[CVS] OpenSSL: OpenSSL_0_9_6-stable: openssl/ CHANGES openssl/crypto/a...

  OpenSSL CVS Repository
  http://cvs.openssl.org/
  ____________________________________________________________________________

  Server: cvs.openssl.org                  Name:   Dr. Stephen Henson
  Root:   /e/openssl/cvs                   Email:  steve@xxxxxxxxxxx
  Module: openssl                          Date:   30-Sep-2003 14:05:11
  Branch: OpenSSL_0_9_6-stable             Handle: 2003093013050803

  Modified files:           (Branch: OpenSSL_0_9_6-stable)
    openssl                 CHANGES
    openssl/crypto/asn1     asn1_lib.c
    openssl/crypto/x509     x509_vfy.c

  Log:
    Fix for ASN1 parsing bugs.

  Summary:
    Revision    Changes     Path
    1.618.2.203 +10 -0      openssl/CHANGES
    1.19.2.5    +2  -0      openssl/crypto/asn1/asn1_lib.c
    1.46.2.5    +1  -1      openssl/crypto/x509/x509_vfy.c
  ____________________________________________________________________________

  patch -p0 <<'@@ .'
  Index: openssl/CHANGES
  ============================================================================
  $ cvs diff -u -r1.618.2.202 -r1.618.2.203 CHANGES
  --- openssl/CHANGES   3 Sep 2003 23:35:53 -0000       1.618.2.202
  +++ openssl/CHANGES   30 Sep 2003 12:05:08 -0000      1.618.2.203
  @@ -4,6 +4,16 @@
   
    Changes between 0.9.6j and 0.9.6k  [xx XXX 2003]
   
  +  *) Fix various bugs revealed by running the NISCC test suite:
  +
  +     Stop out of bounds reads in the ASN1 code when presented with
  +     invalid tags (CAN-2003-0543 and CAN-2003-0544).
  +     
  +     If verify callback ignores invalid public key errors don't try to check
  +     certificate signature with the NULL public key.
  +
  +     [Steve Henson]
  +
     *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
        if the server requested one: as stated in TLS 1.0 and SSL 3.0
        specifications.
  @@ .
  patch -p0 <<'@@ .'
  Index: openssl/crypto/asn1/asn1_lib.c
  ============================================================================
  $ cvs diff -u -r1.19.2.4 -r1.19.2.5 asn1_lib.c
  --- openssl/crypto/asn1/asn1_lib.c    2 Aug 2002 19:00:21 -0000       1.19.2.4
  +++ openssl/crypto/asn1/asn1_lib.c    30 Sep 2003 12:05:10 -0000      1.19.2.5
  @@ -104,10 +104,12 @@
                        l<<=7L;
                        l|= *(p++)&0x7f;
                        if (--max == 0) goto err;
  +                     if (l > (INT_MAX >> 7L)) goto err;
                        }
                l<<=7L;
                l|= *(p++)&0x7f;
                tag=(int)l;
  +             if (--max == 0) goto err;
                }
        else
                { 
  @@ .
  patch -p0 <<'@@ .'
  Index: openssl/crypto/x509/x509_vfy.c
  ============================================================================
  $ cvs diff -u -r1.46.2.4 -r1.46.2.5 x509_vfy.c
  --- openssl/crypto/x509/x509_vfy.c    10 Dec 2002 08:28:16 -0000      1.46.2.4
  +++ openssl/crypto/x509/x509_vfy.c    30 Sep 2003 12:05:11 -0000      1.46.2.5
  @@ -490,7 +490,7 @@
                                ok=(*cb)(0,ctx);
                                if (!ok) goto end;
                                }
  -                     if (X509_verify(xs,pkey) <= 0)
  +                     else if (X509_verify(xs,pkey) <= 0)
                                {
                                ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;
                                ctx->current_cert=xs;
  @@ .
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
CVS Repository Commit List                     openssl-cvs@xxxxxxxxxxx
Automated List Manager                           majordomo@xxxxxxxxxxx