From: Michael Paquier <michael@paquier.xyz>
Date: Tue, 1 Jan 2019 01:39:29 +0000 (+0900)
Subject: Fix generation of padding message before encrypting Elgamal in pgcrypto
X-Git-Tag: REL_11_2~93
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2882bab920a41186ed9ec719947b1e730fd335a8;p=postgresql

Fix generation of padding message before encrypting Elgamal in pgcrypto

fe0a0b5, which has added a stronger random source in Postgres, has
introduced a thinko when creating a padding message which gets encrypted
for Elgamal.  The padding message cannot have zeros, which are replaced
by random bytes.  However if pg_strong_random() failed, the message
would finish by being considered in correct shape for encryption with
zeros.

Author: Tom Lane
Reviewed-by: Michael Paquier
Discussion: https://postgr.es/m/20186.1546188423@sss.pgh.pa.us
Backpatch-through: 10
---

diff --git a/contrib/pgcrypto/pgp-pubenc.c b/contrib/pgcrypto/pgp-pubenc.c
index 4439876664..e4ff832f90 100644
--- a/contrib/pgcrypto/pgp-pubenc.c
+++ b/contrib/pgcrypto/pgp-pubenc.c
@@ -66,7 +66,7 @@ pad_eme_pkcs1_v15(uint8 *data, int data_len, int res_len, uint8 **res_p)
 			{
 				px_memset(buf, 0, res_len);
 				px_free(buf);
-				break;
+				return PXE_NO_RANDOM;
 			}
 		}
 		if (*p != 0)