[openssl/openssl] 9c823d: poly1305: prevent crash on final without a key
"'007bsd' via openssl-commits" <[email protected]>
| Newsgroups | gmane.comp.encryption.openssl.cvs |
|---|---|
| Message-ID | <openssl/openssl/push/refs/heads/openssl-3.0/[email protected]> |
Branch: refs/heads/openssl-3.0
Home: https://github.com/openssl/openssl
Commit: 9c823dad3f5c94ec57887540ee6d0f562601faf8
https://github.com/openssl/openssl/commit/9c823dad3f5c94ec57887540ee6d0f562601faf8
Author: 007bsd <[email protected]>
Date: 2026-06-01 (Mon, 01 Jun 2026)
Changed paths:
M providers/implementations/macs/poly1305_prov.c
M test/evp_extra_test.c
Log Message:
-----------
poly1305: prevent crash on final without a key
EVP_MAC_init with a NULL key followed by EVP_MAC_final on a
Poly1305 context crashed with a NULL function-pointer dispatch
because poly1305_init accepted the no-key case as success, and
poly1305_final had no guard before dispatching through the
uninitialised Poly1305 state.
Add a key_set field to struct poly1305_data_st (matching
OCB/CCM/GCM), set it in poly1305_setkey, and refuse init and
final if no key has been installed.
Added a regression test asserting EVP_MAC_init with a NULL key
returns 0.
##### Checklist
- [ ] documentation is added or updated
- [x] tests are added or updated
CLA: trivial
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
MergeDate: Mon Jun 1 07:35:20 2026
(Merged from https://github.com/openssl/openssl/pull/31298)
To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications
--
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.0/a0fc27-9c823d%40github.com.