Skip to content

MDEV-39509: Fix "invalid iv length" with OpenSSL 4.0 #5029

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
9EOR9 wants to merge 1 commit into
base: 10.6
Choose a base branch
from
Open

MDEV-39509: Fix "invalid iv length" with OpenSSL 4.0 #5029

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions mysys_ssl/my_crypt.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,22 @@ class MyCTX
if (unlikely(!cipher))
return MY_AES_BAD_KEYSIZE;

#if !defined(HAVE_WOLFSSL) && OPENSSL_VERSION_NUMBER >= 0x40000000L
/* MDEV-39509: In OpenSSL 4.0, EVP_CIPHER_CTX_new initializes the internal
iv_len with a sentinel value of -1. If EVP_CipherInit_ex is called with
cipher, key, and ii in a single step, the provider validates the IV
against this uninitialized state before the cipher's default
metadata is applied, resulting in an "invalid iv length" error.

We perform a two-stage initialization: first, bind the cipher to the
context to "thaw" the metadata and set the correct default iv_len.
Second, provide the actual Key and IV data. This approach is used
instead of EVP_CipherInit_ex2 to maintain compatibility with FIPS mode.
*/
if (EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, encrypt) != 1)
return MY_AES_OPENSSL_ERROR;
#endif

if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, encrypt) != 1)
return MY_AES_OPENSSL_ERROR;

Expand Down