File openssl-CVE-2016-0797.patch of Package compat-openssl098.10476

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-CVE-2016-0797.patch of Package compat-openssl098.10476

Index: openssl-0.9.8j/crypto/bn/bn_print.c
===================================================================
--- openssl-0.9.8j.orig/crypto/bn/bn_print.c	2016-02-26 13:33:53.627051694 +0100
+++ openssl-0.9.8j/crypto/bn/bn_print.c	2016-02-26 13:33:56.843083801 +0100
@@ -58,6 +58,7 @@
 
 #include <stdio.h>
 #include <ctype.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/buffer.h>
 #include "bn_lcl.h"
@@ -180,10 +181,12 @@
 
 	if (*a == '-') { neg=1; a++; }
 
-	for (i=0; isxdigit((unsigned char) a[i]); i++)
-		;
+    for (i = 0; i <= (INT_MAX/4) && isxdigit((unsigned char)a[i]); i++);
+    if (i > INT_MAX/4)
+        goto err;
+
+    num = i + neg;
 
-	num=i+neg;
 	if (bn == NULL) return(num);
 
 	/* a is the start of the hex digits, and it is 'i' long */
@@ -197,7 +200,7 @@
 		BN_zero(ret);
 		}
 
-	/* i is the number of hex digests; */
+	/* i is the number of hex digits */
 	if (bn_expand(ret,i*4) == NULL) goto err;
 
 	j=i; /* least significant 'hex' */
@@ -244,12 +247,15 @@
 	int num;
 
 	if ((a == NULL) || (*a == '\0')) return(0);
+
 	if (*a == '-') { neg=1; a++; }
 
-	for (i=0; isdigit((unsigned char) a[i]); i++)
-		;
+    for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++);
+    if (i > INT_MAX/4)
+        goto err;
+
+    num = i + neg;
 
-	num=i+neg;
 	if (bn == NULL) return(num);
 
 	/* a is the start of the digits, and it is 'i' long.
@@ -264,7 +270,7 @@
 		BN_zero(ret);
 		}
 
-	/* i is the number of digests, a bit of an over expand; */
+	/* i is the number of digits, a bit of an over expand */
 	if (bn_expand(ret,i*4) == NULL) goto err;
 
 	j=BN_DEC_NUM-(i%BN_DEC_NUM);
Index: openssl-0.9.8j/crypto/bn/bn.h
===================================================================
--- openssl-0.9.8j.orig/crypto/bn/bn.h	2016-02-26 13:33:53.627051694 +0100
+++ openssl-0.9.8j/crypto/bn/bn.h	2016-02-26 13:33:56.847083841 +0100
@@ -77,6 +77,7 @@
 #include <stdio.h> /* FILE */
 #endif
 #include <openssl/ossl_typ.h>
+#include <limits.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -662,8 +663,16 @@
 
 /* library internal functions */
 
-#define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->dmax)?\
-	(a):bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2))
+#define bn_expand(a,bits) \
+    ( \
+        bits > (INT_MAX - BN_BITS2 + 1) ? \
+            NULL \
+        : \
+            (((bits+BN_BITS2-1)/BN_BITS2) <= (a)->dmax) ? \
+                (a) \
+            : \
+                bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2) \
+    )
 #define bn_wexpand(a,words) (((words) <= (a)->dmax)?(a):bn_expand2((a),(words)))
 BIGNUM *bn_expand2(BIGNUM *a, int words);
 #ifndef OPENSSL_NO_DEPRECATED

Places

File openssl-CVE-2016-0797.patch of Package compat-openssl098.10476

Places