generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix initialization sequence to prevent freeing of unitialized objects.

Browse Source 
Submitted by: Nils Larsch <nla@trustcenter.de>

PR: 459
This commit is contained in:
Lutz Jänicke 2003-01-15 14:56:47 +00:00
parent b2c71c489d
commit 0748cdc7f1
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES
View File

@ -4,6 +4,12 @@
Changes between 0.9.7 and 0.9.7a [XX xxx 2003] Changes between 0.9.7 and 0.9.7a [XX xxx 2003]
*) DSA routines: under certain error conditions uninitialized BN objects
could be freed. Solution: make sure initialization is performed early
enough. (Reported and fix supplied by Ivan D Nestlerode <nestler@MIT.EDU>,
Nils Larsch <nla@trustcenter.de> via PR#459)
[Lutz Jaenicke]
*) Another fix for SSLv2 session ID handling: the session ID was incorrectly *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
checked on reconnect on the client side, therefore session resumption checked on reconnect on the client side, therefore session resumption
could still fail with a "ssl session id is different" error. This could still fail with a "ssl session id is different" error. This

13
crypto/dsa/dsa_ossl.c
View File

@ -106,13 +106,15 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
int i,reason=ERR_R_BN_LIB; int i,reason=ERR_R_BN_LIB;
DSA_SIG *ret=NULL; DSA_SIG *ret=NULL;
BN_init(&m);
BN_init(&xr);
if (!dsa->p || !dsa->q || !dsa->g) if (!dsa->p || !dsa->q || !dsa->g)
{ {
reason=DSA_R_MISSING_PARAMETERS; reason=DSA_R_MISSING_PARAMETERS;
goto err; goto err;
} }
BN_init(&m);
BN_init(&xr);
s=BN_new(); s=BN_new();
if (s == NULL) goto err; if (s == NULL) goto err;
@ -178,6 +180,9 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
DSAerr(DSA_F_DSA_SIGN_SETUP,DSA_R_MISSING_PARAMETERS); DSAerr(DSA_F_DSA_SIGN_SETUP,DSA_R_MISSING_PARAMETERS);
return 0; return 0;
} }
BN_init(&k);
if (ctx_in == NULL) if (ctx_in == NULL)
{ {
if ((ctx=BN_CTX_new()) == NULL) goto err; if ((ctx=BN_CTX_new()) == NULL) goto err;
@ -185,7 +190,6 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
else else
ctx=ctx_in; ctx=ctx_in;
BN_init(&k);
if ((r=BN_new()) == NULL) goto err; if ((r=BN_new()) == NULL) goto err;
kinv=NULL; kinv=NULL;
@ -241,11 +245,12 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
return -1; return -1;
} }
if ((ctx=BN_CTX_new()) == NULL) goto err;
BN_init(&u1); BN_init(&u1);
BN_init(&u2); BN_init(&u2);
BN_init(&t1); BN_init(&t1);
if ((ctx=BN_CTX_new()) == NULL) goto err;
if (BN_is_zero(sig->r) || sig->r->neg || BN_ucmp(sig->r, dsa->q) >= 0) if (BN_is_zero(sig->r) || sig->r->neg || BN_ucmp(sig->r, dsa->q) >= 0)
{ {
ret = 0; ret = 0;