diff options
| author | Georg Richter <georg@mariadb.com> | 2017-02-01 12:14:37 +0100 |
|---|---|---|
| committer | Georg Richter <georg@mariadb.com> | 2017-02-01 12:14:37 +0100 |
| commit | 23628d123bd2b0fe48e41c79207835c96e329496 (patch) | |
| tree | 329ce9f9075a244b152778f7f96f1643d68110ea /mysys_ssl | |
| parent | e1977712cce51f3d914e6598869c6f4dee2ff46e (diff) | |
| download | mariadb-git-23628d123bd2b0fe48e41c79207835c96e329496.tar.gz | |
Fix for MDEV-11174:
A GCM encrypted ciphertext must contain an authentication tag with AES_BLOCK_SIZE length, so we need to check that the length of ciphertext is at least AES_BLOCK_SIZE.
Diffstat (limited to 'mysys_ssl')
| -rw-r--r-- | mysys_ssl/my_crypt.cc | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/mysys_ssl/my_crypt.cc b/mysys_ssl/my_crypt.cc index 49bd9af3f60..5411a908bf8 100644 --- a/mysys_ssl/my_crypt.cc +++ b/mysys_ssl/my_crypt.cc @@ -168,6 +168,9 @@ public: */ if (!ctx.encrypt) { + /* encrypted string must contain authenticaton tag (see MDEV-11174) */ + if (slen < MY_AES_BLOCK_SIZE) + return MY_AES_BAD_DATA; slen-= MY_AES_BLOCK_SIZE; if(!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, MY_AES_BLOCK_SIZE, (void*)(src + slen))) |