[openssl/openssl] 4d0cff: aes_wrap: prevent crash on update without a key

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: 4d0cffd118cd7afe91d18781500095e4949f9449
      https://github.com/openssl/openssl/commit/4d0cffd118cd7afe91d18781500095e4949f9449
  Author: 007bsd <[email protected]>
  Date:   2026-06-03 (Wed, 03 Jun 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_wrp.c
    M test/aeswrap_test.c

  Log Message:
  -----------
  aes_wrap: prevent crash on update without a key

EVP_CipherInit_ex2 with a NULL key followed by EVP_CipherUpdate
on AES-WRAP/WRAP-PAD/WRAP-INV ciphers dereferenced an uninitialised
function pointer because aes_wrap_init installs ctx->block only
when a key is supplied. aes_wrap_cipher_internal had no guard
before dispatching.

Track key state in ctx->key_set, matching OCB/CCM/GCM/Poly1305,
and refuse update if no key has been installed.

Added a regression test covering AES-256-WRAP, AES-256-WRAP-PAD
and AES-256-WRAP-INV.

CLA: trivial

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jun  3 11:56:51 2026
(Merged from https://github.com/openssl/openssl/pull/31292)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/ad4136-4d0cff%40github.com.