From 3914106b613ad4f5f27a2d1b3fc8fc2efb41dec6 Mon Sep 17 00:00:00 2001

From: Alex Gaynor <alex.gaynor@gmail.com>

Date: Tue, 31 Jan 2023 08:33:54 -0500

Subject: [PATCH] Don't allow update_into to mutate immutable objects

---

 src/cryptography/hazmat/backends/openssl/ciphers.py | 2 +-

 tests/hazmat/primitives/test_ciphers.py             | 8 ++++++++

 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py

index 1058de9..17abd3a 100644

--- a/src/cryptography/hazmat/backends/openssl/ciphers.py

+++ b/src/cryptography/hazmat/backends/openssl/ciphers.py

@@ -157,7 +157,7 @@ class _CipherContext:

         data_processed = 0

         total_out = 0

         outlen = self._backend._ffi.new("int *")

-        baseoutbuf = self._backend._ffi.from_buffer(buf)

+        baseoutbuf = self._backend._ffi.from_buffer(buf, require_writable=True)

         baseinbuf = self._backend._ffi.from_buffer(data)

         while data_processed != total_data_len:

diff --git a/tests/hazmat/primitives/test_ciphers.py b/tests/hazmat/primitives/test_ciphers.py

index 02127dd..bf3b047 100644

--- a/tests/hazmat/primitives/test_ciphers.py

+++ b/tests/hazmat/primitives/test_ciphers.py

@@ -318,6 +318,14 @@ class TestCipherUpdateInto:

         with pytest.raises(ValueError):

             encryptor.update_into(b"testing", buf)

+    def test_update_into_immutable(self, backend):

+        key = b"\x00" * 16

+        c = ciphers.Cipher(AES(key), modes.ECB(), backend)

+        encryptor = c.encryptor()

+        buf = b"\x00" * 32

+        with pytest.raises((TypeError, BufferError)):

+            encryptor.update_into(b"testing", buf)

+

     @pytest.mark.supported(

         only_if=lambda backend: backend.cipher_supported(

             AES(b"\x00" * 16), modes.GCM(b"\x00" * 12)

-- 

2.39.1