From a95c3d8c337e517fbd5bdb6593749eae3ce67640 Mon Sep 17 00:00:00 2001 From: Jacob Quinn Date: Thu, 29 Oct 2026 18:03:55 -0600 Subject: [PATCH] Size cipher_update's output for decryption with padding EVP_DecryptUpdate can write up to inl + block_size bytes; the buffer was inl + block_size - 1, so a whole-block update after a partial one wrote one byte past it on OpenSSL 1.1. Co-Authored-By: Claude Opus 5.5 --- src/OpenSSL.jl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/OpenSSL.jl b/src/OpenSSL.jl index e064ec4..5695b06 100644 --- a/src/OpenSSL.jl +++ b/src/OpenSSL.jl @@ -1008,8 +1008,8 @@ encrypt_init(evp_cipher_ctx::EvpCipherContext, evp_cipher::EvpCipher, symetric_k function cipher_update(evp_cipher_ctx::EvpCipherContext, in_data::Vector{UInt8})::Vector{UInt8} in_length = length(in_data) - block_size = get_block_size(evp_cipher_ctx) - enc_length = Int((in_length + block_size - 1) / block_size * block_size) + # Decrypting with padding can write up to `in_length + block_size` bytes (EVP_DecryptUpdate docs). + enc_length = in_length + get_block_size(evp_cipher_ctx) out_data = Vector{UInt8}(undef, enc_length) out_length = Ref{UInt32}(0)