openssl-1_1/openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch

---
 crypto/evp/e_aes.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/crypto/evp/e_aes.c
+++ b/crypto/evp/e_aes.c
@@ -2742,6 +2742,9 @@ static int aes_cbc_cipher(EVP_CIPHER_CTX
 {
     EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
 
+    if (!len)
+        return 1;
+
     if (dat->stream.cbc)
         (*dat->stream.cbc) (in, out, len, &dat->ks,
                             EVP_CIPHER_CTX_iv_noconst(ctx),
- Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=164 2024-07-25 10:07:48 +02:00			`---`
			`crypto/evp/e_aes.c \| 3 +++`
			`1 file changed, 3 insertions(+)`

			`--- a/crypto/evp/e_aes.c`
			`+++ b/crypto/evp/e_aes.c`
			`@@ -2742,6 +2742,9 @@ static int aes_cbc_cipher(EVP_CIPHER_CTX`
			`{`
			`EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);`

			`+ if (!len)`
			`+ return 1;`
			`+`
			`if (dat->stream.cbc)`
			`(*dat->stream.cbc) (in, out, len, &dat->ks,`
			`EVP_CIPHER_CTX_iv_noconst(ctx),`