From: Rich Salz <rsalz@openssl.org>
Date: Thu, 28 Jun 2018 22:13:54 +0000 (-0400)
Subject: Zero-fill IV by default.
X-Git-Tag: OpenSSL_1_1_0i~65
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=e21602857e79becb64eb8cba3673830bd7a304e3;p=oweals%2Fopenssl.git

Zero-fill IV by default.

Fixes uninitialized memory read reported by Nick Mathewson

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6603)
(cherry picked from commit 10c3c1c1ec41ce16e51b92bb18fab92d1a42b49c)
---

diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index 33c03eec00..735cd54e57 100644
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c
@@ -466,6 +466,7 @@ int PEM_get_EVP_CIPHER_INFO(char *header, EVP_CIPHER_INFO *cipher)
     char *dekinfostart, c;
 
     cipher->cipher = NULL;
+    memset(cipher->iv, 0, sizeof(cipher->iv));
     if ((header == NULL) || (*header == '\0') || (*header == '\n'))
         return 1;