openbsd/src/lib/libcrypto/evp/evp_key.c, branch OPENBSD_6_8_BASE

Add a comment that explains what the check is doing and why len >= 1.

2018-08-14T17:59:26+00:00

Prompted by a remark by jsing

The UI_add_{input,verify}_string() functions want a length not including

2018-08-14T17:51:36+00:00

the terminating NUL. EVP_read_pw_string_min() got this wrong, leading to a one-byte buffer overrun in all callers of EVP_read_pw_string(). Found by mestre running 'openssl passwd' with MALLOC_OPTIONS including C. Fix this by doing some basic sanity checking in EVP_read_pw_string_min(). Cap the len argument at BUFSIZ and ensure that min < len as well as 0 <= min and 1 <= len. The last two checks are important as these numbers may end up in reallocarray(). ok bcook (on previous version), jsing, mestre

Send the function codes from the error functions to the bit bucket,

2017-01-29T17:49:23+00:00

as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@

Correct spelling of OPENSSL_cleanse.

2015-09-10T15:56:26+00:00

ok miod@

EVP_BytesToKey(): return through the error path (which cleans things up)

2015-02-10T09:55:39+00:00

if EVP_DigestInit_ex() fails.

Replace assert() and OPENSSL_assert() calls with proper error return paths.

2015-02-10T09:52:35+00:00

Careful review, feedback & ok doug@ jsing@

Correct error checks in EVP_read_pw_string_min(): UI_add_input_string()

2014-08-06T04:28:21+00:00

and UI_add_verify_string() return -1 (and maybe -2?) on failure and >=0 on success, instead of always zero on success problem reported by Mark Patruck (mark (at) wrapped.cx) ok miod@

Check the return value of the UI functions (including UI_new() which return

2014-07-23T04:44:56+00:00

value is happily dereferenced without checking it for being non-NULL). ok beck@

Only import cryptlib.h in the four source files that actually need it.

2014-07-11T08:44:49+00:00

Remove the openssl public includes from cryptlib.h and add a small number of includes into the source files that actually need them. While here, also sort/group/tidy the includes. ok beck@ miod@

Kill a blatantly outdated (and now wrong) comment

2014-07-10T19:30:06+00:00