mischief/openbsd-src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2025-01-10 06:47:55 -08:00
Code

ssl3_init_finished_mac() calls BIO_new() which can fail since it in turn

Browse Source 
calls malloc(). Instead of silently continuing on failure, check the return
value of BIO_new() and propagate failure back to the caller for appropriate
handling.

ok bcook@
This commit is contained in:
jsing 2014-12-10 15:43:31 +00:00
parent 829c998383
commit 744da65f12
17 changed files with 115 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/libssl/d1_clnt.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: d1_clnt.c,v 1.39 2014/12/06 14:24:26 jsing Exp $ */
/* $OpenBSD: d1_clnt.c,v 1.40 2014/12/10 15:43:31 jsing Exp $ */
/*
* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@ -310,7 +310,10 @@ dtls1_connect(SSL *s)
s->shutdown = 0;
/* every DTLS ClientHello resets Finished MAC */
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
dtls1_start_timer(s);
ret = dtls1_client_hello(s);

21
lib/libssl/d1_srvr.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: d1_srvr.c,v 1.42 2014/11/16 14:12:47 jsing Exp $ */
/* $OpenBSD: d1_srvr.c,v 1.43 2014/12/10 15:43:31 jsing Exp $ */
/*
* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@ -272,7 +272,11 @@ dtls1_accept(SSL *s)
goto end;
}
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL3_ST_SR_CLNT_HELLO_A;
s->ctx->stats.sess_accept++;
} else {
@ -297,7 +301,10 @@ dtls1_accept(SSL *s)
s->state = SSL3_ST_SW_FLUSH;
s->init_num = 0;
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
break;
case SSL3_ST_SW_HELLO_REQ_C:
@ -351,8 +358,12 @@ dtls1_accept(SSL *s)
s->s3->tmp.next_state = SSL3_ST_SR_CLNT_HELLO_A;
/* HelloVerifyRequest resets Finished MAC */
if (s->version != DTLS1_BAD_VER)
ssl3_init_finished_mac(s);
if (s->version != DTLS1_BAD_VER) {
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
}
break;
#ifndef OPENSSL_NO_SCTP

7
lib/libssl/s23_clnt.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s23_clnt.c,v 1.34 2014/11/16 14:12:47 jsing Exp $ */
/* $OpenBSD: s23_clnt.c,v 1.35 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -230,7 +230,10 @@ ssl23_connect(SSL *s)
goto end;
}
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL23_ST_CW_CLNT_HELLO_A;
s->ctx->stats.sess_connect++;

7
lib/libssl/s23_srvr.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s23_srvr.c,v 1.36 2014/11/16 14:12:47 jsing Exp $ */
/* $OpenBSD: s23_srvr.c,v 1.37 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -219,7 +219,10 @@ ssl23_accept(SSL *s)
s->init_buf = buf;
}
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL23_ST_SR_CLNT_HELLO_A;
s->ctx->stats.sess_accept++;

8
lib/libssl/s3_both.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s3_both.c,v 1.33 2014/12/10 15:36:46 jsing Exp $ */
/* $OpenBSD: s3_both.c,v 1.34 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -464,7 +464,11 @@ ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
* start a new handshake?). We need to restart the mac.
* Don't increment {num,total}_renegotiations because
* we have not completed the handshake. */
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
SSLerr(SSL_F_SSL3_GET_MESSAGE,
ERR_R_MALLOC_FAILURE);
goto err;
}
}
s->s3->tmp.message_type= *(p++);

7
lib/libssl/s3_clnt.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s3_clnt.c,v 1.98 2014/12/10 15:36:46 jsing Exp $ */
/* $OpenBSD: s3_clnt.c,v 1.99 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -288,7 +288,10 @@ ssl3_connect(SSL *s)
/* don't push the buffering BIO quite yet */
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL3_ST_CW_CLNT_HELLO_A;
s->ctx->stats.sess_connect++;

13
lib/libssl/s3_srvr.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s3_srvr.c,v 1.92 2014/12/10 15:36:47 jsing Exp $ */
/* $OpenBSD: s3_srvr.c,v 1.93 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -298,7 +298,11 @@ ssl3_accept(SSL *s)
goto end;
}
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL3_ST_SR_CLNT_HELLO_A;
s->ctx->stats.sess_accept++;
} else if (!s->s3->send_connection_binding) {
@ -334,7 +338,10 @@ ssl3_accept(SSL *s)
s->state = SSL3_ST_SW_FLUSH;
s->init_num = 0;
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
break;
case SSL3_ST_SW_HELLO_REQ_C:

7
lib/libssl/src/ssl/d1_clnt.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: d1_clnt.c,v 1.39 2014/12/06 14:24:26 jsing Exp $ */
/* $OpenBSD: d1_clnt.c,v 1.40 2014/12/10 15:43:31 jsing Exp $ */
/*
* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@ -310,7 +310,10 @@ dtls1_connect(SSL *s)
s->shutdown = 0;
/* every DTLS ClientHello resets Finished MAC */
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
dtls1_start_timer(s);
ret = dtls1_client_hello(s);

21
lib/libssl/src/ssl/d1_srvr.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: d1_srvr.c,v 1.42 2014/11/16 14:12:47 jsing Exp $ */
/* $OpenBSD: d1_srvr.c,v 1.43 2014/12/10 15:43:31 jsing Exp $ */
/*
* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@ -272,7 +272,11 @@ dtls1_accept(SSL *s)
goto end;
}
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL3_ST_SR_CLNT_HELLO_A;
s->ctx->stats.sess_accept++;
} else {
@ -297,7 +301,10 @@ dtls1_accept(SSL *s)
s->state = SSL3_ST_SW_FLUSH;
s->init_num = 0;
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
break;
case SSL3_ST_SW_HELLO_REQ_C:
@ -351,8 +358,12 @@ dtls1_accept(SSL *s)
s->s3->tmp.next_state = SSL3_ST_SR_CLNT_HELLO_A;
/* HelloVerifyRequest resets Finished MAC */
if (s->version != DTLS1_BAD_VER)
ssl3_init_finished_mac(s);
if (s->version != DTLS1_BAD_VER) {
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
}
break;
#ifndef OPENSSL_NO_SCTP

7
lib/libssl/src/ssl/s23_clnt.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s23_clnt.c,v 1.34 2014/11/16 14:12:47 jsing Exp $ */
/* $OpenBSD: s23_clnt.c,v 1.35 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -230,7 +230,10 @@ ssl23_connect(SSL *s)
goto end;
}
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL23_ST_CW_CLNT_HELLO_A;
s->ctx->stats.sess_connect++;

7
lib/libssl/src/ssl/s23_srvr.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s23_srvr.c,v 1.36 2014/11/16 14:12:47 jsing Exp $ */
/* $OpenBSD: s23_srvr.c,v 1.37 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -219,7 +219,10 @@ ssl23_accept(SSL *s)
s->init_buf = buf;
}
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL23_ST_SR_CLNT_HELLO_A;
s->ctx->stats.sess_accept++;

8
lib/libssl/src/ssl/s3_both.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s3_both.c,v 1.33 2014/12/10 15:36:46 jsing Exp $ */
/* $OpenBSD: s3_both.c,v 1.34 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -464,7 +464,11 @@ ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
* start a new handshake?). We need to restart the mac.
* Don't increment {num,total}_renegotiations because
* we have not completed the handshake. */
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
SSLerr(SSL_F_SSL3_GET_MESSAGE,
ERR_R_MALLOC_FAILURE);
goto err;
}
}
s->s3->tmp.message_type= *(p++);

7
lib/libssl/src/ssl/s3_clnt.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s3_clnt.c,v 1.98 2014/12/10 15:36:46 jsing Exp $ */
/* $OpenBSD: s3_clnt.c,v 1.99 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -288,7 +288,10 @@ ssl3_connect(SSL *s)
/* don't push the buffering BIO quite yet */
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL3_ST_CW_CLNT_HELLO_A;
s->ctx->stats.sess_connect++;

9
lib/libssl/src/ssl/s3_enc.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s3_enc.c,v 1.56 2014/11/16 14:12:47 jsing Exp $ */
/* $OpenBSD: s3_enc.c,v 1.57 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -469,14 +469,19 @@ ssl3_enc(SSL *s, int send)
return (1);
}
void
int
ssl3_init_finished_mac(SSL *s)
{
BIO_free(s->s3->handshake_buffer);
ssl3_free_digest_list(s);
s->s3->handshake_buffer = BIO_new(BIO_s_mem());
if (s->s3->handshake_buffer == NULL)
return (0);
(void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
return (1);
}
void

13
lib/libssl/src/ssl/s3_srvr.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: s3_srvr.c,v 1.92 2014/12/10 15:36:47 jsing Exp $ */
/* $OpenBSD: s3_srvr.c,v 1.93 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -298,7 +298,11 @@ ssl3_accept(SSL *s)
goto end;
}
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
s->state = SSL3_ST_SR_CLNT_HELLO_A;
s->ctx->stats.sess_accept++;
} else if (!s->s3->send_connection_binding) {
@ -334,7 +338,10 @@ ssl3_accept(SSL *s)
s->state = SSL3_ST_SW_FLUSH;
s->init_num = 0;
ssl3_init_finished_mac(s);
if (!ssl3_init_finished_mac(s)) {
ret = -1;
goto end;
}
break;
case SSL3_ST_SW_HELLO_REQ_C:

4
lib/libssl/src/ssl/ssl_locl.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssl_locl.h,v 1.80 2014/12/10 15:36:47 jsing Exp $ */
/* $OpenBSD: ssl_locl.h,v 1.81 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -595,7 +595,7 @@ STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
int ssl_verify_alarm_type(long type);
void ssl_load_ciphers(void);
void ssl3_init_finished_mac(SSL *s);
int ssl3_init_finished_mac(SSL *s);
int ssl3_send_server_certificate(SSL *s);
int ssl3_send_newsession_ticket(SSL *s);
int ssl3_send_cert_status(SSL *s);

4
lib/libssl/ssl_locl.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssl_locl.h,v 1.80 2014/12/10 15:36:47 jsing Exp $ */
/* $OpenBSD: ssl_locl.h,v 1.81 2014/12/10 15:43:31 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@ -595,7 +595,7 @@ STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
int ssl_verify_alarm_type(long type);
void ssl_load_ciphers(void);
void ssl3_init_finished_mac(SSL *s);
int ssl3_init_finished_mac(SSL *s);
int ssl3_send_server_certificate(SSL *s);
int ssl3_send_newsession_ticket(SSL *s);
int ssl3_send_cert_status(SSL *s);