Fix Issue OSS-Fuzz: Branch on uninitialized memory (in ccm code).
authorShane Lontis <shane.lontis@oracle.com>
Sun, 25 Aug 2019 07:10:48 +0000 (17:10 +1000)
committerShane Lontis <shane.lontis@oracle.com>
Sun, 25 Aug 2019 07:10:55 +0000 (17:10 +1000)
This would also happen for aes-ccm. There was one branch path where it just returned 1
without setting *padlen, It now branches so that the value is set to 0.

Fixes #9691

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9692)

providers/common/ciphers/cipher_ccm.c

index 980c815..fcfef73 100644 (file)
@@ -349,7 +349,7 @@ static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
 
     /* EVP_*Final() doesn't return any data */
     if (in == NULL && out != NULL)
-        return 1;
+        goto finish;
 
     if (!ctx->iv_set)
         goto err;
@@ -388,6 +388,7 @@ static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
         }
     }
     olen = len;
+finish:
     rv = 1;
 err:
     *padlen = olen;