X-Git-Url: http://wagner.pp.ru/gitweb/?a=blobdiff_plain;f=gost_keyexpimp.c;h=eb1033110c1cf7fcc8a4d8d5e297f3fe68b2e0dd;hb=b5613a2844470fd983cc3681633681a02ef6b44e;hp=b9602002f617c69e2fd5a4f6b87590d25aaa66f2;hpb=47be42da87cb9bf9bad6f415c442b586ce0752ef;p=openssl-gost%2Fengine.git

diff --git a/gost_keyexpimp.c b/gost_keyexpimp.c
index b960200..eb10331 100644
--- a/gost_keyexpimp.c
+++ b/gost_keyexpimp.c
@@ -46,6 +46,11 @@ int gost_kexp15(const unsigned char *shared_key, const int shared_len,
         goto err;
     }
 
+    if (shared_len + mac_len > (unsigned int)(*out_len)) {
+        GOSTerr(GOST_F_GOST_KEXP15, ERR_R_INTERNAL_ERROR);
+        goto err;
+    }
+
     /* we expect IV of half length */
     memset(iv_full, 0, 16);
     memcpy(iv_full, iv, ivlen);
@@ -123,6 +128,16 @@ int gost_kimp15(const unsigned char *expkey, const size_t expkeylen,
         goto err;
     }
 
+    if (expkeylen > sizeof(out)) {
+        GOSTerr(GOST_F_GOST_KIMP15, ERR_R_INTERNAL_ERROR);
+        goto err;
+    }
+
+    if (ivlen > 16) {
+        GOSTerr(GOST_F_GOST_KIMP15, ERR_R_INTERNAL_ERROR);
+        goto err;
+    }
+
     /* we expect IV of half length */
     memset(iv_full, 0, 16);
     memcpy(iv_full, iv, ivlen);
@@ -349,7 +364,6 @@ static int magma_wrap_do(EVP_CIPHER_CTX *ctx, unsigned char *out,
 		return gost_kimp15(cctx->wrapped, cctx->wrap_count, NID_magma_ctr,
 		cctx->key+GOSTKEYLEN, NID_magma_mac, cctx->key, cctx->iv, 4, out) > 0 ? GOSTKEYLEN : 0;
 	}
-	return 1;
 }
 
 static int kuznyechik_wrap_init(EVP_CIPHER_CTX *ctx, const unsigned char *key,