Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing OpenSSL guards in common code #1862

Closed
SWilson4 opened this issue Jul 26, 2024 · 0 comments · Fixed by #1869
Closed

Missing OpenSSL guards in common code #1862

SWilson4 opened this issue Jul 26, 2024 · 0 comments · Fixed by #1869
Assignees

Comments

@SWilson4
Copy link
Member

SWilson4 commented Jul 26, 2024

Calls to the OpenSSL EVP API are not being error-checked in the SHA2 code. We should be using the OQS_OPENSSL_GUARD macro here.

static void do_hash(uint8_t *output, const uint8_t *input, size_t inplen, const EVP_MD *md) {
EVP_MD_CTX *mdctx;
unsigned int outlen;
mdctx = OSSL_FUNC(EVP_MD_CTX_new)();
OQS_EXIT_IF_NULLPTR(mdctx, "OpenSSL");
OSSL_FUNC(EVP_DigestInit_ex)(mdctx, md, NULL);
OSSL_FUNC(EVP_DigestUpdate)(mdctx, input, inplen);
OSSL_FUNC(EVP_DigestFinal_ex)(mdctx, output, &outlen);
OSSL_FUNC(EVP_MD_CTX_free)(mdctx);
}

We could also use the macro here instead of error-checking manually:

/* Create and initialise the context */
if (!(ctx = OSSL_FUNC(EVP_CIPHER_CTX_new)())) {
handleErrors();
}
if (1 != OSSL_FUNC(EVP_EncryptInit_ex)(ctx, oqs_aes_256_ecb(), NULL, key, NULL)) {
handleErrors();
}
if (1 != OSSL_FUNC(EVP_EncryptUpdate)(ctx, buffer, &len, ctr, 16)) {
handleErrors();
}

Reported by @trailofbits in Week 1 of their audit of liboqs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging a pull request may close this issue.

1 participant