signature: add FIPS error state handling

[openssl.git] / providers / implementations / signature / mac_legacy.c

diff --git a/providers/implementations/signature/mac_legacy.c b/providers/implementations/signature/mac_legacy.c
index 3c6366756d2f6220f9b3172dbca7407cb5c3c4c9..0b1415a9c968c8848079077898faeb2208429558 100644 (file)
--- a/providers/implementations/signature/mac_legacy.c
+++ b/providers/implementations/signature/mac_legacy.c
@@ -19,6 +19,7 @@
 #include "prov/implementations.h"
 #include "prov/provider_ctx.h"
 #include "prov/macsignature.h"
+#include "prov/providercommon.h"
 
 static OSSL_FUNC_signature_newctx_fn mac_hmac_newctx;
 static OSSL_FUNC_signature_newctx_fn mac_siphash_newctx;
@@ -44,9 +45,13 @@ typedef struct {
 
 static void *mac_newctx(void *provctx, const char *propq, const char *macname)
 {
-    PROV_MAC_CTX *pmacctx = OPENSSL_zalloc(sizeof(PROV_MAC_CTX));
+    PROV_MAC_CTX *pmacctx;
     EVP_MAC *mac = NULL;
 
+    if (!ossl_prov_is_running())
+        return NULL;
+
+    pmacctx = OPENSSL_zalloc(sizeof(PROV_MAC_CTX));
     if (pmacctx == NULL)
         return NULL;
 
@@ -90,7 +95,10 @@ static int mac_digest_sign_init(void *vpmacctx, const char *mdname, void *vkey)
     PROV_MAC_CTX *pmacctx = (PROV_MAC_CTX *)vpmacctx;
     const char *ciphername = NULL, *engine = NULL;
 
-    if (pmacctx == NULL || vkey == NULL || !mac_key_up_ref(vkey))
+    if (!ossl_prov_is_running()
+            || pmacctx == NULL
+            || vkey == NULL
+            || !mac_key_up_ref(vkey))
         return 0;
 
     mac_key_free(pmacctx->key);
@@ -134,7 +142,7 @@ int mac_digest_sign_final(void *vpmacctx, unsigned char *mac, size_t *maclen,
 {
     PROV_MAC_CTX *pmacctx = (PROV_MAC_CTX *)vpmacctx;
 
-    if (pmacctx == NULL || pmacctx->macctx == NULL)
+    if (!ossl_prov_is_running() || pmacctx == NULL || pmacctx->macctx == NULL)
         return 0;
 
     return EVP_MAC_final(pmacctx->macctx, mac, maclen, macsize);
@@ -155,6 +163,9 @@ static void *mac_dupctx(void *vpmacctx)
     PROV_MAC_CTX *srcctx = (PROV_MAC_CTX *)vpmacctx;
     PROV_MAC_CTX *dstctx;
 
+    if (!ossl_prov_is_running())
+        return NULL;
+
     dstctx = OPENSSL_zalloc(sizeof(*srcctx));
     if (dstctx == NULL)
         return NULL;