Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit dfd8bf2

Browse files
committed
pgcrypto: Detect errors with EVP calls from OpenSSL
The following routines are called within pgcrypto when handling digests but there were no checks for failures: - EVP_MD_CTX_size (can fail with -1 as of 3.0.0) - EVP_MD_CTX_block_size (can fail with -1 as of 3.0.0) - EVP_DigestInit_ex - EVP_DigestUpdate - EVP_DigestFinal_ex A set of elog(ERROR) is added by this commit to detect such failures, that should never happen except in the event of a processing failure internal to OpenSSL. Note that it would be possible to use ERR_reason_error_string() to get more context about such errors, but these refer mainly to the internals of OpenSSL, so it is not really obvious how useful that would be. This is left out for simplicity. Per report from Coverity. Thanks to Tom Lane for the discussion. Backpatch-through: 9.5
1 parent 01c6370 commit dfd8bf2

File tree

1 file changed

+16
-5
lines changed

1 file changed

+16
-5
lines changed

contrib/pgcrypto/openssl.c

+16-5
Original file line numberDiff line numberDiff line change
@@ -114,40 +114,51 @@ static unsigned
114114
digest_result_size(PX_MD *h)
115115
{
116116
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
117+
int result = EVP_MD_CTX_size(digest->ctx);
117118

118-
return EVP_MD_CTX_size(digest->ctx);
119+
if (result < 0)
120+
elog(ERROR, "EVP_MD_CTX_size() failed");
121+
122+
return result;
119123
}
120124

121125
static unsigned
122126
digest_block_size(PX_MD *h)
123127
{
124128
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
129+
int result = EVP_MD_CTX_block_size(digest->ctx);
130+
131+
if (result < 0)
132+
elog(ERROR, "EVP_MD_CTX_block_size() failed");
125133

126-
return EVP_MD_CTX_block_size(digest->ctx);
134+
return result;
127135
}
128136

129137
static void
130138
digest_reset(PX_MD *h)
131139
{
132140
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
133141

134-
EVP_DigestInit_ex(digest->ctx, digest->algo, NULL);
142+
if (!EVP_DigestInit_ex(digest->ctx, digest->algo, NULL))
143+
elog(ERROR, "EVP_DigestInit_ex() failed");
135144
}
136145

137146
static void
138147
digest_update(PX_MD *h, const uint8 *data, unsigned dlen)
139148
{
140149
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
141150

142-
EVP_DigestUpdate(digest->ctx, data, dlen);
151+
if (!EVP_DigestUpdate(digest->ctx, data, dlen))
152+
elog(ERROR, "EVP_DigestUpdate() failed");
143153
}
144154

145155
static void
146156
digest_finish(PX_MD *h, uint8 *dst)
147157
{
148158
OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
149159

150-
EVP_DigestFinal_ex(digest->ctx, dst, NULL);
160+
if (!EVP_DigestFinal_ex(digest->ctx, dst, NULL))
161+
elog(ERROR, "EVP_DigestFinal_ex() failed");
151162
}
152163

153164
static void

0 commit comments

Comments
 (0)