Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix crash in openssl (I suspect caused by malformed packets):

Browse Source 
handshake_dgst[] may be used without being allocated, causing NULL
pointer dereference.
Fix by checking that handshake_dgst is not NULL before use.
Reported to openssl as ticket openssl.org #2214.
Fix tested on netbsd-5 by Luke Mewburn with apache, and by me with
freeradius (fixing segmentation fault in both cases).
This commit is contained in:
bouyer 2010-04-09 04:34:13 +00:00
parent 6a306d5969
commit 769c627b01
3 changed files with 26 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/external/bsd/openssl/dist/ssl/s3_enc.c vendored
View File

@ -578,7 +578,7 @@ void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
{
BIO_write (s->s3->handshake_buffer,(void *)buf,len);
}
else
else if (s->s3->handshake_dgst != NULL)
{
int i;
for (i=0;i< SSL_MAX_DIGEST;i++)

28
crypto/external/bsd/openssl/dist/ssl/s3_srvr.c vendored
View File

@ -537,20 +537,22 @@ int ssl3_accept(SSL *s)
if (s->s3->handshake_buffer)
if (!ssl3_digest_cached_records(s))
return -1;
for (dgst_num=0; dgst_num<SSL_MAX_DIGEST;dgst_num++)
if (s->s3->handshake_dgst[dgst_num])
{
int dgst_size;
s->method->ssl3_enc->cert_verify_mac(s,EVP_MD_CTX_type(s->s3->handshake_dgst[dgst_num]),&(s->s3->tmp.cert_verify_md[offset]));
dgst_size=EVP_MD_CTX_size(s->s3->handshake_dgst[dgst_num]);
if (dgst_size < 0)
if (s->s3->handshake_dgst != NULL) {
for (dgst_num=0; dgst_num<SSL_MAX_DIGEST;dgst_num++)
if (s->s3->handshake_dgst[dgst_num])
{
ret = -1;
goto end;
}
offset+=dgst_size;
}
int dgst_size;
s->method->ssl3_enc->cert_verify_mac(s,EVP_MD_CTX_type(s->s3->handshake_dgst[dgst_num]),&(s->s3->tmp.cert_verify_md[offset]));
dgst_size=EVP_MD_CTX_size(s->s3->handshake_dgst[dgst_num]);
if (dgst_size < 0)
{
ret = -1;
goto end;
}
offset+=dgst_size;
}
}
}
break;

18
crypto/external/bsd/openssl/dist/ssl/t1_enc.c vendored
View File

@ -788,14 +788,16 @@ int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out)
if (!ssl3_digest_cached_records(s))
return 0;
for (i=0;i<SSL_MAX_DIGEST;i++)
{
if (s->s3->handshake_dgst[i]&&EVP_MD_CTX_type(s->s3->handshake_dgst[i])==md_nid)
{
d=s->s3->handshake_dgst[i];
break;
if (s->s3->handshake_dgst) {
for (i=0;i<SSL_MAX_DIGEST;i++)
{
if (s->s3->handshake_dgst[i]&&EVP_MD_CTX_type(s->s3->handshake_dgst[i])==md_nid)
{
d=s->s3->handshake_dgst[i];
break;
}
}
}
}
if (!d) {
SSLerr(SSL_F_TLS1_CERT_VERIFY_MAC,SSL_R_NO_REQUIRED_DIGEST);
return 0;
@ -833,7 +835,7 @@ int tls1_final_finish_mac(SSL *s,
if (mask & s->s3->tmp.new_cipher->algorithm2)
{
int hashsize = EVP_MD_size(md);
if (hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf)))
if (hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf)) || s->s3->handshake_dgst == NULL)
{
/* internal error: 'buf' is too small for this cipersuite! */
err = 1;