Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit d7ecba9

Browse files
committed
pgcrypto: Detect errors with EVP calls from OpenSSL
The following routines are called within pgcrypto when handling digests but there were no checks for failures: - EVP_MD_CTX_size (can fail with -1 as of 3.0.0) - EVP_MD_CTX_block_size (can fail with -1 as of 3.0.0) - EVP_DigestInit_ex - EVP_DigestUpdate - EVP_DigestFinal_ex A set of elog(ERROR) is added by this commit to detect such failures, that should never happen except in the event of a processing failure internal to OpenSSL. Note that it would be possible to use ERR_reason_error_string() to get more context about such errors, but these refer mainly to the internals of OpenSSL, so it is not really obvious how useful that would be. This is left out for simplicity. Per report from Coverity. Thanks to Tom Lane for the discussion. Backpatch-through: 9.5
1 parent 27b57f8 commit d7ecba9

File tree

1 file changed

+16
-5
lines changed

1 file changed

+16
-5
lines changed

contrib/pgcrypto/openssl.c

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -115,40 +115,51 @@ static unsigned
115115
digest_result_size(PX_MD *h)
116116
{
117117
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
118+
int result = EVP_MD_CTX_size(digest->ctx);
118119

119-
return EVP_MD_CTX_size(digest->ctx);
120+
if (result < 0)
121+
elog(ERROR, "EVP_MD_CTX_size() failed");
122+
123+
return result;
120124
}
121125

122126
static unsigned
123127
digest_block_size(PX_MD *h)
124128
{
125129
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
130+
int result = EVP_MD_CTX_block_size(digest->ctx);
131+
132+
if (result < 0)
133+
elog(ERROR, "EVP_MD_CTX_block_size() failed");
126134

127-
return EVP_MD_CTX_block_size(digest->ctx);
135+
return result;
128136
}
129137

130138
static void
131139
digest_reset(PX_MD *h)
132140
{
133141
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
134142

135-
EVP_DigestInit_ex(digest->ctx, digest->algo, NULL);
143+
if (!EVP_DigestInit_ex(digest->ctx, digest->algo, NULL))
144+
elog(ERROR, "EVP_DigestInit_ex() failed");
136145
}
137146

138147
static void
139148
digest_update(PX_MD *h, const uint8 *data, unsigned dlen)
140149
{
141150
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
142151

143-
EVP_DigestUpdate(digest->ctx, data, dlen);
152+
if (!EVP_DigestUpdate(digest->ctx, data, dlen))
153+
elog(ERROR, "EVP_DigestUpdate() failed");
144154
}
145155

146156
static void
147157
digest_finish(PX_MD *h, uint8 *dst)
148158
{
149159
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
150160

151-
EVP_DigestFinal_ex(digest->ctx, dst, NULL);
161+
if (!EVP_DigestFinal_ex(digest->ctx, dst, NULL))
162+
elog(ERROR, "EVP_DigestFinal_ex() failed");
152163
}
153164

154165
static void

0 commit comments

Comments
 (0)