[openssl/openssl] d099e3: aes_wrap: prevent crash on update without a key

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: d099e33e5733bb9d3975fc4f3ac4a85b6ed1a4cb
      https://github.com/openssl/openssl/commit/d099e33e5733bb9d3975fc4f3ac4a85b6ed1a4cb
  Author: 007bsd <[email protected]>
  Date:   2026-06-03 (Wed, 03 Jun 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_wrp.c
    M test/aeswrap_test.c

  Log Message:
  -----------
  aes_wrap: prevent crash on update without a key

EVP_CipherInit_ex2 with a NULL key followed by EVP_CipherUpdate
on AES-WRAP/WRAP-PAD/WRAP-INV ciphers dereferenced an uninitialised
function pointer because aes_wrap_init installs ctx->block only
when a key is supplied. aes_wrap_cipher_internal had no guard
before dispatching.

Track key state in ctx->key_set, matching OCB/CCM/GCM/Poly1305,
and refuse update if no key has been installed.

Added a regression test covering AES-256-WRAP, AES-256-WRAP-PAD
and AES-256-WRAP-INV.

CLA: trivial

Fixes: ca392b294359 "Add aes_wrap cipher to providers"

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jun  3 11:52:05 2026
(Merged from https://github.com/openssl/openssl/pull/31292)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/14d4de-d099e3%40github.com.