File openssl-CVE-2023-0401-1of2.patch of Package openssl-3.28459

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-CVE-2023-0401-1of2.patch of Package openssl-3.28459

commit 570d2d6693f35a2f46f1406471d0a991537675b5
Author: Tomas Mraz <tomas@openssl.org>
Date:   Wed Jan 18 09:27:53 2023 +0100

pk7_doit.c: Check return of BIO_set_md() calls
    
    These calls invoke EVP_DigestInit() which can fail for digests
    with implicit fetches. Subsequent EVP_DigestUpdate() from BIO_write()
    or EVP_DigestFinal() from BIO_read() will segfault on NULL
    dereference. This can be triggered by an attacker providing
    PKCS7 data digested with MD4 for example if the legacy provider
    is not loaded.
    
    If BIO_set_md() fails the md BIO cannot be used.
    
    CVE-2023-0401

diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index f116e46411..a4897f8ff7 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -84,8 +84,12 @@ static int pkcs7_bio_add_digest(BIO **pbio, X509_ALGOR *alg,
     }
     (void)ERR_pop_to_mark();
 
-    BIO_set_md(btmp, md);
+    if (BIO_set_md(btmp, md) <= 0) {
+        ERR_raise(ERR_LIB_PKCS7, ERR_R_BIO_LIB);
+        goto err;
+    }
     EVP_MD_free(fetched);
+    fetched = NULL;
     if (*pbio == NULL)
         *pbio = btmp;
     else if (!BIO_push(*pbio, btmp)) {
@@ -98,6 +102,7 @@ static int pkcs7_bio_add_digest(BIO **pbio, X509_ALGOR *alg,
 
  err:
     BIO_free(btmp);
+    EVP_MD_free(fetched);
     return 0;
 }
 
@@ -522,7 +527,11 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
             }
             (void)ERR_pop_to_mark();
 
-            BIO_set_md(btmp, md);
+            if (BIO_set_md(btmp, md) <= 0) {
+                EVP_MD_free(evp_md);
+                ERR_raise(ERR_LIB_PKCS7, ERR_R_BIO_LIB);
+                goto err;
+            }
             EVP_MD_free(evp_md);
             if (out == NULL)
                 out = btmp;

Places

File openssl-CVE-2023-0401-1of2.patch of Package openssl-3.28459

Places