diff options
| -rw-r--r-- | ChangeLog | 10 | ||||
| -rw-r--r-- | ext/openssl/ossl_cipher.c | 14 | ||||
| -rw-r--r-- | test/openssl/test_cipher.rb | 12 |
3 files changed, 31 insertions, 5 deletions
@@ -1,3 +1,13 @@ +Tue May 24 22:04:15 2016 Kazuki Yamaguchi <k@rhe.jp> + + * ext/openssl/ossl_cipher.c (ossl_cipher_set_key, ossl_cipher_set_iv): + Reject too long values as well as too short ones. Currently they + just truncate the input but this would hide bugs and lead to + unexpected encryption/decryption results. + + * test/openssl/test_cipher.rb: Test that Cipher#key= and #iv= reject + Strings with invalid length. + Tue May 24 21:32:21 2016 Kazuki Yamaguchi <k@rhe.jp> * ext/openssl/ossl_x509ext.c (ossl_x509ext_set_value): Use diff --git a/ext/openssl/ossl_cipher.c b/ext/openssl/ossl_cipher.c index 9aab802508..43a8effa64 100644 --- a/ext/openssl/ossl_cipher.c +++ b/ext/openssl/ossl_cipher.c @@ -480,15 +480,17 @@ static VALUE ossl_cipher_set_key(VALUE self, VALUE key) { EVP_CIPHER_CTX *ctx; + int key_len; StringValue(key); GetCipher(self, ctx); - if (RSTRING_LEN(key) < EVP_CIPHER_CTX_key_length(ctx)) - ossl_raise(eCipherError, "key length too short"); + key_len = EVP_CIPHER_CTX_key_length(ctx); + if (RSTRING_LEN(key) != key_len) + ossl_raise(rb_eArgError, "key must be %d bytes", key_len); if (EVP_CipherInit_ex(ctx, NULL, NULL, (unsigned char *)RSTRING_PTR(key), NULL, -1) != 1) - ossl_raise(eCipherError, NULL); + ossl_raise(eCipherError, NULL); return key; } @@ -512,12 +514,14 @@ static VALUE ossl_cipher_set_iv(VALUE self, VALUE iv) { EVP_CIPHER_CTX *ctx; + int iv_len; StringValue(iv); GetCipher(self, ctx); - if (RSTRING_LEN(iv) < EVP_CIPHER_CTX_iv_length(ctx)) - ossl_raise(eCipherError, "iv length too short"); + iv_len = EVP_CIPHER_CTX_iv_length(ctx); + if (RSTRING_LEN(iv) != iv_len) + ossl_raise(rb_eArgError, "iv must be %d bytes", iv_len); if (EVP_CipherInit_ex(ctx, NULL, NULL, NULL, (unsigned char *)RSTRING_PTR(iv), -1) != 1) ossl_raise(eCipherError, NULL); diff --git a/test/openssl/test_cipher.rb b/test/openssl/test_cipher.rb index dab64aa5a1..aec33fdd1a 100644 --- a/test/openssl/test_cipher.rb +++ b/test/openssl/test_cipher.rb @@ -80,6 +80,18 @@ class OpenSSL::TestCipher < OpenSSL::TestCase assert_equal(s1, s2, "encrypt reset") end + def test_key_iv_set + # default value for DES-EDE3-CBC + assert_equal(24, @c1.key_len) + assert_equal(8, @c1.iv_len) + assert_raise(ArgumentError) { @c1.key = "\x01" * 23 } + @c1.key = "\x01" * 24 + assert_raise(ArgumentError) { @c1.key = "\x01" * 25 } + assert_raise(ArgumentError) { @c1.iv = "\x01" * 7 } + @c1.iv = "\x01" * 8 + assert_raise(ArgumentError) { @c1.iv = "\x01" * 9 } + end + def test_empty_data @c1.encrypt assert_raise(ArgumentError){ @c1.update("") } |