From 651b949d85f847318ece301b64c099ad7959e9d0 Mon Sep 17 00:00:00 2001 From: Sverker Eriksson Date: Wed, 12 Feb 2014 15:05:52 +0100 Subject: crypto: Fix bug when using old hmac context Symptom: Using an old context (that had already been passed as argument to either hmac_upgrade or hmac_final) could cause VM crash or worse. Reason: Only a shallow copy (memcpy) of the context was made causing a new context to partly mutate its parent context into an inconsistent state. Problem: Only OpenSSL v1.0 supports deep copy of hmac context. It is thus not possible to implement a functional interface for older OpenSSL versions (0.9.8) which still have wide spread use. Solution: Change hmac contexts into a mutable state using NIF resources. Document reuse of old contexts as undefined. Future: If a need for reusing old context variables arise, a new hmac_copy function could be introduced that is only supported for OpenSSL v1.0. --- lib/crypto/doc/src/crypto.xml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'lib/crypto/doc/src') diff --git a/lib/crypto/doc/src/crypto.xml b/lib/crypto/doc/src/crypto.xml index 40f829e704..c95827c371 100644 --- a/lib/crypto/doc/src/crypto.xml +++ b/lib/crypto/doc/src/crypto.xml @@ -4,7 +4,7 @@
- 19992013 + 19992014 Ericsson AB. All Rights Reserved. @@ -366,7 +366,11 @@ or to one of the functions hmac_final and hmac_final_n

- +

Do not use a Context as argument in more than one + call to hmac_update or hmac_final. The semantics of reusing old contexts + in any way is undefined and could even crash the VM in earlier releases. + The reason for this limitation is a lack of support in the underlying + OpenSSL API.

 -- cgit v1.2.3