Commit 9981220
crypto: fix behavior of createCipher in wrap mode
The old implementation silently failed in EVP_CipherInit_ex in
EVP_CIPH_WRAP_MODE, this commit should fix that.
PR-URL: #21287
Reviewed-By: Ujjwal Sharma <usharma1998@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 9353093 commit 9981220
1 file changed
Lines changed: 5 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -2611,10 +2611,14 @@ void CipherBase::Init(const char* cipher_type, | |||
| 2611 | 2611 | iv); | |
| 2612 | 2612 | ||
| 2613 | 2613 | ctx_.reset(EVP_CIPHER_CTX_new()); | |
| 2614 | + | ||
| 2615 | + const int mode = EVP_CIPHER_mode(cipher); | ||
| 2616 | + if (mode == EVP_CIPH_WRAP_MODE) | ||
| 2617 | + EVP_CIPHER_CTX_set_flags(ctx_.get(), EVP_CIPHER_CTX_FLAG_WRAP_ALLOW); | ||
| 2618 | + | ||
| 2614 | 2619 | const bool encrypt = (kind_ == kCipher); | |
| 2615 | 2620 | EVP_CipherInit_ex(ctx_.get(), cipher, nullptr, nullptr, nullptr, encrypt); | |
| 2616 | 2621 | ||
| 2617 | - int mode = EVP_CIPHER_CTX_mode(ctx_.get()); | ||
| 2618 | 2622 | if (encrypt && (mode == EVP_CIPH_CTR_MODE || mode == EVP_CIPH_GCM_MODE || | |
| 2619 | 2623 | mode == EVP_CIPH_CCM_MODE)) { | |
| 2620 | 2624 | // Ignore the return value (i.e. possible exception) because we are | |
@@ -2624,9 +2628,6 @@ void CipherBase::Init(const char* cipher_type, | |||
| 2624 | 2628 | cipher_type); | |
| 2625 | 2629 | } | |
| 2626 | 2630 | ||
| 2627 | - if (mode == EVP_CIPH_WRAP_MODE) | ||
| 2628 | - EVP_CIPHER_CTX_set_flags(ctx_.get(), EVP_CIPHER_CTX_FLAG_WRAP_ALLOW); | ||
| 2629 | - | ||
| 2630 | 2631 | if (IsAuthenticatedMode()) { | |
| 2631 | 2632 | if (!InitAuthenticated(cipher_type, EVP_CIPHER_iv_length(cipher), | |
| 2632 | 2633 | auth_tag_len)) | |
0 commit comments