evp: fix improper use of negative value issues

Coverity issues 1485662, 1485663 & 1485664.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)

diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
index 2c2a4ba90c141e299a92f5fe4a64031f28d56767..e43076752f3a5dbbf2d468fe4e022def5dd3cbdf 100644 (file)
--- a/crypto/evp/e_aes.c
+++ b/crypto/evp/e_aes.c
@@ -2516,9 +2516,14 @@ static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 static int aes_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                           const unsigned char *in, size_t len)
 {
-    unsigned int num = EVP_CIPHER_CTX_get_num(ctx);
+    int n = EVP_CIPHER_CTX_get_num(ctx);
+    unsigned int num;
     EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
 
+    if (n < 0)
+        return 0;
+    num = (unsigned int)n;
+
     if (dat->stream.ctr)
         CRYPTO_ctr128_encrypt_ctr32(in, out, len, &dat->ks,
                                     ctx->iv,

diff --git a/crypto/evp/e_aria.c b/crypto/evp/e_aria.c
index f53528ea5c1b0f459379e1c32be7ca0a9852c7bd..7e1fda33e1211137572372e979f03565ff80672c 100644 (file)
--- a/crypto/evp/e_aria.c
+++ b/crypto/evp/e_aria.c
@@ -175,9 +175,14 @@ const EVP_CIPHER *EVP_aria_##keylen##_##mode(void) \
 static int aria_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                                const unsigned char *in, size_t len)
 {
-    unsigned int num = EVP_CIPHER_CTX_get_num(ctx);
+    int n = EVP_CIPHER_CTX_get_num(ctx);
+    unsigned int num;
     EVP_ARIA_KEY *dat = EVP_C_DATA(EVP_ARIA_KEY, ctx);
 
+    if (n < 0)
+        return 0;
+    num = (unsigned int)n;
+
     CRYPTO_ctr128_encrypt(in, out, len, &dat->ks, ctx->iv,
                           EVP_CIPHER_CTX_buf_noconst(ctx), &num,
                           (block128_f) ossl_aria_encrypt);

diff --git a/crypto/evp/e_sm4.c b/crypto/evp/e_sm4.c
index 39bec569f78bbd20c60a8a195f55d68eaa0ae567..abd603015c714ce96251ce22e3c2f59d462d5907 100644 (file)
--- a/crypto/evp/e_sm4.c
+++ b/crypto/evp/e_sm4.c
@@ -74,9 +74,14 @@ IMPLEMENT_BLOCK_CIPHER(sm4, ks, sm4, EVP_SM4_KEY, NID_sm4,
 static int sm4_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                           const unsigned char *in, size_t len)
 {
-    unsigned int num = EVP_CIPHER_CTX_get_num(ctx);
+    int n = EVP_CIPHER_CTX_get_num(ctx);
+    unsigned int num;
     EVP_SM4_KEY *dat = EVP_C_DATA(EVP_SM4_KEY, ctx);
 
+    if (n < 0)
+        return 0;
+    num = (unsigned int)n;
+
     CRYPTO_ctr128_encrypt(in, out, len, &dat->ks, ctx->iv,
                           EVP_CIPHER_CTX_buf_noconst(ctx), &num,
                           (block128_f)ossl_sm4_encrypt);