Fix isc_crypto_aead_open() for OpenSSL 1.1.x

The ciphertext length passed to the EVP_DecryptUpdate() function
included the tag length too. Use the 'len' variable instead which
doesn't include the tag length.

diff --git a/lib/isc/crypto/ossl1_1.c b/lib/isc/crypto/ossl1_1.c
index ac9d876d3fe7f6a13eaa58f9844488c73b51ae33..7456afc24556f1ed437462254112682a09cd6e33 100644 (file)
--- a/lib/isc/crypto/ossl1_1.c
+++ b/lib/isc/crypto/ossl1_1.c
@@ -642,8 +642,7 @@ isc_crypto_aead_open(isc_crypto_aead_t *aead, isc_constregion_t nonce,
        }
 
        len = out.length;
-       if (EVP_DecryptUpdate(aead, out.base, &len, ciphertext.base,
-                             ciphertext.length) != 1)
+       if (EVP_DecryptUpdate(aead, out.base, &len, ciphertext.base, len) != 1)
        {
                CLEANUP(ISC_R_CRYPTOFAILURE);
        }