1 files changed, 32 insertions, 12 deletions

diff --git a/src/lib/libcrypto/aes/aes_cbc.c b/src/lib/libcrypto/aes/aes_cbc.c
index 1222a21002..d2ba6bcdb4 100644
--- a/src/lib/libcrypto/aes/aes_cbc.c
+++ b/src/lib/libcrypto/aes/aes_cbc.c
@@ -66,6 +66,7 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
         unsigned long n;
         unsigned long len = length;
         unsigned char tmp[AES_BLOCK_SIZE];
+        const unsigned char *iv = ivec;
 
         assert(in && out && key && ivec);
         assert((AES_ENCRYPT == enc)||(AES_DECRYPT == enc));
@@ -73,22 +74,39 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
         if (AES_ENCRYPT == enc) {
                 while (len >= AES_BLOCK_SIZE) {
                         for(n=0; n < AES_BLOCK_SIZE; ++n)
-                                tmp[n] = in[n] ^ ivec[n];
-                        AES_encrypt(tmp, out, key);
-                        memcpy(ivec, out, AES_BLOCK_SIZE);
+                                out[n] = in[n] ^ iv[n];
+                        AES_encrypt(out, out, key);
+                        iv = out;
                         len -= AES_BLOCK_SIZE;
                         in += AES_BLOCK_SIZE;
                         out += AES_BLOCK_SIZE;
                 }
                 if (len) {
                         for(n=0; n < len; ++n)
-                                tmp[n] = in[n] ^ ivec[n];
+                                out[n] = in[n] ^ iv[n];
                         for(n=len; n < AES_BLOCK_SIZE; ++n)
-                                tmp[n] = ivec[n];
-                        AES_encrypt(tmp, tmp, key);
-                        memcpy(out, tmp, AES_BLOCK_SIZE);
-                        memcpy(ivec, tmp, AES_BLOCK_SIZE);
-                }                       
+                                out[n] = iv[n];
+                        AES_encrypt(out, out, key);
+                        iv = out;
+                }
+                memcpy(ivec,iv,AES_BLOCK_SIZE);
+        } else if (in != out) {
+                while (len >= AES_BLOCK_SIZE) {
+                        AES_decrypt(in, out, key);
+                        for(n=0; n < AES_BLOCK_SIZE; ++n)
+                                out[n] ^= iv[n];
+                        iv = in;
+                        len -= AES_BLOCK_SIZE;
+                        in  += AES_BLOCK_SIZE;
+                        out += AES_BLOCK_SIZE;
+                }
+                if (len) {
+                        AES_decrypt(in,tmp,key);
+                        for(n=0; n < len; ++n)
+                                out[n] = tmp[n] ^ iv[n];
+                        iv = in;
+                }
+                memcpy(ivec,iv,AES_BLOCK_SIZE);
         } else {
                 while (len >= AES_BLOCK_SIZE) {
                         memcpy(tmp, in, AES_BLOCK_SIZE);
@@ -102,10 +120,12 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
                 }
                 if (len) {
                         memcpy(tmp, in, AES_BLOCK_SIZE);
-                        AES_decrypt(tmp, tmp, key);
+                        AES_decrypt(tmp, out, key);
                         for(n=0; n < len; ++n)
-                                out[n] = tmp[n] ^ ivec[n];
+                                out[n] ^= ivec[n];
+                        for(n=len; n < AES_BLOCK_SIZE; ++n)
+                                out[n] = tmp[n];
                         memcpy(ivec, tmp, AES_BLOCK_SIZE);
-                }                       
+                }
         }
 }