@matheusbsbs / matheus-bagliano / commits / e0b8c84240

treewide: fix various bugs w/ OpenSSL 3+ EVP API

The OpenSSL 3+ EVP API for SHA-* cannot support our prior use cases supported by other SHA-* implementations. It has the following differences: 1. ->init_fn is required before all use 2. struct assignments don't work and requires ->clone_fn 3. can't support ->update_fn after ->final_*fn While fixing cases 1 and 2 is merely the matter of calling ->init_fn and ->clone_fn as appropriate, fixing case 3 requires calling ->final_*fn on a temporary context that's cloned from the primary context. Reported-by: Bagas Sanjaya <bagasdotme@gmail.com> Link: https://lore.kernel.org/ZPCL11k38PXTkFga@debian.me/ Helped-by: brian m. carlson <sandals@crustytoothpaste.net> Fixes: 3e440ea0aba0 ("sha256: avoid functions deprecated in OpenSSL 3+") Fixes: bda9c12073e7 ("avoid SHA-1 functions deprecated in OpenSSL 3+") Signed-off-by: Eric Wong <e@80x24.org> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Eric Wong committed Sep 1, 2023 at 02:09 UTC e0b8c84240037a592c5bd5f18fc382a98a323bea

5 files changed +11 -3

builtin/fast-import.c

@@ -1103,6 +1103,7 @@ static void stream_blob(uintmax_t len, struct object_id *oidout, uintmax_t mark)

1103 || (pack_size + PACK_SIZE_THRESHOLD + len) < pack_size)

1104 cycle_packfile();

1105

1106 + the_hash_algo->init_fn(&checkpoint.ctx);

1107 hashfile_checkpoint(pack_file, &checkpoint);

1108 offset = checkpoint.offset;

1109

builtin/index-pack.c

+4 -1

@@ -1166,6 +1166,7 @@ static void parse_pack_objects(unsigned char *hash)

1166 struct ofs_delta_entry *ofs_delta = ofs_deltas;

1167 struct object_id ref_delta_oid;

1168 struct stat st;

1169 + git_hash_ctx tmp_ctx;

1170

1171 if (verbose)

1172 progress = start_progress(

@@ -1202,7 +1203,9 @@ static void parse_pack_objects(unsigned char *hash)

1203

1204 /* Check pack integrity */

1205 flush();

1205 - the_hash_algo->final_fn(hash, &input_ctx);

1206 + the_hash_algo->init_fn(&tmp_ctx);

1207 + the_hash_algo->clone_fn(&tmp_ctx, &input_ctx);

1208 + the_hash_algo->final_fn(hash, &tmp_ctx);

1209 if (!hasheq(fill(the_hash_algo->rawsz), hash))

1210 die(_("pack is corrupted (SHA1 mismatch)"));

1211 use(the_hash_algo->rawsz);

builtin/unpack-objects.c

+4 -1

@@ -608,6 +608,7 @@ int cmd_unpack_objects(int argc, const char **argv, const char *prefix UNUSED)

608 {

609 int i;

610 struct object_id oid;

611 + git_hash_ctx tmp_ctx;

612

613 read_replace_refs = 0;

614

@@ -668,7 +669,9 @@ int cmd_unpack_objects(int argc, const char **argv, const char *prefix UNUSED)

669 the_hash_algo->init_fn(&ctx);

670 unpack_all();

671 the_hash_algo->update_fn(&ctx, buffer, offset);

671 - the_hash_algo->final_oid_fn(&oid, &ctx);

672 + the_hash_algo->init_fn(&tmp_ctx);

673 + the_hash_algo->clone_fn(&tmp_ctx, &ctx);

674 + the_hash_algo->final_oid_fn(&oid, &tmp_ctx);

675 if (strict) {

676 write_rest();

677 if (fsck_finish(&fsck_options))

bulk-checkin.c

@@ -270,6 +270,7 @@ static int deflate_to_pack(struct bulk_checkin_packfile *state,

270 type, size);

271 the_hash_algo->init_fn(&ctx);

272 the_hash_algo->update_fn(&ctx, obuf, header_len);

273 + the_hash_algo->init_fn(&checkpoint.ctx);

274

275 /* Note: idx is non-NULL when we are writing */

276 if ((flags & HASH_WRITE_OBJECT) != 0)

csum-file.c

+1 -1

@@ -208,7 +208,7 @@ int hashfile_truncate(struct hashfile *f, struct hashfile_checkpoint *checkpoint

208 lseek(f->fd, offset, SEEK_SET) != offset)

209 return -1;

210 f->total = offset;

211 - f->ctx = checkpoint->ctx;

211 + the_hash_algo->clone_fn(&f->ctx, &checkpoint->ctx);

212 f->offset = 0; /* hashflush() was called in checkpoint */

213 return 0;

214 }