[openssl-dev] Possible bug in crypto/evp/e_aes.c:aes_cbc_cipher

[Vadim Lebedev]

Hello,

I'was tracking a segfault in EVP_OpneUdate and stumbled on following:

static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
	const unsigned char *in, size_t len)
{
	EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;

	if (dat->stream.cbc)
		(*dat->stream.cbc)(in,out,len,&dat->ks,ctx->iv,ctx->encrypt);
	else if (ctx->encrypt)
	 CRYPTO_cbc128_encrypt(in,out,len,&dat->ks,ctx->iv,dat->block);
	else
	 CRYPTO_cbc128_encrypt(in,out,len,&dat->ks,ctx->iv,dat->block); 

	return 1;
}


I think that the second call to CRYPTO_cbc128_encrypt  should be actually to
CRYPTO_cbc128_decrypt.


Any feedback please?
Thanks
Vadim