diff options
| author | Kurt Roeckx <kurt@roeckx.be> | 2016-04-16 23:08:56 +0200 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2016-05-03 13:15:39 +0100 |
| commit | 70428eada9bc4cf31424d723d1f992baffeb0dfb (patch) | |
| tree | 75a2a8b160823c2f197c4a25a049523a7c39642f | |
| parent | 2c7fe4dc9ae0c84d2c398d57143983800cc3f18d (diff) | |
| download | openssl-new-70428eada9bc4cf31424d723d1f992baffeb0dfb.tar.gz | |
Check that we have enough padding characters.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
CVE-2016-2107
MR: #2572
| -rw-r--r-- | crypto/evp/e_aes_cbc_hmac_sha1.c | 3 | ||||
| -rw-r--r-- | crypto/evp/e_aes_cbc_hmac_sha256.c | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c index 394a380aa0..2d5131f284 100644 --- a/crypto/evp/e_aes_cbc_hmac_sha1.c +++ b/crypto/evp/e_aes_cbc_hmac_sha1.c @@ -59,6 +59,7 @@ #include <openssl/rand.h> #include "modes_lcl.h" #include "internal/evp_int.h" +#include "internal/constant_time_locl.h" #ifndef EVP_CIPH_FLAG_AEAD_CIPHER # define EVP_CIPH_FLAG_AEAD_CIPHER 0x200000 @@ -583,6 +584,8 @@ static int aesni_cbc_hmac_sha1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, maxpad |= (255 - maxpad) >> (sizeof(maxpad) * 8 - 8); maxpad &= 255; + ret &= constant_time_ge(maxpad, pad); + inp_len = len - (SHA_DIGEST_LENGTH + pad + 1); mask = (0 - ((inp_len - len) >> (sizeof(inp_len) * 8 - 1))); inp_len &= mask; diff --git a/crypto/evp/e_aes_cbc_hmac_sha256.c b/crypto/evp/e_aes_cbc_hmac_sha256.c index 956cd58a05..3ac59abc34 100644 --- a/crypto/evp/e_aes_cbc_hmac_sha256.c +++ b/crypto/evp/e_aes_cbc_hmac_sha256.c @@ -59,6 +59,7 @@ #include <openssl/sha.h> #include <openssl/rand.h> #include "modes_lcl.h" +#include "internal/constant_time_locl.h" #include "internal/evp_int.h" #ifndef EVP_CIPH_FLAG_AEAD_CIPHER @@ -594,6 +595,8 @@ static int aesni_cbc_hmac_sha256_cipher(EVP_CIPHER_CTX *ctx, maxpad |= (255 - maxpad) >> (sizeof(maxpad) * 8 - 8); maxpad &= 255; + ret &= constant_time_ge(maxpad, pad); + inp_len = len - (SHA256_DIGEST_LENGTH + pad + 1); mask = (0 - ((inp_len - len) >> (sizeof(inp_len) * 8 - 1))); inp_len &= mask; |