From d179dc80a5b13189c79fe4531eacb28698a7a0e9 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sun, 27 Jul 2025 18:57:04 +0200 Subject: [PATCH] Use mbedtls_psa_cipher_finish() in PSA Signed-off-by: Gilles Peskine --- library/psa_crypto_cipher.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/library/psa_crypto_cipher.c b/library/psa_crypto_cipher.c index efc5813ff0..4443d73ba4 100644 --- a/library/psa_crypto_cipher.c +++ b/library/psa_crypto_cipher.c @@ -552,6 +552,7 @@ psa_status_t mbedtls_psa_cipher_finish( { psa_status_t status = PSA_ERROR_GENERIC_ERROR; uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH]; + size_t invalid_padding = 0; if (operation->ctx.cipher.unprocessed_len != 0) { if (operation->alg == PSA_ALG_ECB_NO_PADDING || @@ -562,9 +563,10 @@ psa_status_t mbedtls_psa_cipher_finish( } status = mbedtls_to_psa_error( - mbedtls_cipher_finish(&operation->ctx.cipher, - temp_output_buffer, - output_length)); + mbedtls_cipher_finish_padded(&operation->ctx.cipher, + temp_output_buffer, + output_length, + &invalid_padding)); if (status != PSA_SUCCESS) { goto exit; } @@ -581,6 +583,9 @@ exit: mbedtls_platform_zeroize(temp_output_buffer, sizeof(temp_output_buffer)); + if (status == PSA_SUCCESS && invalid_padding) { + status = PSA_ERROR_INVALID_PADDING; + } return status; }