Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libcaes for openSUSE:Factory checked in at 2026-11-02 16:40:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libcaes (Old) and /work/SRC/openSUSE:Factory/.libcaes.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libcaes" Mon Nov 2 16:40:43 2026 rev:28 rq:1394452 version:20261028 Changes: -------- --- /work/SRC/openSUSE:Factory/libcaes/libcaes.changes 2026-09-07 16:24:26.211791139 +0200 +++ /work/SRC/openSUSE:Factory/.libcaes.new.1255/libcaes.changes 2026-11-02 16:41:27.714984918 +0100 @@ -1,0 +2,6 @@ +Mon Nov 2 12:17:36 UTC 2026 - Jan Engelhardt <[email protected]> + +- Update to release 20261028 + * Fix potential double free involving openssl code + +------------------------------------------------------------------- Old: ---- libcaes-alpha-20260905.tar.gz libcaes-alpha-20260905.tar.gz.asc New: ---- libcaes-alpha-20261028.tar.gz libcaes-alpha-20261028.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libcaes.spec ++++++ --- /var/tmp/diff_new_pack.tA3e0P/_old 2026-11-02 16:41:28.852032354 +0100 +++ /var/tmp/diff_new_pack.tA3e0P/_new 2026-11-02 16:41:28.857032562 +0100 @@ -20,7 +20,7 @@ %define lname libcaes1 Name: libcaes -Version: 20260905 +Version: 20261028 Release: 0 Summary: Library for AES encryption License: LGPL-3.0-or-later ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.tA3e0P/_old 2026-11-02 16:41:28.915034982 +0100 +++ /var/tmp/diff_new_pack.tA3e0P/_new 2026-11-02 16:41:28.925035399 +0100 @@ -1,5 +1,5 @@ -mtime: 1788699939 -commit: bc809dac794eee3f884730352dbb43ebcb8c6b7ad17f2737a6d296ae67773fc6 +mtime: 1793623561 +commit: 5a84fc5729a47d738b2bb91a6fa85ba88c6955d9d2afb23e90af87e4311c22d3 url: https://src.opensuse.org/security-forensics/libcaes revision: master ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-11-02 13:46:01.000000000 +0100 @@ -0,0 +1 @@ +.osc ++++++ libcaes-alpha-20260905.tar.gz -> libcaes-alpha-20261028.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/acinclude.m4 new/libcaes-20261028/acinclude.m4 --- old/libcaes-20260905/acinclude.m4 2026-09-05 18:18:37.000000000 +0200 +++ new/libcaes-20261028/acinclude.m4 2026-10-28 11:12:57.000000000 +0100 @@ -1,6 +1,6 @@ dnl Checks for required headers and functions dnl -dnl Version: 20240520 +dnl Version: 20260905 dnl Function to detect if libcaes dependencies are available AC_DEFUN([AX_LIBCAES_CHECK_LOCAL], diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/common/config.h new/libcaes-20261028/common/config.h --- old/libcaes-20260905/common/config.h 2026-09-05 19:29:32.000000000 +0200 +++ new/libcaes-20261028/common/config.h 2026-10-28 11:29:34.000000000 +0100 @@ -335,7 +335,7 @@ #define PACKAGE_NAME "libcaes" /* Define to the full name and version of this package. */ -#define PACKAGE_STRING "libcaes 20260905" +#define PACKAGE_STRING "libcaes 20261028" /* Define to the one symbol short name of this package. */ #define PACKAGE_TARNAME "libcaes" @@ -344,7 +344,7 @@ #define PACKAGE_URL "" /* Define to the version of this package. */ -#define PACKAGE_VERSION "20260905" +#define PACKAGE_VERSION "20261028" /* The size of 'int', as computed by sizeof. */ #define SIZEOF_INT 4 @@ -370,7 +370,7 @@ /* #undef STRERROR_R_CHAR_P */ /* Version number of package */ -#define VERSION "20260905" +#define VERSION "20261028" /* Number of bits in a file offset, on hosts where this is settable. */ /* #undef _FILE_OFFSET_BITS */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/configure new/libcaes-20261028/configure --- old/libcaes-20260905/configure 2026-09-05 19:29:53.000000000 +0200 +++ new/libcaes-20261028/configure 2026-10-28 11:29:49.000000000 +0100 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.72 for libcaes 20260905. +# Generated by GNU Autoconf 2.72 for libcaes 20261028. # # Report bugs to <https://github.com/libyal/libcaes/issues>. # @@ -614,8 +614,8 @@ # Identity of this package. PACKAGE_NAME='libcaes' PACKAGE_TARNAME='libcaes' -PACKAGE_VERSION='20260905' -PACKAGE_STRING='libcaes 20260905' +PACKAGE_VERSION='20261028' +PACKAGE_STRING='libcaes 20261028' PACKAGE_BUGREPORT='https://github.com/libyal/libcaes/issues' PACKAGE_URL='' @@ -1475,7 +1475,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -'configure' configures libcaes 20260905 to adapt to many kinds of systems. +'configure' configures libcaes 20261028 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1546,7 +1546,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of libcaes 20260905:";; + short | recursive ) echo "Configuration of libcaes 20261028:";; esac cat <<\_ACEOF @@ -1704,7 +1704,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -libcaes configure 20260905 +libcaes configure 20261028 generated by GNU Autoconf 2.72 Copyright (C) 2023 Free Software Foundation, Inc. @@ -2446,7 +2446,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by libcaes $as_me 20260905, which was +It was created by libcaes $as_me 20261028, which was generated by GNU Autoconf 2.72. Invocation command line was $ $0$ac_configure_args_raw @@ -4143,7 +4143,7 @@ # Define the identity of the package. PACKAGE='libcaes' - VERSION='20260905' + VERSION='20261028' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -26291,7 +26291,13 @@ if test -d "$ac_cv_with_openssl" then : CFLAGS="$CFLAGS -I${ac_cv_with_openssl}/include" - LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib" + if test -d "${ac_cv_with_openssl}/lib64" +then : + LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib64" +else case e in #( + e) LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib" ;; +esac +fi else case e in #( e) { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in '$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in '$ac_pwd':" >&2;} @@ -26670,7 +26676,13 @@ if test -d "$ac_cv_with_openssl" then : CFLAGS="$CFLAGS -I${ac_cv_with_openssl}/include" - LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib" + if test -d "${ac_cv_with_openssl}/lib64" +then : + LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib64" +else case e in #( + e) LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib" ;; +esac +fi else case e in #( e) { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in '$ac_pwd':" >&5 printf "%s\n" "$as_me: error: in '$ac_pwd':" >&2;} @@ -27190,9 +27202,9 @@ fi - { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ERR_remove_thread_state in -lcrypto" >&5 -printf %s "checking for ERR_remove_thread_state in -lcrypto... " >&6; } -if test ${ac_cv_lib_crypto_ERR_remove_thread_state+y} + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ERR_clear_error in -lcrypto" >&5 +printf %s "checking for ERR_clear_error in -lcrypto... " >&6; } +if test ${ac_cv_lib_crypto_ERR_clear_error+y} then : printf %s "(cached) " >&6 else case e in #( @@ -27210,20 +27222,20 @@ #ifdef __cplusplus extern "C" #endif -char ERR_remove_thread_state (void); +char ERR_clear_error (void); int main (void) { -return ERR_remove_thread_state (); +return ERR_clear_error (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : - ac_cv_lib_crypto_ERR_remove_thread_state=yes + ac_cv_lib_crypto_ERR_clear_error=yes else case e in #( - e) ac_cv_lib_crypto_ERR_remove_thread_state=no ;; + e) ac_cv_lib_crypto_ERR_clear_error=no ;; esac fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ @@ -27231,9 +27243,9 @@ LIBS=$ac_check_lib_save_LIBS ;; esac fi -{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_ERR_remove_thread_state" >&5 -printf "%s\n" "$ac_cv_lib_crypto_ERR_remove_thread_state" >&6; } -if test "x$ac_cv_lib_crypto_ERR_remove_thread_state" = xyes +{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_ERR_clear_error" >&5 +printf "%s\n" "$ac_cv_lib_crypto_ERR_clear_error" >&6; } +if test "x$ac_cv_lib_crypto_ERR_clear_error" = xyes then : ac_cv_libcrypto_dummy=yes else case e in #( @@ -28083,9 +28095,9 @@ fi - { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ERR_remove_thread_state in -lcrypto" >&5 -printf %s "checking for ERR_remove_thread_state in -lcrypto... " >&6; } -if test ${ac_cv_lib_crypto_ERR_remove_thread_state+y} + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ERR_clear_error in -lcrypto" >&5 +printf %s "checking for ERR_clear_error in -lcrypto... " >&6; } +if test ${ac_cv_lib_crypto_ERR_clear_error+y} then : printf %s "(cached) " >&6 else case e in #( @@ -28103,20 +28115,20 @@ #ifdef __cplusplus extern "C" #endif -char ERR_remove_thread_state (void); +char ERR_clear_error (void); int main (void) { -return ERR_remove_thread_state (); +return ERR_clear_error (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : - ac_cv_lib_crypto_ERR_remove_thread_state=yes + ac_cv_lib_crypto_ERR_clear_error=yes else case e in #( - e) ac_cv_lib_crypto_ERR_remove_thread_state=no ;; + e) ac_cv_lib_crypto_ERR_clear_error=no ;; esac fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ @@ -28124,9 +28136,9 @@ LIBS=$ac_check_lib_save_LIBS ;; esac fi -{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_ERR_remove_thread_state" >&5 -printf "%s\n" "$ac_cv_lib_crypto_ERR_remove_thread_state" >&6; } -if test "x$ac_cv_lib_crypto_ERR_remove_thread_state" = xyes +{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_ERR_clear_error" >&5 +printf "%s\n" "$ac_cv_lib_crypto_ERR_clear_error" >&6; } +if test "x$ac_cv_lib_crypto_ERR_clear_error" = xyes then : ac_cv_libcrypto_dummy=yes else case e in #( @@ -29019,7 +29031,7 @@ if test "x$ac_cv_libcrypto" = xno then : - if test "x$ac_cv_libcrypto_aes_cbc" = xno || test "x$ac_cv_libcrypto_aes_ecb" = xno + if test "x$ac_cv_libcrypto_aes_cbc" = xlibcrypto || test "x$ac_cv_libcrypto_aes_ecb" = xlibcrypto then : ac_cv_libcrypto=yes fi @@ -29250,9 +29262,9 @@ fi - { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ERR_remove_thread_state in -lcrypto" >&5 -printf %s "checking for ERR_remove_thread_state in -lcrypto... " >&6; } -if test ${ac_cv_lib_crypto_ERR_remove_thread_state+y} + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ERR_clear_error in -lcrypto" >&5 +printf %s "checking for ERR_clear_error in -lcrypto... " >&6; } +if test ${ac_cv_lib_crypto_ERR_clear_error+y} then : printf %s "(cached) " >&6 else case e in #( @@ -29270,20 +29282,20 @@ #ifdef __cplusplus extern "C" #endif -char ERR_remove_thread_state (void); +char ERR_clear_error (void); int main (void) { -return ERR_remove_thread_state (); +return ERR_clear_error (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO" then : - ac_cv_lib_crypto_ERR_remove_thread_state=yes + ac_cv_lib_crypto_ERR_clear_error=yes else case e in #( - e) ac_cv_lib_crypto_ERR_remove_thread_state=no ;; + e) ac_cv_lib_crypto_ERR_clear_error=no ;; esac fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ @@ -29291,9 +29303,9 @@ LIBS=$ac_check_lib_save_LIBS ;; esac fi -{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_ERR_remove_thread_state" >&5 -printf "%s\n" "$ac_cv_lib_crypto_ERR_remove_thread_state" >&6; } -if test "x$ac_cv_lib_crypto_ERR_remove_thread_state" = xyes +{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_ERR_clear_error" >&5 +printf "%s\n" "$ac_cv_lib_crypto_ERR_clear_error" >&6; } +if test "x$ac_cv_lib_crypto_ERR_clear_error" = xyes then : ac_cv_libcrypto_dummy=yes else case e in #( @@ -29889,32 +29901,38 @@ e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include <stdlib.h> -#include <openssl/err.h> +#include <string.h> #include <openssl/evp.h> int main (void) { -unsigned char key[ 16 ] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }; -int result = 0; +unsigned char initialization_vector[ 16 ] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }; +unsigned char input_data[ 32 ] = { 0 }; +unsigned char output_data[ 32 ] = { 0 }; +int safe_output_data_size = 0; -#if defined( HAVE_EVP_CIPHER_CTX_INIT ) -EVP_CIPHER_CTX ctx; +const EVP_CIPHER *cipher = EVP_aes_128_xts(); +EVP_CIPHER_CTX *context = EVP_CIPHER_CTX_new(); -EVP_CIPHER_CTX_init( &ctx ); -#else -EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); -#endif +unsigned char key_encrypt[ 32 ] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, + 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }; +unsigned char key_decrypt[ 32 ] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }; -result = EVP_CipherInit_ex(ctx, EVP_aes_128_xts(), NULL, key, key, 0); +if( (cipher == NULL) || (context == NULL) ) return( EXIT_FAILURE ); -#if defined( HAVE_EVP_CIPHER_CTX_INIT ) -EVP_CIPHER_CTX_cleanup( &ctx ); -#else -EVP_CIPHER_CTX_free( ctx ); -#endif +if( EVP_CipherInit_ex(context, cipher, NULL, key_encrypt, initialization_vector, 1) != 1 ) return( EXIT_FAILURE ); + +if( EVP_CipherUpdate(context, output_data, &safe_output_data_size, input_data, 32) != 1 ) return( EXIT_FAILURE ); -if( result != 1 ) return( EXIT_FAILURE ); +if( EVP_CipherInit_ex(context, cipher, NULL, key_decrypt, initialization_vector, 0) != 1 ) return( EXIT_FAILURE ); +if( EVP_CipherUpdate(context, input_data, &safe_output_data_size, output_data, 32) != 1 ) return( EXIT_FAILURE ); + +EVP_CIPHER_CTX_free( context ); return( EXIT_SUCCESS ); ; return 0; @@ -30379,7 +30397,8 @@ esac fi -fi + + fi if test "x${ac_cv_enable_python}" != xno; then HAVE_PYTHON_TRUE= @@ -31775,7 +31794,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by libcaes $as_me 20260905, which was +This file was extended by libcaes $as_me 20261028, which was generated by GNU Autoconf 2.72. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -31843,7 +31862,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -libcaes config.status 20260905 +libcaes config.status 20261028 configured by $0, generated by GNU Autoconf 2.72, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/configure.ac new/libcaes-20261028/configure.ac --- old/libcaes-20260905/configure.ac 2026-09-05 19:19:09.000000000 +0200 +++ new/libcaes-20261028/configure.ac 2026-10-28 11:12:56.000000000 +0100 @@ -2,7 +2,7 @@ AC_INIT( [libcaes], - [20260905], + [20261028], [https://github.com/libyal/libcaes/issues]) AC_CONFIG_SRCDIR( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/dpkg/changelog new/libcaes-20261028/dpkg/changelog --- old/libcaes-20260905/dpkg/changelog 2026-09-05 19:29:58.000000000 +0200 +++ new/libcaes-20261028/dpkg/changelog 2026-10-28 11:29:55.000000000 +0100 @@ -1,5 +1,5 @@ -libcaes (20260905-1) unstable; urgency=low +libcaes (20261028-1) unstable; urgency=low * Auto-generated - -- Joachim Metz <[email protected]> Sat, 05 Sep 2026 19:29:58 +0200 + -- Joachim Metz <[email protected]> Wed, 28 Oct 2026 11:29:55 +0100 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/include/libcaes/definitions.h new/libcaes-20261028/include/libcaes/definitions.h --- old/libcaes-20260905/include/libcaes/definitions.h 2026-09-05 19:29:58.000000000 +0200 +++ new/libcaes-20261028/include/libcaes/definitions.h 2026-10-28 11:29:55.000000000 +0100 @@ -24,11 +24,11 @@ #include <libcaes/types.h> -#define LIBCAES_VERSION 20260905 +#define LIBCAES_VERSION 20261028 /* The version string */ -#define LIBCAES_VERSION_STRING "20260905" +#define LIBCAES_VERSION_STRING "20261028" /* The crypt modes */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/libcaes/libcaes.rc new/libcaes-20261028/libcaes/libcaes.rc --- old/libcaes-20260905/libcaes/libcaes.rc 2026-09-05 19:29:58.000000000 +0200 +++ new/libcaes-20261028/libcaes/libcaes.rc 2026-10-28 11:29:55.000000000 +0100 @@ -22,12 +22,12 @@ BLOCK "040904E4" BEGIN VALUE "FileDescription", "Library to support cross-platform AES encryption\0" - VALUE "FileVersion", "20260905" "\0" + VALUE "FileVersion", "20261028" "\0" VALUE "InternalName", "libcaes.dll\0" VALUE "LegalCopyright", "(C) 2011-2026, Joachim Metz <[email protected]>\0" VALUE "OriginalFilename", "libcaes.dll\0" VALUE "ProductName", "libcaes\0" - VALUE "ProductVersion", "20260905" "\0" + VALUE "ProductVersion", "20261028" "\0" VALUE "Comments", "For more information visit https://github.com/libyal/libcaes/\0"; END END diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/libcaes/libcaes_context.c new/libcaes-20261028/libcaes/libcaes_context.c --- old/libcaes-20260905/libcaes/libcaes_context.c 2026-09-05 19:14:08.000000000 +0200 +++ new/libcaes-20261028/libcaes/libcaes_context.c 2026-10-28 11:24:49.000000000 +0100 @@ -446,8 +446,7 @@ } /* Make sure the error state is removed otherwise OpenSSL will leak memory */ - ERR_remove_thread_state( - NULL ); + ERR_clear_error(); #else EVP_CIPHER_CTX_free( internal_context->evp_cipher_context ); @@ -1353,7 +1352,6 @@ size_t output_data_size, libcerror_error_t **error ) { - uint8_t block_data[ EVP_MAX_BLOCK_LENGTH ]; char error_string[ 256 ]; #if defined( HAVE_EVP_CIPHERINIT_EX2 ) @@ -1370,6 +1368,7 @@ static char *function = "libcaes_crypt_cbc"; unsigned long error_code = 0; int safe_output_data_size = 0; + int total_data_size = 0; if( context == NULL ) { @@ -1479,20 +1478,6 @@ return( -1 ); } - if( memory_set( - block_data, - 0, - EVP_MAX_BLOCK_LENGTH ) == NULL ) - { - libcerror_error_set( - error, - LIBCERROR_ERROR_DOMAIN_MEMORY, - LIBCERROR_MEMORY_ERROR_SET_FAILED, - "%s: unable to clear input block data.", - function ); - - goto on_error; - } #if defined( HAVE_EVP_CIPHERINIT_EX2 ) if( EVP_CIPHER_CTX_reset( internal_context->evp_cipher_context ) != 1 ) @@ -1613,7 +1598,7 @@ } if( EVP_CIPHER_CTX_set_padding( internal_context->evp_cipher_context, - 1 ) != 1 ) + 0 ) != 1 ) { error_code = ERR_get_error(); @@ -1658,12 +1643,34 @@ goto on_error; } - /* Just ignore the output of this function + /* Get any remaining data, i.e. the final block, and write it + * to the output data */ - EVP_CipherFinal_ex( - internal_context->evp_cipher_context, - (unsigned char *) block_data, - &safe_output_data_size ); + total_data_size = 0; + + if( EVP_CipherFinal_ex( + internal_context->evp_cipher_context, + (unsigned char *) &( output_data[ (size_t) safe_output_data_size ] ), + &total_data_size ) != 1 ) + { + error_code = ERR_get_error(); + + ERR_error_string_n( + error_code, + error_string, + 256 ); + + libcerror_error_set( + error, + LIBCERROR_ERROR_DOMAIN_RUNTIME, + LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED, + "%s: unable to finalize cipher with error: %s.", + function, + error_string ); + + goto on_error; + } + safe_output_data_size += total_data_size; #if defined( HAVE_EVP_CIPHERINIT_EX2 ) EVP_CIPHER_free( @@ -2872,7 +2879,6 @@ size_t output_data_size, libcerror_error_t **error ) { - uint8_t block_data[ EVP_MAX_BLOCK_LENGTH ]; char error_string[ 256 ]; #if defined( HAVE_EVP_CIPHERINIT_EX2 ) @@ -2889,6 +2895,7 @@ static char *function = "libcaes_crypt_ecb"; unsigned long error_code = 0; int safe_output_data_size = 0; + int total_data_size = 0; if( context == NULL ) { @@ -2974,20 +2981,6 @@ return( -1 ); } - if( memory_set( - block_data, - 0, - EVP_MAX_BLOCK_LENGTH ) == NULL ) - { - libcerror_error_set( - error, - LIBCERROR_ERROR_DOMAIN_MEMORY, - LIBCERROR_MEMORY_ERROR_SET_FAILED, - "%s: unable to clear block data.", - function ); - - goto on_error; - } #if defined( HAVE_EVP_CIPHERINIT_EX2 ) if( EVP_CIPHER_CTX_reset( internal_context->evp_cipher_context ) != 1 ) @@ -3108,7 +3101,7 @@ } if( EVP_CIPHER_CTX_set_padding( internal_context->evp_cipher_context, - 1 ) != 1 ) + 0 ) != 1 ) { error_code = ERR_get_error(); @@ -3153,12 +3146,34 @@ goto on_error; } - /* Just ignore the output of this function + /* Get any remaining data, i.e. the final block, and write it + * to the output data */ - EVP_CipherFinal_ex( - internal_context->evp_cipher_context, - (unsigned char *) block_data, - &safe_output_data_size ); + total_data_size = 0; + + if( EVP_CipherFinal_ex( + internal_context->evp_cipher_context, + (unsigned char *) &( output_data[ (size_t) safe_output_data_size ] ), + &total_data_size ) != 1 ) + { + error_code = ERR_get_error(); + + ERR_error_string_n( + error_code, + error_string, + 256 ); + + libcerror_error_set( + error, + LIBCERROR_ERROR_DOMAIN_RUNTIME, + LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED, + "%s: unable to finalize cipher with error: %s.", + function, + error_string ); + + goto on_error; + } + safe_output_data_size += total_data_size; #if defined( HAVE_EVP_CIPHERINIT_EX2 ) EVP_CIPHER_free( @@ -3217,6 +3232,17 @@ } internal_context = (libcaes_internal_context_t *) context; + if( internal_context->round_keys == NULL ) + { + libcerror_error_set( + error, + LIBCERROR_ERROR_DOMAIN_RUNTIME, + LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, + "%s: invalid context - missing round keys.", + function ); + + return( -1 ); + } if( ( mode != LIBCAES_CRYPT_MODE_DECRYPT ) && ( mode != LIBCAES_CRYPT_MODE_ENCRYPT ) ) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/libcaes/libcaes_definitions.h new/libcaes-20261028/libcaes/libcaes_definitions.h --- old/libcaes-20260905/libcaes/libcaes_definitions.h 2026-09-05 19:29:58.000000000 +0200 +++ new/libcaes-20261028/libcaes/libcaes_definitions.h 2026-10-28 11:29:55.000000000 +0100 @@ -34,11 +34,11 @@ * for local use of libcaes */ #else -#define LIBCAES_VERSION 20260905 +#define LIBCAES_VERSION 20261028 /* The libcaes version string */ -#define LIBCAES_VERSION_STRING "20260905" +#define LIBCAES_VERSION_STRING "20261028" /* The crypt modes */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/libcaes/libcaes_tweaked_context.c new/libcaes-20261028/libcaes/libcaes_tweaked_context.c --- old/libcaes-20260905/libcaes/libcaes_tweaked_context.c 2026-09-05 18:18:37.000000000 +0200 +++ new/libcaes-20261028/libcaes/libcaes_tweaked_context.c 2026-10-28 11:12:57.000000000 +0100 @@ -249,8 +249,7 @@ } /* Make sure the error state is removed otherwise OpenSSL will leak memory */ - ERR_remove_thread_state( - NULL ); + ERR_clear_error(); #else EVP_CIPHER_CTX_free( internal_tweaked_context->evp_cipher_context ); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/libcaes.spec new/libcaes-20261028/libcaes.spec --- old/libcaes-20260905/libcaes.spec 2026-09-05 19:29:58.000000000 +0200 +++ new/libcaes-20261028/libcaes.spec 2026-10-28 11:29:55.000000000 +0100 @@ -1,5 +1,5 @@ Name: libcaes -Version: 20260905 +Version: 20261028 Release: 1 Summary: Library to support cross-platform AES encryption Group: System Environment/Libraries @@ -80,6 +80,6 @@ %{_libdir}/python3*/site-packages/*.so %changelog -* Sat Sep 5 2026 Joachim Metz <[email protected]> 20260905-1 +* Wed Oct 28 2026 Joachim Metz <[email protected]> 20261028-1 - Auto-generated diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/m4/libcrypto.m4 new/libcaes-20261028/m4/libcrypto.m4 --- old/libcaes-20260905/m4/libcrypto.m4 2026-09-05 18:18:37.000000000 +0200 +++ new/libcaes-20261028/m4/libcrypto.m4 2026-10-28 11:27:15.000000000 +0100 @@ -1,9 +1,9 @@ dnl Checks for libcrypto required headers and functions dnl -dnl Version: 20260606 +dnl Version: 20261028 dnl Function to detect whether openssl/evp.h can be used in combination with zlib.h -AC_DEFUN([AX_LIBCRYPTO_CHECK_OPENSSL_EVP_ZLIB_COMPATIBILE], +AC_DEFUN([AX_LIBCRYPTO_CHECK_OPENSSL_EVP_ZLIB_COMPATIBLE], [AC_CACHE_CHECK( [if openssl/evp.h can be used in combination with zlib.h], [ac_cv_openssl_evp_zlib_compatible], @@ -18,7 +18,13 @@ AC_LANG_POP(C)]) ]) -dnl Function to detect whether EVP_CipherInit_ex can be used with duplicate keys. +dnl Function to detect whether EVP_CipherInit_ex can be used with the +dnl duplicate key halves libcaes uses for its tweaked (XTS) keys. +dnl +dnl OpenSSL (>= 1.1.1c) always rejects AES-XTS encryption with duplicate +dnl key halves and in FIPS builds it also rejects decryption with +dnl duplicate key halves. If either operation is rejected libcaes +dnl falls back to its internal AES-XTS implementation. AC_DEFUN([AX_LIBCRYPTO_CHECK_XTS_DUPLICATE_KEYS_SUPPORT], [AC_CACHE_CHECK( [if `EVP_CipherInit_ex' can be used with duplicate keys], @@ -30,29 +36,35 @@ AC_RUN_IFELSE( [AC_LANG_PROGRAM( [[#include <stdlib.h> -#include <openssl/err.h> +#include <string.h> #include <openssl/evp.h>]], - [[unsigned char key[ 16 ] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }; -int result = 0; + [[unsigned char initialization_vector[ 16 ] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }; +unsigned char input_data[ 32 ] = { 0 }; +unsigned char output_data[ 32 ] = { 0 }; +int safe_output_data_size = 0; + +const EVP_CIPHER *cipher = EVP_aes_128_xts(); +EVP_CIPHER_CTX *context = EVP_CIPHER_CTX_new(); + +unsigned char key_encrypt[ 32 ] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, + 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }; +unsigned char key_decrypt[ 32 ] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }; + +if( (cipher == NULL) || (context == NULL) ) return( EXIT_FAILURE ); + +if( EVP_CipherInit_ex(context, cipher, NULL, key_encrypt, initialization_vector, 1) != 1 ) return( EXIT_FAILURE ); -#if defined( HAVE_EVP_CIPHER_CTX_INIT ) -EVP_CIPHER_CTX ctx; +if( EVP_CipherUpdate(context, output_data, &safe_output_data_size, input_data, 32) != 1 ) return( EXIT_FAILURE ); -EVP_CIPHER_CTX_init( &ctx ); -#else -EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); -#endif - -result = EVP_CipherInit_ex(ctx, EVP_aes_128_xts(), NULL, key, key, 0); - -#if defined( HAVE_EVP_CIPHER_CTX_INIT ) -EVP_CIPHER_CTX_cleanup( &ctx ); -#else -EVP_CIPHER_CTX_free( ctx ); -#endif +if( EVP_CipherInit_ex(context, cipher, NULL, key_decrypt, initialization_vector, 0) != 1 ) return( EXIT_FAILURE ); -if( result != 1 ) return( EXIT_FAILURE ); +if( EVP_CipherUpdate(context, input_data, &safe_output_data_size, output_data, 32) != 1 ) return( EXIT_FAILURE ); +EVP_CIPHER_CTX_free( context ); return( EXIT_SUCCESS ); ]] )], [ac_cv_openssl_xts_duplicate_keys=yes], [ac_cv_openssl_xts_duplicate_keys=no], @@ -69,7 +81,7 @@ AS_IF( [test "x$ac_cv_header_openssl_evp_h" = xno], [ac_cv_libcrypto_evp=no], - [AX_LIBCRYPTO_CHECK_OPENSSL_EVP_ZLIB_COMPATIBILE + [AX_LIBCRYPTO_CHECK_OPENSSL_EVP_ZLIB_COMPATIBLE AS_IF( [test "x$ac_cv_openssl_evp_zlib_compatible" = xyes], @@ -125,7 +137,7 @@ AC_CHECK_LIB( crypto, - ERR_remove_thread_state, + ERR_clear_error, [ac_cv_libcrypto_dummy=yes], [ac_cv_libcrypto_evp_md=no]) ]) @@ -479,7 +491,7 @@ AC_CHECK_LIB( crypto, - ERR_remove_thread_state, + ERR_clear_error, [ac_cv_libcrypto_dummy=yes], [ac_cv_libcrypto_evp_cipher=no]) ]) @@ -620,7 +632,7 @@ AS_IF( [test "x$ac_cv_libcrypto" = xno], [AS_IF( - [test "x$ac_cv_libcrypto_aes_cbc" = xno || test "x$ac_cv_libcrypto_aes_ecb" = xno], + [test "x$ac_cv_libcrypto_aes_cbc" = xlibcrypto || test "x$ac_cv_libcrypto_aes_ecb" = xlibcrypto], [ac_cv_libcrypto=yes]) ]) @@ -644,7 +656,10 @@ [AS_IF( [test -d "$ac_cv_with_openssl"], [CFLAGS="$CFLAGS -I${ac_cv_with_openssl}/include" - LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib"], + AS_IF( + [test -d "${ac_cv_with_openssl}/lib64"], + [LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib64"], + [LDFLAGS="$LDFLAGS -L${ac_cv_with_openssl}/lib"])], [AC_MSG_FAILURE( [no such directory: $ac_cv_with_openssl], [1]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/m4/python.m4 new/libcaes-20261028/m4/python.m4 --- old/libcaes-20260905/m4/python.m4 2026-09-05 18:18:37.000000000 +0200 +++ new/libcaes-20261028/m4/python.m4 2026-10-28 11:12:57.000000000 +0100 @@ -1,6 +1,6 @@ dnl Functions for Python bindings dnl -dnl Version: 20260529 +dnl Version: 20261022 dnl Function to check if the python binary is available dnl "python${PYTHON_VERSION} python python# python#.#" @@ -188,7 +188,7 @@ [use `python-config --prefix' to determine the prefix of pythondir instead of --prefix], [no], [no]) -]) + ]) dnl Function to detect if to enable Python AC_DEFUN([AX_PYTHON_CHECK_ENABLE], @@ -208,7 +208,9 @@ AS_IF( [test "x${ac_cv_enable_python}" != xno], - [AX_PYTHON_CHECK]) + [AX_PYTHON_CHECK + + dnl TODO: add check to catch mismatch Python runtime used in tests and module version]) AM_CONDITIONAL( HAVE_PYTHON, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/pyproject.toml new/libcaes-20261028/pyproject.toml --- old/libcaes-20260905/pyproject.toml 2026-09-05 19:29:58.000000000 +0200 +++ new/libcaes-20261028/pyproject.toml 2026-10-28 11:29:55.000000000 +0100 @@ -4,7 +4,7 @@ [project] name = "libcaes-python" -version = "20260905" +version = "20261028" description = "Python bindings for libcaes" maintainers = [ { name = "Joachim Metz", email = "[email protected]" }, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libcaes-20260905/tests/package.m4 new/libcaes-20261028/tests/package.m4 --- old/libcaes-20260905/tests/package.m4 2026-09-05 19:20:34.000000000 +0200 +++ new/libcaes-20261028/tests/package.m4 2026-10-28 11:12:57.000000000 +0100 @@ -1,5 +1,5 @@ m4_define([AT_PACKAGE_NAME], [libcaes]) m4_define([AT_PACKAGE_TARNAME], [libcaes]) -m4_define([AT_PACKAGE_VERSION], [20260905]) -m4_define([AT_PACKAGE_STRING], [libcaes 20260905]) +m4_define([AT_PACKAGE_VERSION], [20260911]) +m4_define([AT_PACKAGE_STRING], [libcaes 20260911]) m4_define([AT_PACKAGE_BUGREPORT], [https://github.com/libyal/libcaes/issues])
