← Back to branch summary

~ubuntu-branches/ubuntu/lucid/openssl/lucid-security

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2009-3245.patch

  • Committer: Bazaar Package Importer
  • Author(s): Marc Deslauriers
  • Date: 2010-03-30 08:57:51 UTC
  • Revision ID: james.westby@ubuntu.com-20100330085751-psie5ihdbr6ywffg
Tags: 0.9.8k-7ubuntu8
* SECURITY UPDATE: denial of service and possible arbitrary code
  execution via unchecked return values
  - debian/patches/CVE-2009-3245.patch: check bn_wexpand return value in
    crypto/bn/{bn_div.c,bn_gf2m.c,bn_mul.c}, crypto/ec/ec2_smpl.c,
    engines/e_ubsec.c.
  - CVE-2009-3245
* SECURITY UPDATE: denial of service via "record of death"
  - debian/patches/CVE-2010-0740.patch: only send back minor version
    number in ssl/s3_pkt.c.
  - CVE-2010-0740

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2009-3245.patch
 
1
Description: fix denial of service and possible arbitrary code
 
2
 execution via unchecked return values
 
3
Bug: http://rt.openssl.org/Ticket/Display.html?id=2111&user=guest&pass=guest
 
4
Origin: upstream, http://cvs.openssl.org/chngview?cn=18936
 
5
Origin: upstream, http://cvs.openssl.org/chngview?cn=19309
 
6
 
 
7
diff -Nur openssl-0.9.8k/crypto/bn/bn_div.c openssl-0.9.8k.new/crypto/bn/bn_div.c
 
8
--- openssl-0.9.8k/crypto/bn/bn_div.c   2008-09-14 09:42:40.000000000 -0400
 
9
+++ openssl-0.9.8k.new/crypto/bn/bn_div.c       2010-03-30 08:56:10.000000000 -0400
 
10
@@ -102,7 +102,7 @@
 
11
        /* The next 2 are needed so we can do a dv->d[0]|=1 later
 
12
         * since BN_lshift1 will only work once there is a value :-) */
 
13
        BN_zero(dv);
 
14
-       bn_wexpand(dv,1);
 
15
+       if(bn_wexpand(dv,1) == NULL) goto end;
 
16
        dv->top=1;
 
17
 
 
18
        if (!BN_lshift(D,D,nm-nd)) goto end;
 
19
diff -Nur openssl-0.9.8k/crypto/bn/bn_gf2m.c openssl-0.9.8k.new/crypto/bn/bn_gf2m.c
 
20
--- openssl-0.9.8k/crypto/bn/bn_gf2m.c  2008-06-23 16:46:28.000000000 -0400
 
21
+++ openssl-0.9.8k.new/crypto/bn/bn_gf2m.c      2010-03-30 08:56:10.000000000 -0400
 
22
@@ -294,7 +294,8 @@
 
23
        if (a->top < b->top) { at = b; bt = a; }
 
24
        else { at = a; bt = b; }
 
25
 
 
26
-       bn_wexpand(r, at->top);
 
27
+       if(bn_wexpand(r, at->top) == NULL)
 
28
+               return 0;
 
29
 
 
30
        for (i = 0; i < bt->top; i++)
 
31
                {
 
32
diff -Nur openssl-0.9.8k/crypto/bn/bn_mul.c openssl-0.9.8k.new/crypto/bn/bn_mul.c
 
33
--- openssl-0.9.8k/crypto/bn/bn_mul.c   2007-11-03 16:09:29.000000000 -0400
 
34
+++ openssl-0.9.8k.new/crypto/bn/bn_mul.c       2010-03-30 08:56:06.000000000 -0400
 
35
@@ -1030,15 +1030,15 @@
 
36
                        t = BN_CTX_get(ctx);
 
37
                        if (al > j || bl > j)
 
38
                                {
 
39
-                               bn_wexpand(t,k*4);
 
40
-                               bn_wexpand(rr,k*4);
 
41
+                               if (bn_wexpand(t,k*4) == NULL) goto err;
 
42
+                               if (bn_wexpand(rr,k*4) == NULL) goto err;
 
43
                                bn_mul_part_recursive(rr->d,a->d,b->d,
 
44
                                        j,al-j,bl-j,t->d);
 
45
                                }
 
46
                        else    /* al <= j || bl <= j */
 
47
                                {
 
48
-                               bn_wexpand(t,k*2);
 
49
-                               bn_wexpand(rr,k*2);
 
50
+                               if (bn_wexpand(t,k*2) == NULL) goto err;
 
51
+                               if (bn_wexpand(rr,k*2) == NULL) goto err;
 
52
                                bn_mul_recursive(rr->d,a->d,b->d,
 
53
                                        j,al-j,bl-j,t->d);
 
54
                                }
 
55
diff -Nur openssl-0.9.8k/crypto/ec/ec2_smpl.c openssl-0.9.8k.new/crypto/ec/ec2_smpl.c
 
56
--- openssl-0.9.8k/crypto/ec/ec2_smpl.c 2006-03-13 18:12:07.000000000 -0500
 
57
+++ openssl-0.9.8k.new/crypto/ec/ec2_smpl.c     2010-03-30 08:56:10.000000000 -0400
 
58
@@ -174,8 +174,10 @@
 
59
        dest->poly[2] = src->poly[2];
 
60
        dest->poly[3] = src->poly[3];
 
61
        dest->poly[4] = src->poly[4];
 
62
-       bn_wexpand(&dest->a, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2);
 
63
-       bn_wexpand(&dest->b, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2);
 
64
+       if(bn_wexpand(&dest->a, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL)
 
65
+               return 0;
 
66
+       if(bn_wexpand(&dest->b, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL)
 
67
+               return 0;
 
68
        for (i = dest->a.top; i < dest->a.dmax; i++) dest->a.d[i] = 0;
 
69
        for (i = dest->b.top; i < dest->b.dmax; i++) dest->b.d[i] = 0;
 
70
        return 1;
 
71
@@ -199,12 +201,12 @@
 
72
 
 
73
        /* group->a */
 
74
        if (!BN_GF2m_mod_arr(&group->a, a, group->poly)) goto err;
 
75
-       bn_wexpand(&group->a, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2);
 
76
+       if(bn_wexpand(&group->a, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) goto err;
 
77
        for (i = group->a.top; i < group->a.dmax; i++) group->a.d[i] = 0;
 
78
        
 
79
        /* group->b */
 
80
        if (!BN_GF2m_mod_arr(&group->b, b, group->poly)) goto err;
 
81
-       bn_wexpand(&group->b, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2);
 
82
+       if(bn_wexpand(&group->b, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) goto err;
 
83
        for (i = group->b.top; i < group->b.dmax; i++) group->b.d[i] = 0;
 
84
                
 
85
        ret = 1;
 
86
diff -Nur openssl-0.9.8k/engines/e_ubsec.c openssl-0.9.8k.new/engines/e_ubsec.c
 
87
--- openssl-0.9.8k/engines/e_ubsec.c    2007-09-06 08:43:53.000000000 -0400
 
88
+++ openssl-0.9.8k.new/engines/e_ubsec.c        2010-03-30 08:56:10.000000000 -0400
 
89
@@ -934,7 +934,7 @@
 
90
                 priv_key = BN_new();
 
91
                 if (priv_key == NULL) goto err;
 
92
                 priv_key_len = BN_num_bits(dh->p);
 
93
-                bn_wexpand(priv_key, dh->p->top);
 
94
+                if(bn_wexpand(priv_key, dh->p->top) == NULL) goto err;
 
95
                 do
 
96
                         if (!BN_rand_range(priv_key, dh->p)) goto err;
 
97
                 while (BN_is_zero(priv_key));
 
98
@@ -949,7 +949,7 @@
 
99
                 {
 
100
                 pub_key = BN_new();
 
101
                 pub_key_len = BN_num_bits(dh->p);
 
102
-                bn_wexpand(pub_key, dh->p->top);
 
103
+                if(bn_wexpand(pub_key, dh->p->top) == NULL) goto err;
 
104
                 if(pub_key == NULL) goto err;
 
105
                 }
 
106
         else