EVP_DecodeUpdate() should not produce padding zeros to the decoded output (Fixes #26677)
EVP_DecodeUpdate() should not produce zeros for input padding `=` signs to avoid writing to non-allocated memory regions. To achieve this: - Add `eof` parameter to `evp_decodeblock_int` function in `openssl/crypto/evp`. The parameter should either contain the number of the input padding characters to ignore or `-1` if the function has to count them. - Use precalculated `eof` in `EVP_DecodeUpdate` to fix its behaviour. - Use `eof = -1` in `EVP_DecodeFinal` to count it in `evp_decodeblock_int`. - Do not ignore padding in `EVP_DecodeBlock` (`eof = 0`) because it should write padding zeros according to the documentation. - Add the HISTORY section to EVP_EncodeInit documentation to describe the fix. Other changes: - Update AUTHORS.md - Update the copyright date in the documentation. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26678)
This commit is contained in:
parent
6ef393b89b
commit
f86acc9434
5 changed files with 89 additions and 16 deletions
|
@ -176,9 +176,15 @@ EVP_DecodeBlock() returns the length of the data decoded or -1 on error.
|
|||
|
||||
L<evp(7)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
The EVP_DecodeUpdate() function was fixed in OpenSSL 3.5,
|
||||
so now it produces the number of bytes specified in B<outl*>
|
||||
and does not decode padding bytes (B<=>) to 6 zero bits.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
|
||||
Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
this file except in compliance with the License. You can obtain a copy
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue