Don't require any length of password when decrypting
authorRichard Levitte <levitte@openssl.org>
Mon, 16 May 2016 15:29:43 +0000 (17:29 +0200)
committerRichard Levitte <levitte@openssl.org>
Tue, 17 May 2016 15:18:25 +0000 (17:18 +0200)
RT#2534

Reviewed-by: Matt Caswell <matt@openssl.org>
crypto/pem/pem_lib.c

index fe881d6..ac4faae 100644 (file)
@@ -105,17 +105,23 @@ int PEM_def_callback(char *buf, int num, int w, void *key)
         prompt = "Enter PEM pass phrase:";
 
     for (;;) {
-        i = EVP_read_pw_string_min(buf, MIN_LENGTH, num, prompt, w);
+        /*
+         * We assume that w == 0 means decryption,
+         * while w == 1 means encryption
+         */
+        int min_len = w ? MIN_LENGTH : 0;
+
+        i = EVP_read_pw_string_min(buf, min_len, num, prompt, w);
         if (i != 0) {
             PEMerr(PEM_F_PEM_DEF_CALLBACK, PEM_R_PROBLEMS_GETTING_PASSWORD);
             memset(buf, 0, (unsigned int)num);
             return (-1);
         }
         j = strlen(buf);
-        if (j < MIN_LENGTH) {
+        if (min_len && j < min_len) {
             fprintf(stderr,
                     "phrase is too short, needs to be at least %d chars\n",
-                    MIN_LENGTH);
+                    min_len);
         } else
             break;
     }