[openssl/openssl] 96f5d5: poly1305: reject no-key update and NULL key params

  Branch: refs/heads/openssl-3.4
  Home:   https://github.com/openssl/openssl
  Commit: 96f5d52a0c829691af9c4d8ce719e88ebe3a8645
      https://github.com/openssl/openssl/commit/96f5d52a0c829691af9c4d8ce719e88ebe3a8645
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-13 (Mon, 13 Jul 2026)

  Changed paths:
    M providers/implementations/macs/poly1305_prov.c
    M test/evp_extra_test.c

  Log Message:
  -----------
  poly1305: reject no-key update and NULL key params

Poly1305 permits EVP_MAC_init(ctx, NULL, 0, ...) as part of staged
initialization. If no key has been installed, update still dispatched
into the uninitialized Poly1305 state, which can crash on POLY1305_ASM
builds.

Guard update with the same key_set check used by final and report no key set.

Also reject an explicit OSSL_MAC_PARAM_KEY whose data pointer is NULL before
calling Poly1305_Init(), even when the supplied size is POLY1305_KEY_SIZE.

Fixes #31332

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Jul 13 15:44:48 2026
(Merged from https://github.com/openssl/openssl/pull/31382)

(cherry picked from commit 95f95b59dded1ad376458152e4c8533018ee2f43)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/66f1af-96f5d5%40github.com.