sha.h>
 #include <openssl/rand.h>
 #include "modes_lcl.h"
+#include "internal/constant_time_locl.h"
 #include "internal/evp_int.h"
 
 #ifndef EVP_CIPH_FLAG_AEAD_CIPHER
@@ -91,8 +92,7 @@ typedef struct {
 
 #if     defined(AES_ASM) &&     ( \
         defined(__x86_64)       || defined(__x86_64__)  || \
-        defined(_M_AMD64)       || defined(_M_X64)      || \
-        defined(__INTEL__)      )
+        defined(_M_AMD64)       || defined(_M_X64)      )
 
 extern unsigned int OPENSSL_ia32cap_P[];
 # define AESNI_CAPABLE   (1<<(57-32))
@@ -595,6 +595,8 @@ static int aesni_cbc_hmac_sha256_cipher(EVP_CIPHER_CTX *ctx,
             maxpad |= (255 - maxpad) >> (sizeof(maxpad) * 8 - 8);
             maxpad &= 255;
 
+            ret &= constant_time_ge(maxpad, pad);
+
             inp_len = len - (SHA256_DIGEST_LENGTH + pad + 1);
             mask = (0 - ((inp_len - len) >> (sizeof(inp_len) * 8 - 1)));
             inp_len &= mask;