From: Martin Sehnoutka <msehnout@redhat.com>
Date: Wed, 12 Jul 2017 08:09:24 +0000 (+0200)
Subject: Use separate buffers for encrypted and decrypted content in print-esp.c
X-Git-Tag: tcpdump-4.9.2~143
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/06931406d7d50ab93f6457ecf2812695be8adb3c?ds=sidebyside

Use separate buffers for encrypted and decrypted content in print-esp.c

The EVP_Cipher function should not be called with the same buffer as
input and output. It works fine on most architectures, but fails on
PowerPC. There is also a second problem, that we write the output to a
const buffer, but this issue is not addressed with this PR.
---

diff --git a/print-esp.c b/print-esp.c
index 375075a3..9ac7d0be 100644
--- a/print-esp.c
+++ b/print-esp.c
@@ -156,7 +156,8 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo,
 {
 	struct sa_list *sa;
 	const u_char *iv;
-	int len;
+	u_char *buf_mut, *output_buffer;
+	int len, block_size, cipher_nid, output_buffer_size ;
 	EVP_CIPHER_CTX *ctx;
 
 	/* initiator arg is any non-zero value */
@@ -190,15 +191,30 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo,
 		return 0;
 	if (EVP_CipherInit(ctx, sa->evp, sa->secret, NULL, 0) < 0)
 		(*ndo->ndo_warning)(ndo, "espkey init failed");
-	EVP_CipherInit(ctx, NULL, NULL, iv, 0);
-	EVP_Cipher(ctx, buf, buf, len);
+        EVP_CipherInit(ctx, NULL, NULL, iv, 0);
+
+        /* We need a block size */
+        block_size = EVP_CIPHER_CTX_block_size(ctx);
+        /* We need the buffer size to be multiple of a block size */
+        output_buffer_size = len + (block_size - len % block_size);
+        output_buffer = (u_char *)calloc(output_buffer_size, sizeof(u_char));
+	/* EVP_Cipher output buffer should be different from the input one.
+         * Also it should be of size that is multiple of cipher block size. */
+	EVP_Cipher(ctx, output_buffer, buf, len);
 	EVP_CIPHER_CTX_free(ctx);
 
+        buf_mut = (u_char*) buf;
+        /* Of course this is wrong, because buf is a const buffer, but changing this
+         * would require more complicated fix. */
+        memcpy(buf_mut, output_buffer, len);
+        free(output_buffer);
+
 	ndo->ndo_packetp = buf;
 	ndo->ndo_snapend = end;
 
 	return 1;
 
+
 }
 USES_APPLE_RST
 
@@ -606,6 +622,8 @@ esp_print(netdissect_options *ndo,
 	const u_char *ivoff;
 	const u_char *p;
 	EVP_CIPHER_CTX *ctx;
+        u_char *buf_mut, *output_buffer;
+        int block_size, cipher_nid, output_buffer_size;
 #endif
 
 	esp = (const struct newesp *)bp;
@@ -716,8 +734,19 @@ esp_print(netdissect_options *ndo,
 
 			p = ivoff;
 			EVP_CipherInit(ctx, NULL, NULL, p, 0);
-			EVP_Cipher(ctx, p + ivlen, p + ivlen, ep - (p + ivlen));
+                        len = ep - (p + ivlen);
+
+                        /* We need a block size */
+                        block_size = EVP_CIPHER_CTX_block_size(ctx);
+                        /* We need the buffer size to be multiple of a block size */
+                        output_buffer_size = len + (block_size - len % block_size);
+                        output_buffer = (u_char *)calloc(output_buffer_size, sizeof(u_char));
+                        /* EVP_Cipher output buffer should be different from the input one.
+                         * Also it should be of size that is multiple of cipher block size. */
+                        EVP_Cipher(ctx, output_buffer, p + ivlen, len);
 			EVP_CIPHER_CTX_free(ctx);
+                        memcpy(p + ivlen, output_buffer, len);
+                        free(output_buffer);
 			advance = ivoff - (const u_char *)esp + ivlen;
 		} else
 			advance = sizeof(struct newesp);