mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-21 01:15:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix for CVE-2015-0291

Browse Source 
If a client renegotiates using an invalid signature algorithms extension
it will crash a server with a NULL pointer dereference.

Thanks to David Ramos of Stanford University for reporting this bug.

CVE-2015-0291

Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Dr. Stephen Henson 2015-03-03 13:20:57 +00:00 committed by Matt Caswell
parent 09f06923e6
commit 34e3edbf3a
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
ssl/t1_lib.c
View File

@ -2693,6 +2693,7 @@ int tls1_set_server_sigalgs(SSL *s)
if (s->cert->shared_sigalgs) { if (s->cert->shared_sigalgs) {
OPENSSL_free(s->cert->shared_sigalgs); OPENSSL_free(s->cert->shared_sigalgs);
s->cert->shared_sigalgs = NULL; s->cert->shared_sigalgs = NULL;
s->cert->shared_sigalgslen = 0;
} }
/* Clear certificate digests and validity flags */ /* Clear certificate digests and validity flags */
for (i = 0; i < SSL_PKEY_NUM; i++) { for (i = 0; i < SSL_PKEY_NUM; i++) {
@ -3396,6 +3397,7 @@ static int tls1_set_shared_sigalgs(SSL *s)
if (c->shared_sigalgs) { if (c->shared_sigalgs) {
OPENSSL_free(c->shared_sigalgs); OPENSSL_free(c->shared_sigalgs);
c->shared_sigalgs = NULL; c->shared_sigalgs = NULL;
c->shared_sigalgslen = 0;
} }
/* If client use client signature algorithms if not NULL */ /* If client use client signature algorithms if not NULL */
if (!s->server && c->client_sigalgs && !is_suiteb) { if (!s->server && c->client_sigalgs && !is_suiteb) {
@ -3418,12 +3420,14 @@ static int tls1_set_shared_sigalgs(SSL *s)
preflen = c->peer_sigalgslen; preflen = c->peer_sigalgslen;
} }
nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen); nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen);
if (!nmatch) if (nmatch) {
return 1; salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS)); if (!salgs)
if (!salgs) return 0;
return 0; nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen);
nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen); } else {
salgs = NULL;
}
c->shared_sigalgs = salgs; c->shared_sigalgs = salgs;
c->shared_sigalgslen = nmatch; c->shared_sigalgslen = nmatch;
return 1; return 1;