From: Aram Sargsyan <aram@isc.org>
Date: Wed, 15 Jul 2026 13:14:42 +0000 (+0000)
Subject: Check AEAD additional data existence before use
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=80280620251c683974c01ede57e70b488db4cd19;p=thirdparty%2Fbind9.git

Check AEAD additional data existence before use

The isc_crypto_aead_open() and isc_crypto_aead_seal() functions
in ossl3.c didn't check if 'additional_data' exists before using
it. The checks were in place in the ossl1_1.c implementation. Use
the same conditions in the ossl3.c implementation too.
---

diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c
index 3473502badc..716786260d7 100644
--- a/lib/isc/crypto/ossl3.c
+++ b/lib/isc/crypto/ossl3.c
@@ -533,10 +533,13 @@ isc_crypto_aead_seal(isc_crypto_aead_t *aead, isc_constregion_t nonce,
 		CLEANUP(ISC_R_CRYPTOFAILURE);
 	}
 
-	if (EVP_EncryptUpdate(aead, NULL, &len, additional_data.base,
-			      additional_data.length) != 1)
-	{
-		CLEANUP(ISC_R_CRYPTOFAILURE);
+	if (additional_data.base != NULL) {
+		INSIST(additional_data.length != 0);
+		if (EVP_EncryptUpdate(aead, NULL, &len, additional_data.base,
+				      additional_data.length) != 1)
+		{
+			CLEANUP(ISC_R_CRYPTOFAILURE);
+		}
 	}
 
 	len = out.length;
@@ -599,10 +602,13 @@ isc_crypto_aead_open(isc_crypto_aead_t *aead, isc_constregion_t nonce,
 		CLEANUP(ISC_R_CRYPTOFAILURE);
 	}
 
-	if (EVP_DecryptUpdate(aead, NULL, &len, additional_data.base,
-			      additional_data.length) != 1)
-	{
-		CLEANUP(ISC_R_CRYPTOFAILURE);
+	if (additional_data.base != NULL) {
+		INSIST(additional_data.length != 0);
+		if (EVP_DecryptUpdate(aead, NULL, &len, additional_data.base,
+				      additional_data.length) != 1)
+		{
+			CLEANUP(ISC_R_CRYPTOFAILURE);
+		}
 	}
 
 	len = out.length;