From: Aram Sargsyan <aram@isc.org>
Date: Wed, 15 Jul 2026 13:19:17 +0000 (+0000)
Subject: Fix isc_crypto_aead_open() for OpenSSL 1.1.x
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c69384f5a41fbd094a5eaf22843c19806424aca7;p=thirdparty%2Fbind9.git

Fix isc_crypto_aead_open() for OpenSSL 1.1.x

The ciphertext length passed to the EVP_DecryptUpdate() function
included the tag length too. Use the 'len' variable instead which
doesn't include the tag length.
---

diff --git a/lib/isc/crypto/ossl1_1.c b/lib/isc/crypto/ossl1_1.c
index ac9d876d3fe..7456afc2455 100644
--- a/lib/isc/crypto/ossl1_1.c
+++ b/lib/isc/crypto/ossl1_1.c
@@ -642,8 +642,7 @@ isc_crypto_aead_open(isc_crypto_aead_t *aead, isc_constregion_t nonce,
 	}
 
 	len = out.length;
-	if (EVP_DecryptUpdate(aead, out.base, &len, ciphertext.base,
-			      ciphertext.length) != 1)
+	if (EVP_DecryptUpdate(aead, out.base, &len, ciphertext.base, len) != 1)
 	{
 		CLEANUP(ISC_R_CRYPTOFAILURE);
 	}