Module Name: src
Committed By: drochner
Date: Thu Jan 5 18:59:53 UTC 2012
Modified Files:
src/crypto/external/bsd/openssl/dist/crypto/x509: x509_vfy.c
src/crypto/external/bsd/openssl/dist/ssl: d1_srvr.c s3_lib.c s3_srvr.c
Log Message:
also pull in patches for older security problems (secadv_20110906.txt):
-rev.21358 for CRL verification vulnerability in OpenSSL (CVE-2011-3207)
-rev.21336 for TLS ephemeral ECDH crashes in OpenSSL (CVE-2011-3210)
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.3 -r1.2 \
src/crypto/external/bsd/openssl/dist/crypto/x509/x509_vfy.c
cvs rdiff -u -r1.1.1.3 -r1.2 \
src/crypto/external/bsd/openssl/dist/ssl/d1_srvr.c
cvs rdiff -u -r1.6 -r1.7 src/crypto/external/bsd/openssl/dist/ssl/s3_lib.c
cvs rdiff -u -r1.9 -r1.10 src/crypto/external/bsd/openssl/dist/ssl/s3_srvr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/crypto/external/bsd/openssl/dist/crypto/x509/x509_vfy.c
diff -u src/crypto/external/bsd/openssl/dist/crypto/x509/x509_vfy.c:1.1.1.3 src/crypto/external/bsd/openssl/dist/crypto/x509/x509_vfy.c:1.2
--- src/crypto/external/bsd/openssl/dist/crypto/x509/x509_vfy.c:1.1.1.3 Sun Jun 5 14:59:58 2011
+++ src/crypto/external/bsd/openssl/dist/crypto/x509/x509_vfy.c Thu Jan 5 18:59:51 2012
@@ -703,6 +703,7 @@ static int check_cert(X509_STORE_CTX *ct
x = sk_X509_value(ctx->chain, cnum);
ctx->current_cert = x;
ctx->current_issuer = NULL;
+ ctx->current_crl_score = 0;
ctx->current_reasons = 0;
while (ctx->current_reasons != CRLDP_ALL_REASONS)
{
@@ -2015,6 +2016,9 @@ int X509_STORE_CTX_init(X509_STORE_CTX *
ctx->error_depth=0;
ctx->current_cert=NULL;
ctx->current_issuer=NULL;
+ ctx->current_crl=NULL;
+ ctx->current_crl_score=0;
+ ctx->current_reasons=0;
ctx->tree = NULL;
ctx->parent = NULL;
Index: src/crypto/external/bsd/openssl/dist/ssl/d1_srvr.c
diff -u src/crypto/external/bsd/openssl/dist/ssl/d1_srvr.c:1.1.1.3 src/crypto/external/bsd/openssl/dist/ssl/d1_srvr.c:1.2
--- src/crypto/external/bsd/openssl/dist/ssl/d1_srvr.c:1.1.1.3 Sun Jun 5 15:00:33 2011
+++ src/crypto/external/bsd/openssl/dist/ssl/d1_srvr.c Thu Jan 5 18:59:53 2012
@@ -1024,12 +1024,11 @@ int dtls1_send_server_key_exchange(SSL *
SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
goto err;
}
- if (!EC_KEY_up_ref(ecdhp))
+ if ((ecdh = EC_KEY_dup(ecdhp)) == NULL)
{
SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
goto err;
}
- ecdh = ecdhp;
s->s3->tmp.ecdh=ecdh;
if ((EC_KEY_get0_public_key(ecdh) == NULL) ||
Index: src/crypto/external/bsd/openssl/dist/ssl/s3_lib.c
diff -u src/crypto/external/bsd/openssl/dist/ssl/s3_lib.c:1.6 src/crypto/external/bsd/openssl/dist/ssl/s3_lib.c:1.7
--- src/crypto/external/bsd/openssl/dist/ssl/s3_lib.c:1.6 Thu Jul 7 18:11:18 2011
+++ src/crypto/external/bsd/openssl/dist/ssl/s3_lib.c Thu Jan 5 18:59:53 2012
@@ -2563,11 +2563,17 @@ void ssl3_clear(SSL *s)
}
#ifndef OPENSSL_NO_DH
if (s->s3->tmp.dh != NULL)
+ {
DH_free(s->s3->tmp.dh);
+ s->s3->tmp.dh = NULL;
+ }
#endif
#ifndef OPENSSL_NO_ECDH
if (s->s3->tmp.ecdh != NULL)
+ {
EC_KEY_free(s->s3->tmp.ecdh);
+ s->s3->tmp.ecdh = NULL;
+ }
#endif
rp = s->s3->rbuf.buf;
Index: src/crypto/external/bsd/openssl/dist/ssl/s3_srvr.c
diff -u src/crypto/external/bsd/openssl/dist/ssl/s3_srvr.c:1.9 src/crypto/external/bsd/openssl/dist/ssl/s3_srvr.c:1.10
--- src/crypto/external/bsd/openssl/dist/ssl/s3_srvr.c:1.9 Thu Jan 5 17:32:02 2012
+++ src/crypto/external/bsd/openssl/dist/ssl/s3_srvr.c Thu Jan 5 18:59:53 2012
@@ -858,9 +858,7 @@ int ssl3_check_client_hello(SSL *s)
if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
{
/* Throw away what we have done so far in the current handshake,
- * which will now be aborted. (A full SSL_clear would be too much.)
- * I hope that tmp.dh is the only thing that may need to be cleared
- * when a handshake is not completed ... */
+ * which will now be aborted. (A full SSL_clear would be too much.) */
#ifndef OPENSSL_NO_DH
if (s->s3->tmp.dh != NULL)
{
@@ -868,6 +866,13 @@ int ssl3_check_client_hello(SSL *s)
s->s3->tmp.dh = NULL;
}
#endif
+#ifndef OPENSSL_NO_ECDH
+ if (s->s3->tmp.ecdh != NULL)
+ {
+ EC_KEY_free(s->s3->tmp.ecdh);
+ s->s3->tmp.ecdh = NULL;
+ }
+#endif
s->s3->flags |= SSL3_FLAGS_SGC_RESTART_DONE;
return 2;
}
@@ -1590,7 +1595,6 @@ int ssl3_send_server_key_exchange(SSL *s
if (s->s3->tmp.dh != NULL)
{
- DH_free(dh);
SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
goto err;
}
@@ -1651,7 +1655,6 @@ int ssl3_send_server_key_exchange(SSL *s
if (s->s3->tmp.ecdh != NULL)
{
- EC_KEY_free(s->s3->tmp.ecdh);
SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
goto err;
}
@@ -1662,12 +1665,11 @@ int ssl3_send_server_key_exchange(SSL *s
SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
goto err;
}
- if (!EC_KEY_up_ref(ecdhp))
+ if ((ecdh = EC_KEY_dup(ecdhp)) == NULL)
{
SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
goto err;
}
- ecdh = ecdhp;
s->s3->tmp.ecdh=ecdh;
if ((EC_KEY_get0_public_key(ecdh) == NULL) ||
@@ -2579,6 +2581,12 @@ int ssl3_get_client_key_exchange(SSL *s)
/* Get encoded point length */
i = *p;
p += 1;
+ if (n != 1 + i)
+ {
+ SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+ ERR_R_EC_LIB);
+ goto err;
+ }
if (EC_POINT_oct2point(group,
clnt_ecpoint, p, i, bn_ctx) == 0)
{
