title: Blowfish CBC mode and Buffer Overrun in C
body: <p>I am trying to use the OpenSSL library to encrypt and decrypt a string using the CBC block mode of Blowfish.  For platform reasons this needs to be done in straight-C rather than C++.  For some reason when the input string is longer than 8 characters (1 block), the size of the output increases dramatically.  </p>
  
  <p>For example: encrypting abcdefgh will generate an output 8 chars in length - all is good.  However, encrypting abcdefgha will generate an output 699 chars long!</p>
  
  <p>Am I doing something fundamentally wrong with this library?  It was my understanding that the output from Blowfish should be the same size as the input.  Can anyone explain what I'm doing wrong with this?  If this is correct, how can I tell how big to create the output buffer as this code overruns it when the input is over 1 block.</p>
  
  <p>Code sample below:</p>
  
  <pre><code>#include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  #include &lt;openssl/blowfish.h&gt;
  const unsigned char* BLOWFISH_KEY = "TestKey!";
  #define SIZE 8
  
  unsigned char* blowfish_decrypt(unsigned char* in);
  unsigned char* blowfish_encrypt(unsigned char* in);
  
  int main(){
  
      char* message   = "abcdefgha";
  
      char* encrypted = blowfish_encrypt(message);
      printf("Encrypted: %s\n", encrypted);
      printf("Size of encrypted: %d\n\n", strlen(encrypted));
  
      char* decrypted = blowfish_decrypt(encrypted);
      printf("Decrypt: %s\n", decrypted);
      printf("Size of encrypted: %d\n\n", strlen(encrypted));
      return 0;
  
  }
  
  unsigned char* blowfish_encrypt(unsigned char* in){
  
    int i;
    int SIZE_IN = strlen(in);
    unsigned char *out = calloc(SIZE_IN+1, sizeof(char));
  
    char ivec[8];
    for(i=0; i&lt;8; i++) ivec[i] = 'i';
  
    BF_KEY *key = calloc(1, sizeof(BF_KEY));
  
    /* set up a test key */
    BF_set_key(key, SIZE, BLOWFISH_KEY );
  
    BF_cbc_encrypt(in, out, strlen(in), key, ivec, BF_ENCRYPT);
  
    printf("Size of out: %d\n", strlen(out));
    printf("Size of in: %d\n", strlen(in));
    return out;
  }
  
  unsigned char* blowfish_decrypt(unsigned char* in){
  
    int i;
    int SIZE_IN = strlen(in);
    unsigned char *out = calloc(SIZE_IN+1, sizeof(char));
  
    char ivec[8];
    for(i=0; i&lt;8; i++) ivec[i] = 'i';
  
    BF_KEY *key = calloc(1, sizeof(BF_KEY));
  
    /* set up a test key */
    BF_set_key(key, SIZE, BLOWFISH_KEY );
  
    BF_cbc_encrypt(in, out, strlen(in), key, ivec, BF_DECRYPT);
  
    printf("Size of out: %d\n", strlen(out));
    printf("Size of in: %d\n", strlen(in));
    return out;
  }
  </code></pre>