[openssl/openssl] a4ee69: Reject AES-XTS operations without an IV

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: a4ee6965a09273425af35cabfefa08862c388fc3
      https://github.com/openssl/openssl/commit/a4ee6965a09273425af35cabfefa08862c388fc3
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-08 (Wed, 08 Jul 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_xts.c
    M test/evp_extra_test.c

  Log Message:
  -----------
  Reject AES-XTS operations without an IV

Commit 774525b38bd4 moved AES-XTS to an implementation-specific cipher
function but did not carry over the generic iv_set guard. This allowed
AES-XTS operations initialized with a NULL IV to proceed.

Restore the missing iv_set check before processing input and add an
evp_extra_test regression covering both a valid-IV control and the
missing-IV failure case.

Fixes #31755

Reviewed-by: Simo Sorce <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
MergeDate: Wed Jul  8 18:16:55 2026
(Merged from https://github.com/openssl/openssl/pull/31756)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/a17cd7-a4ee69%40github.com.