mirror of https://github.com/openssl/openssl
rands/drbg_hmac.c: Add checks for the EVP_MD_get_size()
Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t.
Fixes: 8bf3665196
("Added DRBG_HMAC & DRBG_HASH + Added defaults for setting DRBG for master/public/private + renamed generate_counter back to reseed_counter + generated new cavs data tests")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23945)
This commit is contained in:
parent
e97f468589
commit
81f2b0420a
|
@ -410,6 +410,7 @@ static int drbg_hmac_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]
|
|||
PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)ctx->data;
|
||||
OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
|
||||
const EVP_MD *md;
|
||||
int md_size;
|
||||
|
||||
if (!ossl_prov_digest_load_from_params(&hmac->digest, params, libctx))
|
||||
return 0;
|
||||
|
@ -424,7 +425,10 @@ static int drbg_hmac_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]
|
|||
|
||||
if (md != NULL && hmac->ctx != NULL) {
|
||||
/* These are taken from SP 800-90 10.1 Table 2 */
|
||||
hmac->blocklen = EVP_MD_get_size(md);
|
||||
md_size = EVP_MD_get_size(md);
|
||||
if (md_size <= 0)
|
||||
return 0;
|
||||
hmac->blocklen = (size_t)md_size;
|
||||
/* See SP800-57 Part1 Rev4 5.6.1 Table 3 */
|
||||
ctx->strength = 64 * (int)(hmac->blocklen >> 3);
|
||||
if (ctx->strength > 256)
|
||||
|
|
Loading…
Reference in New Issue