From 882d9cb5c8d37d93f9b349d517e59bf496817007 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Fri, 15 Dec 2023 12:55:27 +0100
Subject: [PATCH 2/5] CVE-2023-6918: Remove unused evp functions and types

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>

Conflict: NA
Reference:https://gitlab.com/libssh/libssh-mirror/-/commit/882d9cb5c8d37d93f9b349d517e59bf496817007
---
 include/libssh/libcrypto.h     |  5 ---
 include/libssh/libgcrypt.h     |  1 -
 include/libssh/libmbedcrypto.h |  1 -
 include/libssh/wrapper.h       |  5 ---
 src/libcrypto.c                | 55 +------------------------
 src/libgcrypt.c                | 52 ------------------------
 src/libmbedcrypto.c            | 74 ----------------------------------
 7 files changed, 1 insertion(+), 192 deletions(-)

diff --git a/include/libssh/libcrypto.h b/include/libssh/libcrypto.h
index 4117942c..35b277c5 100644
--- a/include/libssh/libcrypto.h
+++ b/include/libssh/libcrypto.h
@@ -39,11 +39,6 @@ typedef EVP_MD_CTX* SHA384CTX;
 typedef EVP_MD_CTX* SHA512CTX;
 typedef EVP_MD_CTX* MD5CTX;
 typedef HMAC_CTX* HMACCTX;
-#ifdef HAVE_ECC
-typedef EVP_MD_CTX *EVPCTX;
-#else
-typedef void *EVPCTX;
-#endif
 
 #define SHA_DIGEST_LEN SHA_DIGEST_LENGTH
 #define SHA256_DIGEST_LEN SHA256_DIGEST_LENGTH
diff --git a/include/libssh/libgcrypt.h b/include/libssh/libgcrypt.h
index 347d851b..3a803fa4 100644
--- a/include/libssh/libgcrypt.h
+++ b/include/libssh/libgcrypt.h
@@ -32,7 +32,6 @@ typedef gcry_md_hd_t SHA384CTX;
 typedef gcry_md_hd_t SHA512CTX;
 typedef gcry_md_hd_t MD5CTX;
 typedef gcry_md_hd_t HMACCTX;
-typedef gcry_md_hd_t EVPCTX;
 #define SHA_DIGEST_LENGTH 20
 #define SHA_DIGEST_LEN SHA_DIGEST_LENGTH
 #define MD5_DIGEST_LEN 16
diff --git a/include/libssh/libmbedcrypto.h b/include/libssh/libmbedcrypto.h
index fe53019b..b6e3e2a3 100644
--- a/include/libssh/libmbedcrypto.h
+++ b/include/libssh/libmbedcrypto.h
@@ -41,7 +41,6 @@ typedef mbedtls_md_context_t *SHA384CTX;
 typedef mbedtls_md_context_t *SHA512CTX;
 typedef mbedtls_md_context_t *MD5CTX;
 typedef mbedtls_md_context_t *HMACCTX;
-typedef mbedtls_md_context_t *EVPCTX;
 
 #define SHA_DIGEST_LENGTH 20
 #define SHA_DIGEST_LEN SHA_DIGEST_LENGTH
diff --git a/include/libssh/wrapper.h b/include/libssh/wrapper.h
index ba64939b..2f5ce189 100644
--- a/include/libssh/wrapper.h
+++ b/include/libssh/wrapper.h
@@ -90,11 +90,6 @@ void sha512_update(SHA512CTX c, const void *data, unsigned long len);
 void sha512_final(unsigned char *md,SHA512CTX c);
 void sha512(const unsigned char *digest, int len, unsigned char *hash);
 
-void evp(int nid, unsigned char *digest, int len, unsigned char *hash, unsigned int *hlen);
-EVPCTX evp_init(int nid);
-void evp_update(EVPCTX ctx, const void *data, unsigned long len);
-void evp_final(EVPCTX ctx, unsigned char *md, unsigned int *mdlen);
-
 HMACCTX hmac_init(const void *key,int len, enum ssh_hmac_e type);
 void hmac_update(HMACCTX c, const void *data, unsigned long len);
 void hmac_final(HMACCTX ctx,unsigned char *hashmacbuf,unsigned int *len);
diff --git a/src/libcrypto.c b/src/libcrypto.c
index 3db75df6..5f3917ba 100644
--- a/src/libcrypto.c
+++ b/src/libcrypto.c
@@ -148,60 +148,6 @@ void sha1(const unsigned char *digest, int len, unsigned char *hash)
     }
 }
 
-#ifdef HAVE_OPENSSL_ECC
-static const EVP_MD *nid_to_evpmd(int nid)
-{
-    switch (nid) {
-        case NID_X9_62_prime256v1:
-            return EVP_sha256();
-        case NID_secp384r1:
-            return EVP_sha384();
-        case NID_secp521r1:
-            return EVP_sha512();
-        default:
-            return NULL;
-    }
-
-    return NULL;
-}
-
-void evp(int nid, unsigned char *digest, int len, unsigned char *hash, unsigned int *hlen)
-{
-    const EVP_MD *evp_md = nid_to_evpmd(nid);
-    EVP_MD_CTX *md = EVP_MD_CTX_new();
-
-    EVP_DigestInit(md, evp_md);
-    EVP_DigestUpdate(md, digest, len);
-    EVP_DigestFinal(md, hash, hlen);
-    EVP_MD_CTX_free(md);
-}
-
-EVPCTX evp_init(int nid)
-{
-    const EVP_MD *evp_md = nid_to_evpmd(nid);
-
-    EVPCTX ctx = EVP_MD_CTX_new();
-    if (ctx == NULL) {
-        return NULL;
-    }
-
-    EVP_DigestInit(ctx, evp_md);
-
-    return ctx;
-}
-
-void evp_update(EVPCTX ctx, const void *data, unsigned long len)
-{
-    EVP_DigestUpdate(ctx, data, len);
-}
-
-void evp_final(EVPCTX ctx, unsigned char *md, unsigned int *mdlen)
-{
-    EVP_DigestFinal(ctx, md, mdlen);
-    EVP_MD_CTX_free(ctx);
-}
-#endif
-
 SHA256CTX sha256_init(void)
 {
     int rc;
@@ -345,6 +291,7 @@ void md5_final(unsigned char *md, MD5CTX c)
     EVP_MD_CTX_destroy(c);
 }
 
+
 #ifdef HAVE_OPENSSL_EVP_KDF_CTX_NEW_ID
 static const EVP_MD *sshkdf_digest_to_md(enum ssh_kdf_digest digest_type)
 {
diff --git a/src/libgcrypt.c b/src/libgcrypt.c
index 8fbf2157..49488793 100644
--- a/src/libgcrypt.c
+++ b/src/libgcrypt.c
@@ -82,58 +82,6 @@ void sha1(const unsigned char *digest, int len, unsigned char *hash) {
   gcry_md_hash_buffer(GCRY_MD_SHA1, hash, digest, len);
 }
 
-#ifdef HAVE_GCRYPT_ECC
-static int nid_to_md_algo(int nid)
-{
-    switch (nid) {
-    case NID_gcrypt_nistp256:
-        return GCRY_MD_SHA256;
-    case NID_gcrypt_nistp384:
-        return GCRY_MD_SHA384;
-    case NID_gcrypt_nistp521:
-        return GCRY_MD_SHA512;
-    }
-    return GCRY_MD_NONE;
-}
-
-void evp(int nid, unsigned char *digest, int len,
-         unsigned char *hash, unsigned int *hlen)
-{
-    int algo = nid_to_md_algo(nid);
-
-    /* Note: What gcrypt calls 'hash' is called 'digest' here and
-       vice-versa.  */
-    gcry_md_hash_buffer(algo, hash, digest, len);
-    *hlen = gcry_md_get_algo_dlen(algo);
-}
-
-EVPCTX evp_init(int nid)
-{
-    gcry_error_t err;
-    int algo = nid_to_md_algo(nid);
-    EVPCTX ctx;
-
-    err = gcry_md_open(&ctx, algo, 0);
-    if (err) {
-        return NULL;
-    }
-
-    return ctx;
-}
-
-void evp_update(EVPCTX ctx, const void *data, unsigned long len)
-{
-    gcry_md_write(ctx, data, len);
-}
-
-void evp_final(EVPCTX ctx, unsigned char *md, unsigned int *mdlen)
-{
-    int algo = gcry_md_get_algo(ctx);
-    *mdlen = gcry_md_get_algo_dlen(algo);
-    memcpy(md, gcry_md_read(ctx, algo), *mdlen);
-    gcry_md_close(ctx);
-}
-#endif
 
 SHA256CTX sha256_init(void) {
   SHA256CTX ctx = NULL;
diff --git a/src/libmbedcrypto.c b/src/libmbedcrypto.c
index a2e74d3b..f37a6a6d 100644
--- a/src/libmbedcrypto.c
+++ b/src/libmbedcrypto.c
@@ -103,80 +103,6 @@ void sha1(const unsigned char *digest, int len, unsigned char *hash)
     }
 }
 
-static mbedtls_md_type_t nid_to_md_algo(int nid)
-{
-    switch (nid) {
-        case NID_mbedtls_nistp256:
-            return MBEDTLS_MD_SHA256;
-        case NID_mbedtls_nistp384:
-            return MBEDTLS_MD_SHA384;
-        case NID_mbedtls_nistp521:
-            return MBEDTLS_MD_SHA512;
-    }
-    return MBEDTLS_MD_NONE;
-}
-
-void evp(int nid, unsigned char *digest, int len,
-        unsigned char *hash, unsigned int *hlen)
-{
-    mbedtls_md_type_t algo = nid_to_md_algo(nid);
-    const mbedtls_md_info_t *md_info =
-        mbedtls_md_info_from_type(algo);
-
-
-    if (md_info != NULL) {
-        *hlen = mbedtls_md_get_size(md_info);
-        mbedtls_md(md_info, digest, len, hash);
-    }
-}
-
-EVPCTX evp_init(int nid)
-{
-    EVPCTX ctx = NULL;
-    int rc;
-    mbedtls_md_type_t algo = nid_to_md_algo(nid);
-    const mbedtls_md_info_t *md_info =
-        mbedtls_md_info_from_type(algo);
-
-    if (md_info == NULL) {
-        return NULL;
-    }
-
-    ctx = malloc(sizeof(mbedtls_md_context_t));
-    if (ctx == NULL) {
-        return NULL;
-    }
-
-    mbedtls_md_init(ctx);
-
-    rc = mbedtls_md_setup(ctx, md_info, 0);
-    if (rc != 0) {
-        SAFE_FREE(ctx);
-        return NULL;
-    }
-
-    rc = mbedtls_md_starts(ctx);
-    if (rc != 0) {
-        SAFE_FREE(ctx);
-        return NULL;
-    }
-
-    return ctx;
-}
-
-void evp_update(EVPCTX ctx, const void *data, unsigned long len)
-{
-    mbedtls_md_update(ctx, data, len);
-}
-
-void evp_final(EVPCTX ctx, unsigned char *md, unsigned int *mdlen)
-{
-    *mdlen = mbedtls_md_get_size(ctx->md_info);
-    mbedtls_md_finish(ctx, md);
-    mbedtls_md_free(ctx);
-    SAFE_FREE(ctx);
-}
-
 SHA256CTX sha256_init(void)
 {
     SHA256CTX ctx = NULL;
-- 
2.33.0

