From 7d60ac176da4150e3be232bc35a32289cbe75ccc Mon Sep 17 00:00:00 2001 From: ndossche Date: Thu, 6 Aug 2026 14:17:59 +0200 Subject: [PATCH] crypto: fix error check on decrypt and encrypt init in context In this file, the other calls to EVP_EncryptInit_ex and EVP_DecryptInit_ex did have return value checks for error conditions, but not these 2. Found by a static-dynamic analyser I develop. Signed-off-by: Nora Dossche --- src/crypto/crypto_context.cc | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc index 0f61767cdbbe..b185cf76be66 100644 --- a/src/crypto/crypto_context.cc +++ b/src/crypto/crypto_context.cc @@ -2583,9 +2583,15 @@ int SecureContext::TicketKeyCallback(SSL* ssl, ArrayBufferViewContents aes_key(aes.As()); if (enc) { - EVP_EncryptInit_ex(ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv); + if (EVP_EncryptInit_ex( + ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv) <= 0) { + return -1; + } } else { - EVP_DecryptInit_ex(ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv); + if (EVP_DecryptInit_ex( + ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv) <= 0) { + return -1; + } } return r;