mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 04:29:27 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
63 lines
2.0 KiB
C
63 lines
2.0 KiB
C
/* Provenance: openssl/openssl cms_kek_cipher (fixed).
|
|
* repo: openssl/openssl
|
|
* commit: a0c8ec557d9cac078f032d76cdf684fe743eb382
|
|
* parent: d307f61f1b341b6eb7d5d07bd6902a939c709bc6
|
|
* commit_url: https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382
|
|
* cve: CVE-2026-63072
|
|
* license: Apache-2.0
|
|
* function: cms_kek_cipher
|
|
* relpath: crypto/cms/cms_kari.c
|
|
*/
|
|
|
|
static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
|
|
const unsigned char *in, size_t inlen,
|
|
CMS_KeyAgreeRecipientInfo *kari, int enc)
|
|
{
|
|
/* Key encryption key */
|
|
unsigned char kek[EVP_MAX_KEY_LENGTH];
|
|
size_t keklen;
|
|
int rv = 0;
|
|
unsigned char *out = NULL;
|
|
size_t out_alloc_len = 0;
|
|
int outlen;
|
|
size_t outsize;
|
|
|
|
keklen = EVP_CIPHER_CTX_get_key_length(kari->ctx);
|
|
if (keklen > EVP_MAX_KEY_LENGTH)
|
|
return 0;
|
|
/* Derive KEK */
|
|
if (EVP_PKEY_derive(kari->pctx, kek, &keklen) <= 0)
|
|
goto err;
|
|
/* Set KEK in context */
|
|
if (!EVP_CipherInit_ex(kari->ctx, NULL, NULL, kek, NULL, enc))
|
|
goto err;
|
|
/* obtain output length of ciphered key */
|
|
if (!EVP_CipherUpdate(kari->ctx, NULL, &outlen, in, inlen))
|
|
goto err;
|
|
/*
|
|
* On its integrity-failure paths that primitive writes and cleanses up to
|
|
* inlen bytes of the output buffer. Size the buffer for that worst case so
|
|
* a failed unwrap cannot write past the allocation.
|
|
*/
|
|
outsize = (size_t)outlen < inlen ? inlen : (size_t)outlen;
|
|
out = OPENSSL_malloc(outsize);
|
|
if (out == NULL)
|
|
goto err;
|
|
out_alloc_len = (size_t)outlen;
|
|
if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, (int)inlen))
|
|
goto err;
|
|
*pout = out;
|
|
*poutlen = (size_t)outlen;
|
|
rv = 1;
|
|
|
|
err:
|
|
OPENSSL_cleanse(kek, keklen);
|
|
if (!rv)
|
|
OPENSSL_clear_free(out, out_alloc_len);
|
|
EVP_CIPHER_CTX_reset(kari->ctx);
|
|
/* FIXME: WHY IS kari->pctx freed here? /RL */
|
|
EVP_PKEY_CTX_free(kari->pctx);
|
|
kari->pctx = NULL;
|
|
return rv;
|
|
}
|