The branch master has been updated via d6d94d339756332bbabe2a1032ac511ae31b3fdc (commit) via 4977b4e9281c981efcf6a8b31378b8bbd6a8a96f (commit) from e6a833cb97ed762408b57ea3efa83bd10c1d2a78 (commit)
- Log ----------------------------------------------------------------- commit d6d94d339756332bbabe2a1032ac511ae31b3fdc Author: Richard Levitte <levi...@openssl.org> Date: Wed Apr 25 22:53:40 2018 +0200 PEM_def_callback(): use same parameter names as for pem_password_cb Add a bit more commentary to explain what's going on. Reviewed-by: Matt Caswell <m...@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6080) commit 4977b4e9281c981efcf6a8b31378b8bbd6a8a96f Author: Richard Levitte <levi...@openssl.org> Date: Wed Apr 25 13:57:39 2018 +0200 PEM_def_callback(): don't loop because of too short password given That error is already caught by EVP_read_pw_string_min, and causes this function to return -1, so the code detecting too short passwords in this function is practically dead. Fixes #5465 Reviewed-by: Matt Caswell <m...@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6080) ----------------------------------------------------------------------- Summary of changes: crypto/pem/pem_lib.c | 45 ++++++++++++++++++++------------------------- include/openssl/pem.h | 3 ++- 2 files changed, 22 insertions(+), 26 deletions(-) diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index 6e66e9d..5000f26 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -28,15 +28,16 @@ static int load_iv(char **fromp, unsigned char *to, int num); static int check_pem(const char *nm, const char *name); int pem_check_suffix(const char *pem_str, const char *suffix); -int PEM_def_callback(char *buf, int num, int w, void *key) +int PEM_def_callback(char *buf, int num, int rwflag, void *userdata) { - int i, j; + int i, min_len; const char *prompt; - if (key) { - i = strlen(key); + /* We assume that the user passes a default password as userdata */ + if (userdata) { + i = strlen(userdata); i = (i > num) ? num : i; - memcpy(buf, key, i); + memcpy(buf, userdata, i); return i; } @@ -44,28 +45,22 @@ int PEM_def_callback(char *buf, int num, int w, void *key) if (prompt == NULL) prompt = "Enter PEM pass phrase:"; - for (;;) { - /* - * We assume that w == 0 means decryption, - * while w == 1 means encryption - */ - int min_len = w ? MIN_LENGTH : 0; + /* + * rwflag == 0 means decryption + * rwflag == 1 means encryption + * + * We assume that for encryption, we want a minimum length, while for + * decryption, we cannot know any minimum length, so we assume zero. + */ + min_len = rwflag ? MIN_LENGTH : 0; - i = EVP_read_pw_string_min(buf, min_len, num, prompt, w); - if (i != 0) { - PEMerr(PEM_F_PEM_DEF_CALLBACK, PEM_R_PROBLEMS_GETTING_PASSWORD); - memset(buf, 0, (unsigned int)num); - return -1; - } - j = strlen(buf); - if (min_len && j < min_len) { - fprintf(stderr, - "phrase is too short, needs to be at least %d chars\n", - min_len); - } else - break; + i = EVP_read_pw_string_min(buf, min_len, num, prompt, rwflag); + if (i != 0) { + PEMerr(PEM_F_PEM_DEF_CALLBACK, PEM_R_PROBLEMS_GETTING_PASSWORD); + memset(buf, 0, (unsigned int)num); + return -1; } - return j; + return strlen(buf); } void PEM_proc_type(char *buf, int type) diff --git a/include/openssl/pem.h b/include/openssl/pem.h index 165544c..2ef5b5d 100644 --- a/include/openssl/pem.h +++ b/include/openssl/pem.h @@ -280,7 +280,8 @@ int PEM_SignUpdate(EVP_MD_CTX *ctx, unsigned char *d, unsigned int cnt); int PEM_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, unsigned int *siglen, EVP_PKEY *pkey); -int PEM_def_callback(char *buf, int num, int w, void *key); +/* The default pem_password_cb that's used internally */ +int PEM_def_callback(char *buf, int num, int rwflag, void *userdata); void PEM_proc_type(char *buf, int type); void PEM_dek_info(char *buf, const char *type, int len, char *str); _____ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits