openbsd/src/lib/libcrypto/cms, branch masterA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=master2026-08-27T07:13:34+00:00libcrypto: harden cms_kek_cipher() a bit2026-08-27T07:13:34+00:00tb2026-08-27T07:13:34+00:00urn:sha1:448d7a6a510aab5c772d736a43fb5dcec9dfbd73
When AES key unwrap with padding is in use, the EVP interface breaks its
contract and writes more than the outlen it initially reports to the output
buffer. This is an old, sneaky trap that the muppet set eons ago and many
victims walked right into it, including the muppet himself.
If inlen is larger than outlen, allocate inlen bytes to unwrap with padding
to avoid a buffer overwrite. This is a variant of OpenSSL's fix. Since we
do not support AES keywrap with padding no actual bufer overwrite occurs
here at the moment, but if we ever chose to do so (unlikely) this trap
would be avoided. There's plenty more traps that the next round of scas
will surely find in this absolute trashfire of CMS support code.
ok kenjiro
Avoid out-of-bounds read in CMS password-based decryption2026-06-09T12:20:34+00:00tb2026-06-09T12:20:34+00:00urn:sha1:256315fc6aeff5ec985bfee63fae84e6cafc4555
The RFC 3211 PWRI integrity check when unwrapping the password-derived key
accesses seven bytes from a heap-allocated buffer. If an (invalid) block
cipher with short blocks is in use 2 * blocksize may not be sufficient room
for 7 bytes. In that silly case, the function performs an OOB read. Add
length check to avoid this situation
From Igor Ustinov via OpenSSL.
Avoid NULL dereference in password-based CMS decryption2026-06-09T12:12:34+00:00tb2026-06-09T12:12:34+00:00urn:sha1:77ad4436cc0876666030d6cc1ca6e7be853ef788
The keyDerivationAlgorithm field is OPTIONAL in the ASN.1 but required
for password-based CMS. Check that the field is present before using it
to avoid a crash.
From Igor Ustinov via OpenSSL
cms_local.h: remove #ifdef X509V3_HEADER_H2026-04-06T08:18:19+00:00tb2026-04-06T08:18:19+00:00urn:sha1:cbb1e8b1b47d23d60d1672f412e831bd3bca7ce4
All thirteen files including cms_local.h do that after including cms.h,
which already includes x509v3.h, so this is always defined. While here
make the cms_local.h a bit more selfstanding by including asn1.h and
x509v3.h
ok bcook jsing (who had the same diff) kenjiro
Clean up confusing logic in CMS_EncryptedData_encrypt()2025-11-28T06:07:09+00:00tb2025-11-28T06:07:09+00:00urn:sha1:25e047ad935a9d585bc84fe9aae3de40dbad3e72
This makes it easier to read and more in line with other code in
libcrypto. Also add a missing error check for the CMS_set_detached()
call.
ok jsing kenjiro
Plug memeory leak in CMS_EncryptedData_encrypt()2025-11-03T14:29:50+00:00tb2025-11-03T14:29:50+00:00urn:sha1:d787c292196f9476b2c3d608a900d8b1f334c13a
If CMS_EncryptedData_set1_key() fails, cms is leaked.
From Niels Dossche
cms: fix incorrect length check in kek_unwrap_key()2025-09-30T12:51:16+00:00tb2025-09-30T12:51:16+00:00urn:sha1:0da76a9548849eb542ab090dc5eace7a2be789cb
An incorrect length check can result in a 4-byte overwrite and an
8-byte overread.
From Stanislav Fort and Viktor Dukhovni via OpenSSL.
CVE-2025-9230.
ok jsing
cms_RecipientInfo_pwri_crypt: fix incorrect return check2025-09-30T12:49:34+00:00tb2025-09-30T12:49:34+00:00urn:sha1:4867be3b7736b15337f62460c0a92c9f3f6f5005
ok jsing
cms_RecipientInfo_pwri_crypt: plug leak of kekalg2025-09-30T12:46:55+00:00tb2025-09-30T12:46:55+00:00urn:sha1:9c492217dca486db9aacff39780c63445db043a4
ok jsing
Rework PKCS7_simple_smimecap()2025-07-31T02:24:21+00:00tb2025-07-31T02:24:21+00:00urn:sha1:939b14b31a0ec57a91982f54dd055e000bf5f6ac
This is nearly identical to CMS_add_simple_smimecap(). We can reuse
its doc comment mutatis mutandis and use the same construction.
Maybe this wants deduplicating. Maybe not.
ok kenjiro