mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 20:49:28 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
86 lines
2.5 KiB
C
86 lines
2.5 KiB
C
/* Provenance: openssl/openssl rsa_cms_decrypt (vuln).
|
|
* repo: openssl/openssl
|
|
* commit: 6e74b1275cbc1fd1cf7ba32f662602d68501f6ca
|
|
* parent: 6e74b1275cbc1fd1cf7ba32f662602d68501f6ca
|
|
* commit_url: https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4
|
|
* cve: CVE-2026-28389
|
|
* license: Apache-2.0
|
|
* function: rsa_cms_decrypt
|
|
* relpath: crypto/cms/cms_rsa.c
|
|
*/
|
|
|
|
static int rsa_cms_decrypt(CMS_RecipientInfo *ri)
|
|
{
|
|
EVP_PKEY_CTX *pkctx;
|
|
X509_ALGOR *cmsalg;
|
|
int nid;
|
|
int rv = -1;
|
|
unsigned char *label = NULL;
|
|
int labellen = 0;
|
|
const EVP_MD *mgf1md = NULL, *md = NULL;
|
|
RSA_OAEP_PARAMS *oaep;
|
|
|
|
pkctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
|
|
if (pkctx == NULL)
|
|
return 0;
|
|
if (!CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &cmsalg))
|
|
return -1;
|
|
nid = OBJ_obj2nid(cmsalg->algorithm);
|
|
if (nid == NID_rsaEncryption)
|
|
return 1;
|
|
if (nid != NID_rsaesOaep) {
|
|
ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_ENCRYPTION_TYPE);
|
|
return -1;
|
|
}
|
|
/* Decode OAEP parameters */
|
|
oaep = rsa_oaep_decode(cmsalg);
|
|
|
|
if (oaep == NULL) {
|
|
ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_OAEP_PARAMETERS);
|
|
goto err;
|
|
}
|
|
|
|
mgf1md = ossl_x509_algor_get_md(oaep->maskHash);
|
|
if (mgf1md == NULL)
|
|
goto err;
|
|
md = ossl_x509_algor_get_md(oaep->hashFunc);
|
|
if (md == NULL)
|
|
goto err;
|
|
|
|
if (oaep->pSourceFunc != NULL) {
|
|
X509_ALGOR *plab = oaep->pSourceFunc;
|
|
|
|
if (OBJ_obj2nid(plab->algorithm) != NID_pSpecified) {
|
|
ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_LABEL_SOURCE);
|
|
goto err;
|
|
}
|
|
if (plab->parameter->type != V_ASN1_OCTET_STRING) {
|
|
ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_LABEL);
|
|
goto err;
|
|
}
|
|
|
|
label = plab->parameter->value.octet_string->data;
|
|
/* Stop label being freed when OAEP parameters are freed */
|
|
plab->parameter->value.octet_string->data = NULL;
|
|
labellen = plab->parameter->value.octet_string->length;
|
|
}
|
|
|
|
if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_OAEP_PADDING) <= 0)
|
|
goto err;
|
|
if (EVP_PKEY_CTX_set_rsa_oaep_md(pkctx, md) <= 0)
|
|
goto err;
|
|
if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkctx, mgf1md) <= 0)
|
|
goto err;
|
|
if (label != NULL
|
|
&& EVP_PKEY_CTX_set0_rsa_oaep_label(pkctx, label, labellen) <= 0) {
|
|
OPENSSL_free(label);
|
|
goto err;
|
|
}
|
|
/* Carry on */
|
|
rv = 1;
|
|
|
|
err:
|
|
RSA_OAEP_PARAMS_free(oaep);
|
|
return rv;
|
|
}
|