From 4110a05684ac2e8c96093bfc1f912aab1325dec7 Mon Sep 17 00:00:00 2001 From: mikiubo Date: Mon, 23 Mar 2026 08:20:43 +0100 Subject: [PATCH] LibCrypto: Use OpenSSL wrappers in KMAC Use OpenSSL_MAC and OpenSSL_MAC_CTX wrappers together with OPENSSL_TRY to replace manual EVP_MAC resource management in KMAC::sign(). This eliminates manual EVP_MAC_free/EVP_MAC_CTX_free calls in every error path. --- Libraries/LibCrypto/Authentication/KMAC.cpp | 28 ++++----------------- Libraries/LibCrypto/OpenSSL.h | 8 ++++++ Libraries/LibCrypto/OpenSSLForward.h | 2 ++ 3 files changed, 15 insertions(+), 23 deletions(-) diff --git a/Libraries/LibCrypto/Authentication/KMAC.cpp b/Libraries/LibCrypto/Authentication/KMAC.cpp index d90b5edc9d..52c07cda28 100644 --- a/Libraries/LibCrypto/Authentication/KMAC.cpp +++ b/Libraries/LibCrypto/Authentication/KMAC.cpp @@ -48,14 +48,8 @@ ErrorOr KMAC::sign(ReadonlyBytes key, ReadonlyBytes message, u32 out auto const* mac_name = (m_kind == KMACKind::KMAC128) ? OSSL_MAC_NAME_KMAC128 : OSSL_MAC_NAME_KMAC256; - auto* mac = EVP_MAC_fetch(nullptr, mac_name, nullptr); - if (!mac) - return Error::from_string_literal("EVP_MAC_fetch failed for KMAC"); - - auto* ctx = EVP_MAC_CTX_new(mac); - EVP_MAC_free(mac); - if (!ctx) - return Error::from_string_literal("EVP_MAC_CTX_new failed"); + auto mac = TRY(OpenSSL_MAC::wrap(EVP_MAC_fetch(nullptr, mac_name, nullptr))); + auto ctx = TRY(OpenSSL_MAC_CTX::wrap(EVP_MAC_CTX_new(mac.ptr()))); size_t output_size = output_length_bits / 8; @@ -65,24 +59,12 @@ ErrorOr KMAC::sign(ReadonlyBytes key, ReadonlyBytes message, u32 out params.append(OSSL_PARAM_octet_string(OSSL_MAC_PARAM_CUSTOM, const_cast(customization.value().data()), customization.value().size())); params.append(OSSL_PARAM_END); - if (EVP_MAC_init(ctx, key.data(), key.size(), params.data()) != 1) { - EVP_MAC_CTX_free(ctx); - return Error::from_string_literal("EVP_MAC_init failed for KMAC"); - } - - if (EVP_MAC_update(ctx, message.data(), message.size()) != 1) { - EVP_MAC_CTX_free(ctx); - return Error::from_string_literal("EVP_MAC_update failed for KMAC"); - } + OPENSSL_TRY(EVP_MAC_init(ctx.ptr(), key.data(), key.size(), params.data())); + OPENSSL_TRY(EVP_MAC_update(ctx.ptr(), message.data(), message.size())); auto buf = TRY(ByteBuffer::create_uninitialized(output_size)); size_t written = 0; - if (EVP_MAC_final(ctx, buf.data(), &written, output_size) != 1) { - EVP_MAC_CTX_free(ctx); - return Error::from_string_literal("EVP_MAC_final failed for KMAC"); - } - - EVP_MAC_CTX_free(ctx); + OPENSSL_TRY(EVP_MAC_final(ctx.ptr(), buf.data(), &written, output_size)); if (written != output_size) return Error::from_string_literal("EVP_MAC_final returned an unexpected output length"); diff --git a/Libraries/LibCrypto/OpenSSL.h b/Libraries/LibCrypto/OpenSSL.h index cf9516ba22..da183d8097 100644 --- a/Libraries/LibCrypto/OpenSSL.h +++ b/Libraries/LibCrypto/OpenSSL.h @@ -100,6 +100,14 @@ class OpenSSL_PKEY_CTX { OPENSSL_WRAPPER_CLASS(OpenSSL_PKEY_CTX, EVP_PKEY_CTX, EVP_PKEY_CTX); }; +class OpenSSL_MAC { + OPENSSL_WRAPPER_CLASS(OpenSSL_MAC, EVP_MAC, EVP_MAC); +}; + +class OpenSSL_MAC_CTX { + OPENSSL_WRAPPER_CLASS(OpenSSL_MAC_CTX, EVP_MAC_CTX, EVP_MAC_CTX); +}; + class OpenSSL_MD_CTX { OPENSSL_WRAPPER_CLASS(OpenSSL_MD_CTX, EVP_MD_CTX, EVP_MD_CTX); diff --git a/Libraries/LibCrypto/OpenSSLForward.h b/Libraries/LibCrypto/OpenSSLForward.h index 4d15b9255e..2adfeddd33 100644 --- a/Libraries/LibCrypto/OpenSSLForward.h +++ b/Libraries/LibCrypto/OpenSSLForward.h @@ -34,5 +34,7 @@ void EVP_PKEY_CTX_free(EVP_PKEY_CTX*); void EVP_PKEY_free(EVP_PKEY*); void EVP_KDF_CTX_free(EVP_KDF_CTX* ctx); void EVP_KDF_free(EVP_KDF* kdf); +void EVP_MAC_CTX_free(EVP_MAC_CTX*); +void EVP_MAC_free(EVP_MAC*); void BN_free(BIGNUM*); }