From 1fbdf809f9b510225852a64ac29d9df4e6417527 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Fri, 7 Mar 2014 08:45:42 -0400 Subject: ridiculous workaround time --- cryptography/hazmat/backends/openssl/backend.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py index f05ee3d6..755e476b 100644 --- a/cryptography/hazmat/backends/openssl/backend.py +++ b/cryptography/hazmat/backends/openssl/backend.py @@ -438,6 +438,15 @@ class _CipherContext(object): self._ctx = ctx def update(self, data): + # OpenSSL 0.9.8e has an assertion in its EVP code that causes it + # to SIGABRT if you call update with an empty byte string. This can be + # removed when we drop support for 0.9.8e (CentOS/RHEL 5). This branch + # should be taken only when length is zero and mode is not GCM because + # AES GCM can return improper tag values if you don't call update + # with empty plaintext when authenticating AAD for ...reasons. + if not len(data) and not isinstance(self._mode, GCM): + return b"" + buf = self._backend._ffi.new("unsigned char[]", len(data) + self._block_size - 1) outlen = self._backend._ffi.new("int *") -- cgit v1.2.3