From: Richard Levitte <levitte@openssl.org>
Date: Tue, 26 Nov 2019 11:40:16 +0000 (+0100)
Subject: i2b_PVK(): Use Encrypt, not Decrypt
X-Git-Tag: OpenSSL_1_1_1e~129
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=d4f094a04a3a89319f5bf9277e79bd8d77ba10fa;p=oweals%2Fopenssl.git

i2b_PVK(): Use Encrypt, not Decrypt

We used EVP_EncryptInit_ex() to initialise, but EVP_DecryptUpdate()
and EVP_DecryptFinal_ex() to actually perform encryption.  This worked
long ago, when the Encrypt and Decrypt variants were the same, but
doesn't now (actually haven't for a very long time).

This shows how seldom PVK is actually used.

Fixes #9338

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/10521)
---

diff --git a/crypto/pem/pvkfmt.c b/crypto/pem/pvkfmt.c
index 2bbee4a306..1fc19c17f9 100644
--- a/crypto/pem/pvkfmt.c
+++ b/crypto/pem/pvkfmt.c
@@ -844,9 +844,9 @@ static int i2b_PVK(unsigned char **out, EVP_PKEY *pk, int enclevel,
         if (!EVP_EncryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))
             goto error;
         OPENSSL_cleanse(keybuf, 20);
-        if (!EVP_DecryptUpdate(cctx, p, &enctmplen, p, pklen - 8))
+        if (!EVP_EncryptUpdate(cctx, p, &enctmplen, p, pklen - 8))
             goto error;
-        if (!EVP_DecryptFinal_ex(cctx, p + enctmplen, &enctmplen))
+        if (!EVP_EncryptFinal_ex(cctx, p + enctmplen, &enctmplen))
             goto error;
     }