From: Matt Caswell <matt@openssl.org>
Date: Tue, 18 Nov 2014 12:56:26 +0000 (+0000)
Subject: Add checks to the return value of EVP_Cipher to prevent silent encryption failure.
X-Git-Tag: OpenSSL_1_0_1k~77
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=244d0955adc027c0f41a3251e55d145bf940f9ce;p=oweals%2Fopenssl.git

Add checks to the return value of EVP_Cipher to prevent silent encryption failure.

PR#1767

Reviewed-by: Richard Levitte <levitte@openssl.org>
---

diff --git a/ssl/d1_enc.c b/ssl/d1_enc.c
index 712c4647f2..3da2b4c8c2 100644
--- a/ssl/d1_enc.c
+++ b/ssl/d1_enc.c
@@ -241,7 +241,8 @@ int dtls1_enc(SSL *s, int send)
 				return 0;
 			}
 		
-		EVP_Cipher(ds,rec->data,rec->input,l);
+		if(EVP_Cipher(ds,rec->data,rec->input,l) < 1)
+			return -1;
 
 #ifdef KSSL_DEBUG
 		{
diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index 438c0913d2..edd17df54b 100644
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -1619,7 +1619,7 @@ int do_dtls1_write(SSL *s, int type, const unsigned char *buf, unsigned int len,
 		wr->length += bs;
 		}
 
-	s->method->ssl3_enc->enc(s,1);
+	if(s->method->ssl3_enc->enc(s,1) < 1) goto err;
 
 	/* record length after mac and block padding */
 /*	if (type == SSL3_RT_APPLICATION_DATA ||
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 9db45af7ea..89c133e681 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -535,7 +535,8 @@ int ssl3_enc(SSL *s, int send)
 			/* otherwise, rec->length >= bs */
 			}
 		
-		EVP_Cipher(ds,rec->data,rec->input,l);
+		if(EVP_Cipher(ds,rec->data,rec->input,l) < 1)
+			return -1;
 
 		if (EVP_MD_CTX_md(s->read_hash) != NULL)
 			mac_size = EVP_MD_CTX_size(s->read_hash);
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 4c9285f355..d1cd752209 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -856,8 +856,7 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
 		wr->length += eivlen;
 		}
 
-	/* ssl3_enc can only have an error on read */
-	s->method->ssl3_enc->enc(s,1);
+	if(s->method->ssl3_enc->enc(s,1)<1) goto err;
 
 	/* record length after mac and block padding */
 	s2n(wr->length,plen);