generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Properly check EVP_VerifyFinal() and similar return values

Browse Source 
(CVE-2008-5077).
Submitted by: Ben Laurie, Bodo Moeller, Google Security Team
This commit is contained in:
Dr. Stephen Henson
2009-01-07 10:48:23 +00:00
parent f4677b7960
commit a00c3c4019
11 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ssl/s3_clnt.c
View File

@@ -972,7 +972,7 @@ int ssl3_get_server_certificate(SSL *s)
}
i=ssl_verify_cert_chain(s,sk);
if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
#ifndef OPENSSL_NO_KRB5
&& (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
!= (SSL_aKRB5|SSL_kKRB5)
@@ -1459,7 +1459,7 @@ int ssl3_get_key_exchange(SSL *s)
EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
EVP_VerifyUpdate(&md_ctx,param,param_len);
if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
{
/* bad signature */
al=SSL_AD_DECRYPT_ERROR;
@@ -1477,7 +1477,7 @@ int ssl3_get_key_exchange(SSL *s)
EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
EVP_VerifyUpdate(&md_ctx,param,param_len);
if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
{
/* bad signature */
al=SSL_AD_DECRYPT_ERROR;