Blame SOURCES/0011-Evp-cipher-buffers.patch

1f5cfb
diff --git a/print-esp.c b/print-esp.c
1f5cfb
index 511ee8a3..5b282526 100644
1f5cfb
--- a/print-esp.c
1f5cfb
+++ b/print-esp.c
1f5cfb
@@ -192,8 +192,8 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo,
1f5cfb
 	const u_char *iv;
1f5cfb
 	unsigned int len;
1f5cfb
 	EVP_CIPHER_CTX *ctx;
1f5cfb
-	unsigned int block_size, output_buffer_size;
1f5cfb
-	u_char *output_buffer;
1f5cfb
+	unsigned int block_size, buffer_size;
1f5cfb
+	u_char *input_buffer, *output_buffer;
1f5cfb
 
1f5cfb
 	/* initiator arg is any non-zero value */
1f5cfb
 	if(initiator) initiator=1;
1f5cfb
@@ -228,19 +228,41 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo,
1f5cfb
 		(*ndo->ndo_warning)(ndo, "espkey init failed");
1f5cfb
 	set_cipher_parameters(ctx, NULL, NULL, iv, 0);
1f5cfb
 	/*
1f5cfb
-	 * Allocate a buffer for the decrypted data.
1f5cfb
-	 * The output buffer must be separate from the input buffer, and
1f5cfb
-	 * its size must be a multiple of the cipher block size.
1f5cfb
+	 * Allocate buffers for the encrypted and decrypted data.
1f5cfb
+	 * Both buffers' sizes must be a multiple of the cipher block
1f5cfb
+	 * size, and the output buffer must be separate from the input
1f5cfb
+	 * buffer.
1f5cfb
 	 */
1f5cfb
 	block_size = (unsigned int)EVP_CIPHER_CTX_block_size(ctx);
1f5cfb
-	output_buffer_size = len + (block_size - len % block_size);
1f5cfb
-	output_buffer = (u_char *)malloc(output_buffer_size);
1f5cfb
+	buffer_size = len + (block_size - len % block_size);
1f5cfb
+
1f5cfb
+	/*
1f5cfb
+	 * Attempt to allocate the input buffer.
1f5cfb
+	 */
1f5cfb
+	input_buffer = (u_char *)malloc(buffer_size);
1f5cfb
+	if (input_buffer == NULL) {
1f5cfb
+		(*ndo->ndo_warning)(ndo, "can't allocate memory for encrypted data buffer");
1f5cfb
+		EVP_CIPHER_CTX_free(ctx);
1f5cfb
+		return 0;
1f5cfb
+	}
1f5cfb
+	/*
1f5cfb
+	 * Copy the input data to the encrypted data buffer, and pad it
1f5cfb
+	 * with zeroes.
1f5cfb
+	 */
1f5cfb
+	memcpy(input_buffer, buf, len);
1f5cfb
+	memset(input_buffer + len, 0, buffer_size - len);
1f5cfb
+
1f5cfb
+	/*
1f5cfb
+	 * Attempt to allocate the output buffer.
1f5cfb
+	 */
1f5cfb
+	output_buffer = (u_char *)malloc(buffer_size);
1f5cfb
 	if (output_buffer == NULL) {
1f5cfb
 		(*ndo->ndo_warning)(ndo, "can't allocate memory for decryption buffer");
1f5cfb
+		free(input_buffer);
1f5cfb
 		EVP_CIPHER_CTX_free(ctx);
1f5cfb
 		return 0;
1f5cfb
 	}
1f5cfb
-	EVP_Cipher(ctx, output_buffer, buf, len);
1f5cfb
+	EVP_Cipher(ctx, output_buffer, input_buffer, buffer_size);
1f5cfb
 	EVP_CIPHER_CTX_free(ctx);
1f5cfb
 
1f5cfb
 	/*
1f5cfb
@@ -249,6 +272,7 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo,
1f5cfb
 	 * but changing this would require a more complicated fix.
1f5cfb
 	 */
1f5cfb
 	memcpy(buf, output_buffer, len);
1f5cfb
+	free(input_buffer);
1f5cfb
 	free(output_buffer);
1f5cfb
 
1f5cfb
 	ndo->ndo_packetp = buf;
1f5cfb
@@ -666,8 +690,8 @@ esp_print(netdissect_options *ndo,
1f5cfb
 	const u_char *ivoff;
1f5cfb
 	const u_char *p;
1f5cfb
 	EVP_CIPHER_CTX *ctx;
1f5cfb
-	unsigned int block_size, output_buffer_size;
1f5cfb
-	u_char *output_buffer;
1f5cfb
+	unsigned int block_size, buffer_size;
1f5cfb
+	u_char *input_buffer, *output_buffer;
1f5cfb
 #endif
1f5cfb
 
1f5cfb
 	esp = (const struct newesp *)bp;
1f5cfb
@@ -784,21 +808,43 @@ esp_print(netdissect_options *ndo,
1f5cfb
 			len = ep - (p + ivlen);
1f5cfb
 
1f5cfb
 			/*
1f5cfb
-			 * Allocate a buffer for the decrypted data.
1f5cfb
-			 * The output buffer must be separate from the
1f5cfb
-			 * input buffer, and its size must be a multiple
1f5cfb
-			 * of the cipher block size.
1f5cfb
+			 * Allocate buffers for the encrypted and decrypted
1f5cfb
+			 * data.  Both buffers' sizes must be a multiple of
1f5cfb
+			 * the cipher block size, and the output buffer must
1f5cfb
+			 * be separate from the input buffer.
1f5cfb
 			 */
1f5cfb
 			block_size = (unsigned int)EVP_CIPHER_CTX_block_size(ctx);
1f5cfb
-			output_buffer_size = len + (block_size - len % block_size);
1f5cfb
-			output_buffer = (u_char *)malloc(output_buffer_size);
1f5cfb
+			buffer_size = len + (block_size - len % block_size);
1f5cfb
+
1f5cfb
+			/*
1f5cfb
+			 * Attempt to allocate the input buffer.
1f5cfb
+			 */
1f5cfb
+			input_buffer = (u_char *)malloc(buffer_size);
1f5cfb
+			if (input_buffer == NULL) {
1f5cfb
+				(*ndo->ndo_warning)(ndo, "can't allocate memory for encrypted data buffer");
1f5cfb
+				EVP_CIPHER_CTX_free(ctx);
1f5cfb
+				return 0;
1f5cfb
+			}
1f5cfb
+			/*
1f5cfb
+			 * Copy the input data to the encrypted data buffer,
1f5cfb
+			 * and pad it with zeroes.
1f5cfb
+			 */
1f5cfb
+			memcpy(input_buffer, p + ivlen, len);
1f5cfb
+			memset(input_buffer + len, 0, buffer_size - len);
1f5cfb
+
1f5cfb
+			/*
1f5cfb
+			 * Attempt to allocate the output buffer.
1f5cfb
+			 */
1f5cfb
+			output_buffer = (u_char *)malloc(buffer_size);
1f5cfb
 			if (output_buffer == NULL) {
1f5cfb
 				(*ndo->ndo_warning)(ndo, "can't allocate memory for decryption buffer");
1f5cfb
+				free(input_buffer);
1f5cfb
 				EVP_CIPHER_CTX_free(ctx);
1f5cfb
 				return -1;
1f5cfb
 			}
1f5cfb
 
1f5cfb
-			EVP_Cipher(ctx, output_buffer, p + ivlen, len);
1f5cfb
+			EVP_Cipher(ctx, output_buffer, input_buffer, len);
1f5cfb
+			free(input_buffer);
1f5cfb
 			EVP_CIPHER_CTX_free(ctx);
1f5cfb
 			/*
1f5cfb
 			 * XXX - of course this is wrong, because buf is a