Reject GCM IV lengths below 8 in EVP_CTRL_GCM_IV_GEN

[dougch]

Description of changes

EVP_CTRL_AEAD_SET_IVLEN accepts any positive int, so a caller can set gctx->ivlen to 1..7. EVP_CTRL_GCM_IV_GEN then computes the invocation counter pointer as gctx->iv + gctx->ivlen - 8, which underflows for ivlen < 8. The subsequent 8-byte CRYPTO_load_u64_be / CRYPTO_store_u64_be touch memory before gctx->iv — into the preceding oiv[16] member of EVP_CIPHER_CTX.

No code pointers are affected. The impact is IV/nonce state confusion: the "generated" IV returned to the caller contains bytes read from oiv[], and the increment writes back into oiv[]. Subsequent GCM operations on the same ctx can produce predictable or attacker-influenced IV state, which under GCM breaks confidentiality and authenticity.

Reachable from any caller that lets attacker-influenced input drive EVP_CTRL_AEAD_SET_IVLEN. Not directly reachable through standard TLS 1.2 AES-GCM ciphersuites (12-byte IVs on the send path are hardcoded), but any consumer that plumbs IV-length parameters end-to-end (bindings, custom AEAD frameworks, PKI tools) is exposed.

Call-outs

Extends the entry guard on EVP_CTRL_GCM_IV_GEN to reject ivlen < 8. Mirrors BoringSSL's fix in e2a57cfb (Change-Id Ia9c87e42c43a0dcf6ed9e51621d7484d6a6a6964), merged 2026-05-20. Also matches the test shape upstream added to SetIVLengthResets, adapted to aws-lc's existing GCMIncrementingIV test.

Not applying the corresponding defense-in-depth check at EVP_CTRL_AEAD_SET_IVLEN: that would change behavior for callers that use short IVs on the SET_IV_FIXED / decrypt path without invoking IV_GEN. Matching upstream's narrower fix is the right call.

Testing

Added CipherTest.GCMIncrementingIV sub-block that sets SET_IVLEN=7, primes with SET_IV_FIXED(-1), and verifies EVP_CTRL_GCM_IV_GEN returns 0. Verified locally:

• Test fails without the fix (confirms the guard is what catches the bug, not incidental behavior).
• Test passes with the fix.
• Full CipherTest suite passes (21 tests).

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.24%. Comparing base (0a34e4b) to head (1dbfd0e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3424   +/-   ##
=======================================
  Coverage   78.23%   78.24%           
=======================================
  Files         698      698           
  Lines      124580   124590   +10     
  Branches    17285    17287    +2     
=======================================
+ Hits        97471    97488   +17     
+ Misses      26184    26177    -7     
  Partials      925      925           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.