Codebase list openssl / bb6dafb
Make patches apply Kurt Roeckx 12 years ago
3 changed file(s) with 44 addition(s) and 47 deletion(s). Raw diff Collapse all Expand all
+14
-15
debian/patches/CVE-2011-4108.patch less more
0 diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
1 index e4f47e9..83702e5 100644
2 --- a/ssl/d1_pkt.c
3 +++ b/ssl/d1_pkt.c
4 @@ -335,6 +335,7 @@ dtls1_process_record(SSL *s)
0 Index: openssl-0.9.8o/ssl/d1_pkt.c
1 ===================================================================
2 --- openssl-0.9.8o.orig/ssl/d1_pkt.c 2010-04-14 00:09:39.000000000 +0000
3 +++ openssl-0.9.8o/ssl/d1_pkt.c 2012-01-14 21:36:36.000000000 +0000
4 @@ -338,6 +338,7 @@
55 SSL3_RECORD *rr;
66 unsigned int mac_size;
77 unsigned char md[EVP_MAX_MD_SIZE];
99
1010
1111 rr= &(s->s3->rrec);
12 @@ -369,13 +370,10 @@ dtls1_process_record(SSL *s)
12 @@ -372,12 +373,10 @@
1313 enc_err = s->method->ssl3_enc->enc(s,0);
1414 if (enc_err <= 0)
1515 {
16 - /* decryption failed, silently discard message */
17 - if (enc_err < 0)
18 - {
19 - rr->length = 0;
20 - s->packet_length = 0;
21 - }
16 - if (enc_err == 0)
17 - /* SSLerr() and ssl3_send_alert() have been called */
18 - goto err;
19 -
20 - /* otherwise enc_err == -1 */
2221 - goto err;
2322 + /* To minimize information leaked via timing, we will always
2423 + * perform all computations before discarding the message.
2726 }
2827
2928 #ifdef TLS_DEBUG
30 @@ -401,7 +399,7 @@ if ( (sess == NULL) ||
29 @@ -403,7 +402,7 @@
3130 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
3231 goto f_err;
3332 #else
3635 #endif
3736 }
3837 /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
39 @@ -412,17 +410,25 @@ if ( (sess == NULL) ||
38 @@ -414,17 +413,25 @@
4039 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
4140 goto f_err;
4241 #else
4544 #endif
4645 }
4746 rr->length-=mac_size;
48 s->method->ssl3_enc->mac(s,md,0);
47 i=s->method->ssl3_enc->mac(s,md,0);
4948 if (memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
5049 {
5150 - goto err;
+24
-26
debian/patches/CVE-2011-4577.patch less more
0 diff --git a/crypto/x509v3/v3_addr.c b/crypto/x509v3/v3_addr.c
1 index d27a707..c0e1d2d 100644
2 --- a/crypto/x509v3/v3_addr.c
3 +++ b/crypto/x509v3/v3_addr.c
4 @@ -142,12 +142,13 @@ unsigned int v3_addr_get_afi(const IPAddressFamily *f)
0 Index: openssl-0.9.8o/crypto/x509v3/v3_addr.c
1 ===================================================================
2 --- openssl-0.9.8o.orig/crypto/x509v3/v3_addr.c 2012-01-14 21:41:17.000000000 +0000
3 +++ openssl-0.9.8o/crypto/x509v3/v3_addr.c 2012-01-14 21:42:33.000000000 +0000
4 @@ -142,12 +142,13 @@
55 * Expand the bitstring form of an address into a raw byte array.
66 * At the moment this is coded for simplicity, not speed.
77 */
1717 if (bs->length > 0) {
1818 memcpy(addr, bs->data, bs->length);
1919 if ((bs->flags & 7) != 0) {
20 @@ -159,6 +160,7 @@ static void addr_expand(unsigned char *addr,
20 @@ -159,6 +160,7 @@
2121 }
2222 }
2323 memset(addr + bs->length, fill, length - bs->length);
2525 }
2626
2727 /*
28 @@ -181,15 +183,13 @@ static int i2r_address(BIO *out,
29 return 0;
28 @@ -179,11 +181,13 @@
29
3030 switch (afi) {
3131 case IANA_AFI_IPV4:
32 - if (bs->length > 4)
32 - addr_expand(addr, bs, 4, fill);
3333 + if (!addr_expand(addr, bs, 4, fill))
34 return 0;
35 - addr_expand(addr, bs, 4, fill);
34 + return 0;
3635 BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]);
3736 break;
3837 case IANA_AFI_IPV6:
39 - if (bs->length > 16)
38 - addr_expand(addr, bs, 16, fill);
4039 + if (!addr_expand(addr, bs, 16, fill))
41 return 0;
42 - addr_expand(addr, bs, 16, fill);
40 + return 0;
4341 for (n = 16; n > 1 && addr[n-1] == 0x00 && addr[n-2] == 0x00; n -= 2)
4442 ;
4543 for (i = 0; i < n; i += 2)
46 @@ -315,6 +315,12 @@ static int i2r_IPAddrBlocks(X509V3_EXT_METHOD *method,
44 @@ -309,6 +313,12 @@
4745 /*
4846 * Sort comparison function for a sequence of IPAddressOrRange
4947 * elements.
5654 */
5755 static int IPAddressOrRange_cmp(const IPAddressOrRange *a,
5856 const IPAddressOrRange *b,
59 @@ -327,22 +333,26 @@ static int IPAddressOrRange_cmp(const IPAddressOrRange *a,
57 @@ -321,22 +331,26 @@
6058
6159 switch (a->type) {
6260 case IPAddressOrRange_addressPrefix:
8785 prefixlen_b = length * 8;
8886 break;
8987 }
90 @@ -658,22 +668,22 @@ int v3_addr_add_range(IPAddrBlocks *addr,
88 @@ -651,22 +665,22 @@
9189 /*
9290 * Extract min and max values from an IPAddressOrRange.
9391 */
118116 }
119117
120118 /*
121 @@ -689,9 +699,10 @@ int v3_addr_get_range(IPAddressOrRange *aor,
119 @@ -682,9 +696,10 @@
122120 if (aor == NULL || min == NULL || max == NULL ||
123121 afi_length == 0 || length < afi_length ||
124122 (aor->type != IPAddressOrRange_addressPrefix &&
131129 return afi_length;
132130 }
133131
134 @@ -773,8 +784,9 @@ int v3_addr_is_canonical(IPAddrBlocks *addr)
132 @@ -766,8 +781,9 @@
135133 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
136134 IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
137135
143141
144142 /*
145143 * Punt misordered list, overlapping start, or inverted range.
146 @@ -809,7 +821,8 @@ int v3_addr_is_canonical(IPAddrBlocks *addr)
144 @@ -801,7 +817,8 @@
147145 {
148146 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
149 if (a != NULL && a->type == IPAddressOrRange_addressRange) {
147 if (a->type == IPAddressOrRange_addressRange) {
150148 - extract_min_max(a, a_min, a_max, length);
151149 + if (!extract_min_max(a, a_min, a_max, length))
152150 + return 0;
153 if (memcmp(a_min, a_max, length) > 0 ||
154 range_should_be_prefix(a_min, a_max, length) >= 0)
151 if (range_should_be_prefix(a_min, a_max, length) >= 0)
155152 return 0;
156 @@ -845,8 +858,9 @@ static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors,
153 }
154 @@ -836,8 +853,9 @@
157155 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
158156 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
159157
164162 + return 0;
165163
166164 /*
167 * Punt inverted ranges.
168 @@ -1132,13 +1146,15 @@ static int addr_contains(IPAddressOrRanges *parent,
165 * Punt overlaps.
166 @@ -1097,13 +1115,15 @@
169167
170168 p = 0;
171169 for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
+6
-6
debian/patches/dtls-fragment-alert.patch less more
0 diff --git a/ssl/d1_both.c b/ssl/d1_both.c
1 index 1c4158d..85f4d83 100644
2 --- a/ssl/d1_both.c
3 +++ b/ssl/d1_both.c
4 @@ -793,7 +793,13 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
0 Index: openssl-0.9.8o/ssl/d1_both.c
1 ===================================================================
2 --- openssl-0.9.8o.orig/ssl/d1_both.c 2010-05-03 13:01:59.000000000 +0000
3 +++ openssl-0.9.8o/ssl/d1_both.c 2012-01-14 21:46:02.000000000 +0000
4 @@ -806,7 +806,13 @@
55 *ok = 0;
66 return i;
77 }
1616
1717 /* parse the message fragment header */
1818 dtls1_get_message_header(wire, &msg_hdr);
19 @@ -865,7 +871,12 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
19 @@ -876,7 +882,12 @@
2020
2121 /* XDTLS: an incorrectly formatted fragment should cause the
2222 * handshake to fail */