From: Richard Levitte <levitte@openssl.org>
Date: Mon, 16 May 2016 15:29:43 +0000 (+0200)
Subject: Don't require any length of password when decrypting
X-Git-Tag: OpenSSL_1_1_0-pre6~827
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=b160f2823fb3bafdf8728ea251aab0d07888b934;p=oweals%2Fopenssl.git

Don't require any length of password when decrypting

RT#2534

Reviewed-by: Tim Hudson <tjh@openssl.org>
---

diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index 6ee3b8e049..4ca61875ee 100644
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c
@@ -98,17 +98,23 @@ int PEM_def_callback(char *buf, int num, int w, void *key)
         prompt = "Enter PEM pass phrase:";
 
     for (;;) {
-        i = EVP_read_pw_string_min(buf, MIN_LENGTH, num, prompt, w);
+        /*
+         * We assume that w == 0 means decryption,
+         * while w == 1 means encryption
+         */
+        int min_len = w ? MIN_LENGTH : 0;
+
+        i = EVP_read_pw_string_min(buf, min_len, num, prompt, w);
         if (i != 0) {
             PEMerr(PEM_F_PEM_DEF_CALLBACK, PEM_R_PROBLEMS_GETTING_PASSWORD);
             memset(buf, 0, (unsigned int)num);
             return (-1);
         }
         j = strlen(buf);
-        if (j < MIN_LENGTH) {
+        if (min_len && j < min_len) {
             fprintf(stderr,
                     "phrase is too short, needs to be at least %d chars\n",
-                    MIN_LENGTH);
+                    min_len);
         } else
             break;
     }