1 files changed, 15 insertions, 3 deletions

diff --git a/src/lib/libcrypto/evp/evp_enc.c b/src/lib/libcrypto/evp/evp_enc.c
index f8d2cb78d4..c89f69c9a2 100644
--- a/src/lib/libcrypto/evp/evp_enc.c
+++ b/src/lib/libcrypto/evp/evp_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_enc.c,v 1.31 2016/05/30 13:42:54 beck Exp $ */
+/* $OpenBSD: evp_enc.c,v 1.32 2016/09/03 14:54:25 bcook Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -260,13 +260,19 @@ EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
                 return EVP_DecryptFinal_ex(ctx, out, outl);
 }
 
+__warn_references(EVP_CipherFinal,
+    "warning: EVP_CipherFinal is often misused, please use EVP_CipherFinal_ex and EVP_CIPHER_CTX_cleanup");
+
 int
 EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
 {
+        int ret;
         if (ctx->encrypt)
-                return EVP_EncryptFinal_ex(ctx, out, outl);
+                ret = EVP_EncryptFinal_ex(ctx, out, outl);
         else
-                return EVP_DecryptFinal_ex(ctx, out, outl);
+                ret = EVP_DecryptFinal_ex(ctx, out, outl);
+        (void) EVP_CIPHER_CTX_cleanup(ctx);
+        return ret;
 }
 
 int
@@ -365,6 +371,9 @@ EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
         return 1;
 }
 
+__warn_references(EVP_EncryptFinal,
+    "warning: EVP_EncryptFinal is often misused, please use EVP_EncryptFinal_ex and EVP_CIPHER_CTX_cleanup");
+
 int
 EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
 {
@@ -479,6 +488,9 @@ EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
         return 1;
 }
 
+__warn_references(EVP_DecryptFinal,
+    "warning: EVP_DecryptFinal is often misused, please use EVP_DecryptFinal_ex and EVP_CIPHER_CTX_cleanup");
+
 int
 EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
 {