diff options
| author | tb <> | 2020-06-05 18:44:42 +0000 |
|---|---|---|
| committer | tb <> | 2020-06-05 18:44:42 +0000 |
| commit | f599916be5b15add90651fc8802c4f96fc257310 (patch) | |
| tree | 61efb953452a8c0ac39e8e78cdaefd14329c433c /src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py | |
| parent | 95fc51a1214a75a79263e9b85906e144612c01f1 (diff) | |
| download | openbsd-f599916be5b15add90651fc8802c4f96fc257310.tar.gz openbsd-f599916be5b15add90651fc8802c4f96fc257310.tar.bz2 openbsd-f599916be5b15add90651fc8802c4f96fc257310.zip | |
Add a custom copy handler for AES key wrap
This is necessary because ctx->cipher_data is an EVP_AES_WRAP_CTX
containing a pointer to ctx->iv. EVP_CIPHER_CTX_copy() uses memcpy
to copy cipher_data to the target struct. The result is that the
copy contains a pointer to the wrong struct, which then leads to a
use-after-free. The custom copy handler fixes things up to avoid
that.
Issue reported by Guido Vranken
ok beck inoguchi jsing
Diffstat (limited to 'src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py')
0 files changed, 0 insertions, 0 deletions