public/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Missing Error Messages for AES-OCB Tag Length Validation

Browse source 
Related to #8331
Addressing found issues by adding specific error messages to improve
feedback when tag length checks fail for the `EVP_CTRL_AEAD_SET_TAG`
parameter in the AES-OCB algorithm.

- Added PROV_R_INVALID_TAG_LENGTH error to indicate when the current tag
  length exceeds the maximum tag length of the algorithm.
- Added `PROV_R_INVALID_TAG_LENGTH` error to indicate when the current tag
  length in the context does not match a custom tag length provided as
  a parameter.
- Added `ERR_R_PASSED_INVALID_ARGUMENT` error to handle cases where an
  invalid pointer is passed in encryption mode.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25425)

(cherry picked from commit 645edf50f0)
This commit is contained in:
erbsland-dev 2024-09-10 21:24:59 +02:00 • committed by Tomas Mraz
parent 642567ad8a
commit ceee552964
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
providers/implementations/ciphers/cipher_aes_ocb.c
View file

@ -367,12 +367,20 @@ static int aes_ocb_set_ctx_params(void *vctx, const OSSL_PARAM params[])
}
if (p->data == NULL) {
/* Tag len must be 0 to 16 */
if (p->data_size > OCB_MAX_TAG_LEN)
if (p->data_size > OCB_MAX_TAG_LEN) {
ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG_LENGTH);
return 0;
}
ctx->taglen = p->data_size;
} else {
if (p->data_size != ctx->taglen || ctx->base.enc)
if (ctx->base.enc) {
ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT);
return 0;
}
if (p->data_size != ctx->taglen) {
ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG_LENGTH);
return 0;
}
memcpy(ctx->tag, p->data, p->data_size);
}
}