Verify in2 is not null before attempting to compute hmac

developernotes · developernotes · commit a3f0729a0df9 · 2017-10-13T14:51:52.000-05:00
diff --git a/src/crypto_cc.c b/src/crypto_cc.c
@@ -66,9 +66,10 @@ static const char* sqlcipher_cc_get_provider_version(void *ctx) {
 
 static int sqlcipher_cc_hmac(void *ctx, unsigned char *hmac_key, int key_sz, unsigned char *in, int in_sz, unsigned char *in2, int in2_sz, unsigned char *out) {
   CCHmacContext hmac_context;
+  if(in == NULL) return SQLITE_ERROR;
   CCHmacInit(&hmac_context, kCCHmacAlgSHA1, hmac_key, key_sz);
   CCHmacUpdate(&hmac_context, in, in_sz);
-  CCHmacUpdate(&hmac_context, in2, in2_sz);
+  if(in2 != NULL) CCHmacUpdate(&hmac_context, in2, in2_sz);
   CCHmacFinal(&hmac_context, out);
   return SQLITE_OK; 
 }
diff --git a/src/crypto_libtomcrypt.c b/src/crypto_libtomcrypt.c
@@ -145,9 +145,10 @@ static int sqlcipher_ltc_hmac(void *ctx, unsigned char *hmac_key, int key_sz, un
   unsigned long outlen = key_sz;
 
   hash_idx = find_hash("sha1");
+  if(in == NULL) return SQLITE_ERROR;
   if((rc = hmac_init(&hmac, hash_idx, hmac_key, key_sz)) != CRYPT_OK) return SQLITE_ERROR;
   if((rc = hmac_process(&hmac, in, in_sz)) != CRYPT_OK) return SQLITE_ERROR;
-  if((rc = hmac_process(&hmac, in2, in2_sz)) != CRYPT_OK) return SQLITE_ERROR;
+  if(in2 != NULL && (rc = hmac_process(&hmac, in2, in2_sz)) != CRYPT_OK) return SQLITE_ERROR;
   if((rc = hmac_done(&hmac, out, &outlen)) != CRYPT_OK) return SQLITE_ERROR;
   return SQLITE_OK;
 }
diff --git a/src/crypto_openssl.c b/src/crypto_openssl.c
@@ -207,10 +207,10 @@ static int sqlcipher_openssl_random (void *ctx, void *buffer, int length) {
 static int sqlcipher_openssl_hmac(void *ctx, unsigned char *hmac_key, int key_sz, unsigned char *in, int in_sz, unsigned char *in2, int in2_sz, unsigned char *out) {
   unsigned int outlen;
   HMAC_CTX* hctx = HMAC_CTX_new();
-  if(hctx == NULL) return SQLITE_ERROR;
+  if(hctx == NULL || in == NULL) return SQLITE_ERROR;
   HMAC_Init_ex(hctx, hmac_key, key_sz, EVP_sha1(), NULL);
   HMAC_Update(hctx, in, in_sz);
-  HMAC_Update(hctx, in2, in2_sz);
+  if(in2 != NULL) HMAC_Update(hctx, in2, in2_sz);
   HMAC_Final(hctx, out, &outlen);
   HMAC_CTX_free(hctx);
   return SQLITE_OK; 
