Merge pull request #141 from reaperhulk/block-cipher-buffer-sizing

Fix Block cipher buffer sizing

3 files changed, 15 insertions, 3 deletions

diff --git a/cryptography/bindings/openssl/api.py b/cryptography/bindings/openssl/api.py
index 35be19c7..3c2cf2e2 100644
--- a/cryptography/bindings/openssl/api.py
+++ b/cryptography/bindings/openssl/api.py
@@ -128,7 +128,8 @@ class API(object):
         return ctx
 
     def update_encrypt_context(self, ctx, plaintext):
-        buf = self.ffi.new("unsigned char[]", len(plaintext))
+        block_size = self.lib.EVP_CIPHER_CTX_block_size(ctx)
+        buf = self.ffi.new("unsigned char[]", len(plaintext) + block_size - 1)
         outlen = self.ffi.new("int *")
         res = self.lib.EVP_EncryptUpdate(
             ctx, buf, outlen, plaintext, len(plaintext)
@@ -137,8 +138,7 @@ class API(object):
         return self.ffi.buffer(buf)[:outlen[0]]
 
     def finalize_encrypt_context(self, ctx):
-        cipher = self.lib.EVP_CIPHER_CTX_cipher(ctx)
-        block_size = self.lib.EVP_CIPHER_block_size(cipher)
+        block_size = self.lib.EVP_CIPHER_CTX_block_size(ctx)
         buf = self.ffi.new("unsigned char[]", block_size)
         outlen = self.ffi.new("int *")
         res = self.lib.EVP_EncryptFinal_ex(ctx, buf, outlen)
diff --git a/cryptography/bindings/openssl/evp.py b/cryptography/bindings/openssl/evp.py
index 2b7b0f4c..20159906 100644
--- a/cryptography/bindings/openssl/evp.py
+++ b/cryptography/bindings/openssl/evp.py
@@ -76,4 +76,5 @@ int EVP_VerifyFinal(EVP_MD_CTX *, const unsigned char *, unsigned int,
 MACROS = """
 int EVP_PKEY_assign_RSA(EVP_PKEY *, RSA *);
 int EVP_PKEY_assign_DSA(EVP_PKEY *, DSA *);
+int EVP_CIPHER_CTX_block_size(const EVP_CIPHER_CTX *);
 """
diff --git a/tests/primitives/test_block.py b/tests/primitives/test_block.py
index f4d3f467..9f5905bf 100644
--- a/tests/primitives/test_block.py
+++ b/tests/primitives/test_block.py
@@ -63,3 +63,14 @@ class TestBlockCipher(object):
 
         with pytest.raises(ValueError):
             cipher.finalize()
+
+    def test_unaligned_block_encryption(self, api):
+        cipher = BlockCipher(
+            ciphers.AES(binascii.unhexlify(b"0" * 32)),
+            modes.ECB(),
+            api
+        )
+        ct = cipher.encrypt(b"a" * 15)
+        assert ct == b""
+        ct += cipher.encrypt(b"a" * 65)
+        assert len(ct) == 80