Skip to content

Commit 50b5b66

Browse files
author
jsing
committed
Use LONG_MAX as the limit for ciphers with long based APIs.
These ciphers have long based APIs, while EVP has a size_t based API. The intent of these loops is to handle sizes that are bigger than LONG_MAX. Rather than using the rather crazy EVP_MAXCHUNK construct, use LONG_MAX rounded down to a large block size, ensuring that it is a block size multiple. Revert the recently added overflow checks now that this is handled more appropriately. ok tb@
1 parent 7cd43b1 commit 50b5b66

File tree

6 files changed

+120
-169
lines changed

6 files changed

+120
-169
lines changed

‎src/lib/libcrypto/evp/e_bf.c

Lines changed: 16 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: e_bf.c,v 1.13 2022/09/10 17:39:47 jsing Exp $ */
1+
/* $OpenBSD: e_bf.c,v 1.14 2022/09/15 07:04:19 jsing Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -86,14 +86,13 @@ bf_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
8686
static int
8787
bf_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, size_t inl)
8888
{
89-
if (inl > LONG_MAX)
90-
return 0;
91-
92-
while (inl >= EVP_MAXCHUNK) {
93-
BF_cbc_encrypt(in, out, (long)EVP_MAXCHUNK, &((EVP_BF_KEY *)ctx->cipher_data)->ks, ctx->iv, ctx->encrypt);
94-
inl -= EVP_MAXCHUNK;
95-
in += EVP_MAXCHUNK;
96-
out += EVP_MAXCHUNK;
89+
size_t chunk = LONG_MAX & ~0xff;
90+
91+
while (inl >= chunk) {
92+
BF_cbc_encrypt(in, out, (long)chunk, &((EVP_BF_KEY *)ctx->cipher_data)->ks, ctx->iv, ctx->encrypt);
93+
inl -= chunk;
94+
in += chunk;
95+
out += chunk;
9796
}
9897

9998
if (inl)
@@ -105,10 +104,7 @@ bf_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
105104
static int
106105
bf_cfb64_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, size_t inl)
107106
{
108-
size_t chunk = EVP_MAXCHUNK;
109-
110-
if (inl > LONG_MAX)
111-
return 0;
107+
size_t chunk = LONG_MAX & ~0xff;
112108

113109
if (inl < chunk)
114110
chunk = inl;
@@ -130,9 +126,6 @@ bf_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
130126
{
131127
size_t i, bl;
132128

133-
if (inl > LONG_MAX)
134-
return 0;
135-
136129
bl = ctx->cipher->block_size;
137130

138131
if (inl < bl)
@@ -149,14 +142,13 @@ bf_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
149142
static int
150143
bf_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, size_t inl)
151144
{
152-
if (inl > LONG_MAX)
153-
return 0;
154-
155-
while (inl >= EVP_MAXCHUNK) {
156-
BF_ofb64_encrypt(in, out, (long)EVP_MAXCHUNK, &((EVP_BF_KEY *)ctx->cipher_data)->ks, ctx->iv, &ctx->num);
157-
inl -= EVP_MAXCHUNK;
158-
in += EVP_MAXCHUNK;
159-
out += EVP_MAXCHUNK;
145+
size_t chunk = LONG_MAX & ~0xff;
146+
147+
while (inl >= chunk) {
148+
BF_ofb64_encrypt(in, out, (long)chunk, &((EVP_BF_KEY *)ctx->cipher_data)->ks, ctx->iv, &ctx->num);
149+
inl -= chunk;
150+
in += chunk;
151+
out += chunk;
160152
}
161153

162154
if (inl)

‎src/lib/libcrypto/evp/e_cast.c

Lines changed: 16 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: e_cast.c,v 1.12 2022/09/10 17:39:47 jsing Exp $ */
1+
/* $OpenBSD: e_cast.c,v 1.13 2022/09/15 07:04:19 jsing Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -86,14 +86,13 @@ cast_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
8686
static int
8787
cast5_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, size_t inl)
8888
{
89-
if (inl > LONG_MAX)
90-
return 0;
91-
92-
while (inl >= EVP_MAXCHUNK) {
93-
CAST_cbc_encrypt(in, out, (long)EVP_MAXCHUNK, &((EVP_CAST_KEY *)ctx->cipher_data)->ks, ctx->iv, ctx->encrypt);
94-
inl -= EVP_MAXCHUNK;
95-
in += EVP_MAXCHUNK;
96-
out += EVP_MAXCHUNK;
89+
size_t chunk = LONG_MAX & ~0xff;
90+
91+
while (inl >= chunk) {
92+
CAST_cbc_encrypt(in, out, (long)chunk, &((EVP_CAST_KEY *)ctx->cipher_data)->ks, ctx->iv, ctx->encrypt);
93+
inl -= chunk;
94+
in += chunk;
95+
out += chunk;
9796
}
9897

9998
if (inl)
@@ -105,10 +104,7 @@ cast5_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *i
105104
static int
106105
cast5_cfb64_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, size_t inl)
107106
{
108-
size_t chunk = EVP_MAXCHUNK;
109-
110-
if (inl > LONG_MAX)
111-
return 0;
107+
size_t chunk = LONG_MAX & ~0xff;
112108

113109
if (inl < chunk)
114110
chunk = inl;
@@ -130,9 +126,6 @@ cast5_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *i
130126
{
131127
size_t i, bl;
132128

133-
if (inl > LONG_MAX)
134-
return 0;
135-
136129
bl = ctx->cipher->block_size;
137130

138131
if (inl < bl)
@@ -149,14 +142,13 @@ cast5_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *i
149142
static int
150143
cast5_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, size_t inl)
151144
{
152-
if (inl > LONG_MAX)
153-
return 0;
154-
155-
while (inl >= EVP_MAXCHUNK) {
156-
CAST_ofb64_encrypt(in, out, (long)EVP_MAXCHUNK, &((EVP_CAST_KEY *)ctx->cipher_data)->ks, ctx->iv, &ctx->num);
157-
inl -= EVP_MAXCHUNK;
158-
in += EVP_MAXCHUNK;
159-
out += EVP_MAXCHUNK;
145+
size_t chunk = LONG_MAX & ~0xff;
146+
147+
while (inl >= chunk) {
148+
CAST_ofb64_encrypt(in, out, (long)chunk, &((EVP_CAST_KEY *)ctx->cipher_data)->ks, ctx->iv, &ctx->num);
149+
inl -= chunk;
150+
in += chunk;
151+
out += chunk;
160152
}
161153

162154
if (inl)

‎src/lib/libcrypto/evp/e_des.c

Lines changed: 27 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: e_des.c,v 1.18 2022/09/04 15:45:25 jsing Exp $ */
1+
/* $OpenBSD: e_des.c,v 1.19 2022/09/15 07:04:19 jsing Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -99,9 +99,6 @@ des_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
9999
{
100100
size_t i, bl;
101101

102-
if (inl > LONG_MAX)
103-
return 0;
104-
105102
bl = ctx->cipher->block_size;
106103

107104
if (inl < bl)
@@ -120,15 +117,14 @@ static int
120117
des_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
121118
const unsigned char *in, size_t inl)
122119
{
123-
if (inl > LONG_MAX)
124-
return 0;
120+
size_t chunk = LONG_MAX & ~0xff;
125121

126-
while (inl >= EVP_MAXCHUNK) {
127-
DES_ofb64_encrypt(in, out, (long)EVP_MAXCHUNK, ctx->cipher_data,
122+
while (inl >= chunk) {
123+
DES_ofb64_encrypt(in, out, (long)chunk, ctx->cipher_data,
128124
(DES_cblock *)ctx->iv, &ctx->num);
129-
inl -= EVP_MAXCHUNK;
130-
in += EVP_MAXCHUNK;
131-
out += EVP_MAXCHUNK;
125+
inl -= chunk;
126+
in += chunk;
127+
out += chunk;
132128
}
133129
if (inl)
134130
DES_ofb64_encrypt(in, out, (long)inl, ctx->cipher_data,
@@ -140,15 +136,14 @@ static int
140136
des_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
141137
const unsigned char *in, size_t inl)
142138
{
143-
if (inl > LONG_MAX)
144-
return 0;
139+
size_t chunk = LONG_MAX & ~0xff;
145140

146-
while (inl >= EVP_MAXCHUNK) {
147-
DES_ncbc_encrypt(in, out, (long)EVP_MAXCHUNK, ctx->cipher_data,
141+
while (inl >= chunk) {
142+
DES_ncbc_encrypt(in, out, (long)chunk, ctx->cipher_data,
148143
(DES_cblock *)ctx->iv, ctx->encrypt);
149-
inl -= EVP_MAXCHUNK;
150-
in += EVP_MAXCHUNK;
151-
out += EVP_MAXCHUNK;
144+
inl -= chunk;
145+
in += chunk;
146+
out += chunk;
152147
}
153148
if (inl)
154149
DES_ncbc_encrypt(in, out, (long)inl, ctx->cipher_data,
@@ -160,15 +155,14 @@ static int
160155
des_cfb64_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
161156
const unsigned char *in, size_t inl)
162157
{
163-
if (inl > LONG_MAX)
164-
return 0;
158+
size_t chunk = LONG_MAX & ~0xff;
165159

166-
while (inl >= EVP_MAXCHUNK) {
167-
DES_cfb64_encrypt(in, out, (long)EVP_MAXCHUNK, ctx->cipher_data,
160+
while (inl >= chunk) {
161+
DES_cfb64_encrypt(in, out, (long)chunk, ctx->cipher_data,
168162
(DES_cblock *)ctx->iv, &ctx->num, ctx->encrypt);
169-
inl -= EVP_MAXCHUNK;
170-
in += EVP_MAXCHUNK;
171-
out += EVP_MAXCHUNK;
163+
inl -= chunk;
164+
in += chunk;
165+
out += chunk;
172166
}
173167
if (inl)
174168
DES_cfb64_encrypt(in, out, (long)inl, ctx->cipher_data,
@@ -182,11 +176,9 @@ static int
182176
des_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
183177
const unsigned char *in, size_t inl)
184178
{
185-
size_t n, chunk = EVP_MAXCHUNK/8;
186179
unsigned char c[1], d[1];
187-
188-
if (inl > LONG_MAX)
189-
return 0;
180+
size_t chunk = LONG_MAX / 8;
181+
size_t n;
190182

191183
if (inl < chunk)
192184
chunk = inl;
@@ -214,15 +206,14 @@ static int
214206
des_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
215207
const unsigned char *in, size_t inl)
216208
{
217-
if (inl > LONG_MAX)
218-
return 0;
209+
size_t chunk = LONG_MAX & ~0xff;
219210

220-
while (inl >= EVP_MAXCHUNK) {
221-
DES_cfb_encrypt(in, out, 8, (long)EVP_MAXCHUNK,
211+
while (inl >= chunk) {
212+
DES_cfb_encrypt(in, out, 8, (long)chunk,
222213
ctx->cipher_data, (DES_cblock *)ctx->iv, ctx->encrypt);
223-
inl -= EVP_MAXCHUNK;
224-
in += EVP_MAXCHUNK;
225-
out += EVP_MAXCHUNK;
214+
inl -= chunk;
215+
in += chunk;
216+
out += chunk;
226217
}
227218
if (inl)
228219
DES_cfb_encrypt(in, out, 8, (long)inl, ctx->cipher_data,

‎src/lib/libcrypto/evp/e_des3.c

Lines changed: 29 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: e_des3.c,v 1.24 2022/09/04 15:45:25 jsing Exp $ */
1+
/* $OpenBSD: e_des3.c,v 1.25 2022/09/15 07:04:19 jsing Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -130,9 +130,6 @@ des_ede_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
130130
{
131131
size_t i, bl;
132132

133-
if (inl > LONG_MAX)
134-
return 0;
135-
136133
bl = ctx->cipher->block_size;
137134

138135
if (inl < bl)
@@ -141,25 +138,25 @@ des_ede_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
141138
inl -= bl;
142139

143140
for (i = 0; i <= inl; i += bl)
144-
DES_ecb3_encrypt((const_DES_cblock *)(in + i), (DES_cblock *)(out + i),
145-
&data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3, ctx->encrypt);
141+
DES_ecb3_encrypt((const_DES_cblock *)(in + i), (DES_cblock *)(out + i),
142+
&data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3, ctx->encrypt);
143+
146144
return 1;
147145
}
148146

149147
static int
150148
des_ede_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
151149
const unsigned char *in, size_t inl)
152150
{
153-
if (inl > LONG_MAX)
154-
return 0;
151+
size_t chunk = LONG_MAX & ~0xff;
155152

156-
while (inl >= EVP_MAXCHUNK) {
157-
DES_ede3_ofb64_encrypt(in, out, (long)EVP_MAXCHUNK,
153+
while (inl >= chunk) {
154+
DES_ede3_ofb64_encrypt(in, out, (long)chunk,
158155
&data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3,
159156
(DES_cblock *)ctx->iv, &ctx->num);
160-
inl -= EVP_MAXCHUNK;
161-
in += EVP_MAXCHUNK;
162-
out += EVP_MAXCHUNK;
157+
inl -= chunk;
158+
in += chunk;
159+
out += chunk;
163160
}
164161
if (inl)
165162
DES_ede3_ofb64_encrypt(in, out, (long)inl,
@@ -173,16 +170,15 @@ static int
173170
des_ede_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
174171
const unsigned char *in, size_t inl)
175172
{
176-
if (inl > LONG_MAX)
177-
return 0;
173+
size_t chunk = LONG_MAX & ~0xff;
178174

179-
while (inl >= EVP_MAXCHUNK) {
180-
DES_ede3_cbc_encrypt(in, out, (long)EVP_MAXCHUNK,
175+
while (inl >= chunk) {
176+
DES_ede3_cbc_encrypt(in, out, (long)chunk,
181177
&data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3,
182178
(DES_cblock *)ctx->iv, ctx->encrypt);
183-
inl -= EVP_MAXCHUNK;
184-
in += EVP_MAXCHUNK;
185-
out += EVP_MAXCHUNK;
179+
inl -= chunk;
180+
in += chunk;
181+
out += chunk;
186182
}
187183
if (inl)
188184
DES_ede3_cbc_encrypt(in, out, (long)inl,
@@ -195,16 +191,15 @@ static int
195191
des_ede_cfb64_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
196192
const unsigned char *in, size_t inl)
197193
{
198-
if (inl > LONG_MAX)
199-
return 0;
194+
size_t chunk = LONG_MAX & ~0xff;
200195

201-
while (inl >= EVP_MAXCHUNK) {
202-
DES_ede3_cfb64_encrypt(in, out, (long)EVP_MAXCHUNK,
196+
while (inl >= chunk) {
197+
DES_ede3_cfb64_encrypt(in, out, (long)chunk,
203198
&data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3,
204199
(DES_cblock *)ctx->iv, &ctx->num, ctx->encrypt);
205-
inl -= EVP_MAXCHUNK;
206-
in += EVP_MAXCHUNK;
207-
out += EVP_MAXCHUNK;
200+
inl -= chunk;
201+
in += chunk;
202+
out += chunk;
208203
}
209204
if (inl)
210205
DES_ede3_cfb64_encrypt(in, out, (long)inl,
@@ -219,11 +214,8 @@ static int
219214
des_ede3_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
220215
const unsigned char *in, size_t inl)
221216
{
222-
size_t n;
223217
unsigned char c[1], d[1];
224-
225-
if (inl > LONG_MAX)
226-
return 0;
218+
size_t n;
227219

228220
if (!(ctx->flags & EVP_CIPH_FLAG_LENGTH_BITS))
229221
inl *= 8;
@@ -244,16 +236,15 @@ static int
244236
des_ede3_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
245237
const unsigned char *in, size_t inl)
246238
{
247-
if (inl > LONG_MAX)
248-
return 0;
239+
size_t chunk = LONG_MAX & ~0xff;
249240

250-
while (inl >= EVP_MAXCHUNK) {
251-
DES_ede3_cfb_encrypt(in, out, 8, (long)EVP_MAXCHUNK,
241+
while (inl >= chunk) {
242+
DES_ede3_cfb_encrypt(in, out, 8, (long)chunk,
252243
&data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3,
253244
(DES_cblock *)ctx->iv, ctx->encrypt);
254-
inl -= EVP_MAXCHUNK;
255-
in += EVP_MAXCHUNK;
256-
out += EVP_MAXCHUNK;
245+
inl -= chunk;
246+
in += chunk;
247+
out += chunk;
257248
}
258249
if (inl)
259250
DES_ede3_cfb_encrypt(in, out, 8, (long)inl,

0 commit comments

Comments
 (0)