Blame SOURCES/openssl-fips-0.9.8e-cve-2015-0293.patch

f27bc9
diff -up openssl-fips-0.9.8e/ssl/s2_lib.c.ssl2-assert openssl-fips-0.9.8e/ssl/s2_lib.c
f27bc9
--- openssl-fips-0.9.8e/ssl/s2_lib.c.ssl2-assert	2015-04-01 12:41:28.023403066 +0200
f27bc9
+++ openssl-fips-0.9.8e/ssl/s2_lib.c	2015-04-02 15:29:37.468346462 +0200
f27bc9
@@ -410,7 +410,7 @@ int ssl2_generate_key_material(SSL *s)
f27bc9
 
f27bc9
 		OPENSSL_assert(s->session->master_key_length >= 0
f27bc9
 		    && s->session->master_key_length
f27bc9
-		    < (int)sizeof(s->session->master_key));
f27bc9
+		    <= (int)sizeof(s->session->master_key));
f27bc9
 		EVP_DigestUpdate(&ctx,s->session->master_key,s->session->master_key_length);
f27bc9
 		EVP_DigestUpdate(&ctx,&c,1);
f27bc9
 		c++;
f27bc9
diff -up openssl-fips-0.9.8e/ssl/s2_srvr.c.ssl2-assert openssl-fips-0.9.8e/ssl/s2_srvr.c
f27bc9
--- openssl-fips-0.9.8e/ssl/s2_srvr.c.ssl2-assert	2015-04-01 12:41:27.950401420 +0200
f27bc9
+++ openssl-fips-0.9.8e/ssl/s2_srvr.c	2015-04-02 15:33:51.109049368 +0200
f27bc9
@@ -363,7 +363,8 @@ end:
f27bc9
 
f27bc9
 static int get_client_master_key(SSL *s)
f27bc9
 	{
f27bc9
-	int is_export,i,n,keya,ek;
f27bc9
+	int is_export,i,n,keya;
f27bc9
+	unsigned int ek;
f27bc9
 	unsigned long len;
f27bc9
 	unsigned char *p;
f27bc9
 	SSL_CIPHER *cp;
f27bc9
@@ -445,9 +446,6 @@ static int get_client_master_key(SSL *s)
f27bc9
 		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_NO_PRIVATEKEY);
f27bc9
 		return(-1);
f27bc9
 		}
f27bc9
-	i=ssl_rsa_private_decrypt(s->cert,s->s2->tmp.enc,
f27bc9
-		&(p[s->s2->tmp.clear]),&(p[s->s2->tmp.clear]),
f27bc9
-		(s->s2->ssl2_rollback)?RSA_SSLV23_PADDING:RSA_PKCS1_PADDING);
f27bc9
 
f27bc9
 	is_export=SSL_C_IS_EXPORT(s->session->cipher);
f27bc9
 	
f27bc9
@@ -466,21 +464,61 @@ static int get_client_master_key(SSL *s)
f27bc9
 	else
f27bc9
 		ek=5;
f27bc9
 
f27bc9
+	/*
f27bc9
+	 * The format of the CLIENT-MASTER-KEY message is
f27bc9
+	 * 1 byte message type
f27bc9
+	 * 3 bytes cipher
f27bc9
+	 * 2-byte clear key length (stored in s->s2->tmp.clear)
f27bc9
+	 * 2-byte encrypted key length (stored in s->s2->tmp.enc)
f27bc9
+	 * 2-byte key args length (IV etc)
f27bc9
+	 * clear key
f27bc9
+	 * encrypted key
f27bc9
+	 * key args
f27bc9
+	 *
f27bc9
+	 * If the cipher is an export cipher, then the encrypted key bytes
f27bc9
+	 * are a fixed portion of the total key (5 or 8 bytes). The size of
f27bc9
+	 * this portion is in |ek|. If the cipher is not an export cipher,
f27bc9
+	 * then the entire key material is encrypted (i.e., clear key length
f27bc9
+	 * must be zero).
f27bc9
+	 */
f27bc9
+	 if ((!is_export && s->s2->tmp.clear != 0) ||
f27bc9
+		(is_export && s->s2->tmp.clear + ek != (unsigned int)EVP_CIPHER_key_length(c)))
f27bc9
+		{
f27bc9
+		ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
f27bc9
+		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_BAD_LENGTH);
f27bc9
+		return -1;
f27bc9
+		}
f27bc9
+	/*
f27bc9
+	 * The encrypted blob must decrypt to the encrypted portion of the key.
f27bc9
+	 * Decryption can't be expanding, so if we don't have enough encrypted
f27bc9
+	 * bytes to fit the key in the buffer, stop now.
f27bc9
+	 */
f27bc9
+	if ((is_export && s->s2->tmp.enc < ek) ||
f27bc9
+		(!is_export && s->s2->tmp.enc < (unsigned int)EVP_CIPHER_key_length(c)))
f27bc9
+		{
f27bc9
+		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
f27bc9
+		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_LENGTH_TOO_SHORT);
f27bc9
+		return -1;
f27bc9
+		}
f27bc9
+
f27bc9
+	i = ssl_rsa_private_decrypt(s->cert, s->s2->tmp.enc,
f27bc9
+		&(p[s->s2->tmp.clear]),
f27bc9
+		&(p[s->s2->tmp.clear]),
f27bc9
+		(s->s2->ssl2_rollback) ? RSA_SSLV23_PADDING : RSA_PKCS1_PADDING);
f27bc9
+
f27bc9
 	/* bad decrypt */
f27bc9
 #if 1
f27bc9
 	/* If a bad decrypt, continue with protocol but with a
f27bc9
 	 * random master secret (Bleichenbacher attack) */
f27bc9
-	if ((i < 0) ||
f27bc9
-		((!is_export && (i != EVP_CIPHER_key_length(c)))
f27bc9
-		|| (is_export && ((i != ek) || (s->s2->tmp.clear+(unsigned int)i !=
f27bc9
-			(unsigned int)EVP_CIPHER_key_length(c))))))
f27bc9
+	if ((i < 0) || ((!is_export && i != EVP_CIPHER_key_length(c))
f27bc9
+		|| (is_export && i != (int)ek)))
f27bc9
 		{
f27bc9
 		ERR_clear_error();
f27bc9
 		if (is_export)
f27bc9
 			i=ek;
f27bc9
 		else
f27bc9
 			i=EVP_CIPHER_key_length(c);
f27bc9
-		if (RAND_pseudo_bytes(p,i) <= 0)
f27bc9
+		if (RAND_pseudo_bytes(&p[s->s2->tmp.clear],i) <= 0)
f27bc9
 			return 0;
f27bc9
 		}
f27bc9
 #else
f27bc9
@@ -504,7 +542,8 @@ static int get_client_master_key(SSL *s)
f27bc9
 		}
f27bc9
 #endif
f27bc9
 
f27bc9
-	if (is_export) i+=s->s2->tmp.clear;
f27bc9
+	if (is_export)
f27bc9
+		i = EVP_CIPHER_key_length(c);
f27bc9
 
f27bc9
 	if (i > SSL_MAX_MASTER_KEY_LENGTH)
f27bc9
 		{