From f9cf774cbd31c3498ade4574c3b0ae6cb9773e28 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 16 Aug 2016 14:07:29 +0100 Subject: [PATCH] Ensure we unpad in constant time for read pipelining The read pipelining code broke constant time unpadding. See GitHub issue #1438 Reviewed-by: Rich Salz --- ssl/record/ssl3_record.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/ssl/record/ssl3_record.c b/ssl/record/ssl3_record.c index 5f9ce7a065..f1d6f72d83 100644 --- a/ssl/record/ssl3_record.c +++ b/ssl/record/ssl3_record.c @@ -831,9 +831,15 @@ int tls1_enc(SSL *s, SSL3_RECORD *recs, unsigned int n_recs, int send) int tmpret; for (ctr = 0; ctr < n_recs; ctr++) { tmpret = tls1_cbc_remove_padding(s, &recs[ctr], bs, mac_size); - if (tmpret == -1) - return -1; - ret &= tmpret; + /* + * If tmpret == 0 then this means publicly invalid so we can + * short circuit things here. Otherwise we must respect constant + * time behaviour. + */ + if (tmpret == 0) + return 0; + ret = constant_time_select_int(constant_time_eq_int(tmpret, 1), + ret, -1); } } if (pad && !send) { -- 2.25.1