File openssl-CVE-2015-0289.patch of Package compat-openssl098.2467

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-CVE-2015-0289.patch of Package compat-openssl098.2467

commit f20caf7f66cb1eb9ba9562e6097bc7b64d207cb9
Author: Emilia Kasper <emilia@openssl.org>
Date:   Fri Feb 27 16:52:23 2015 +0100

PKCS#7: avoid NULL pointer dereferences with missing content
    
    In PKCS#7, the ASN.1 content component is optional.
    This typically applies to inner content (detached signatures),
    however we must also handle unexpected missing outer content
    correctly.
    
    This patch only addresses functions reachable from parsing,
    decryption and verification, and functions otherwise associated
    with reading potentially untrusted data.
    
    Correcting all low-level API calls requires further work.
    
    CVE-2015-0289
    
    Thanks to Michal Zalewski (Google) for reporting this issue.
    
    Reviewed-by: Steve Henson <steve@openssl.org>
    
    Conflicts:
    	crypto/pkcs7/pk7_doit.c

Index: openssl-0.9.8j/crypto/pkcs7/pk7_doit.c
===================================================================
--- openssl-0.9.8j.orig/crypto/pkcs7/pk7_doit.c	2015-03-16 18:29:49.267894493 +0100
+++ openssl-0.9.8j/crypto/pkcs7/pk7_doit.c	2015-03-16 18:36:14.433471778 +0100
@@ -151,6 +151,26 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
 	EVP_PKEY *pkey;
 	ASN1_OCTET_STRING *os=NULL;
 
+    if (p7 == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATAINIT, PKCS7_R_INVALID_NULL_POINTER);
+        return NULL;
+    }
+    /*
+     * The content field in the PKCS7 ContentInfo is optional, but that really
+     * only applies to inner content (precisely, detached signatures).
+     *
+     * When reading content, missing outer content is therefore treated as an
+     * error.
+     *
+     * When creating content, PKCS7_content_new() must be called before
+     * calling this method, so a NULL p7->d is always an error.
+     */
+    if (p7->d.ptr == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATAINIT, PKCS7_R_NO_CONTENT);
+        return NULL;
+    }
+
+
 	i=OBJ_obj2nid(p7->type);
 	p7->state=PKCS7_S_HEADER;
 
@@ -345,6 +365,16 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKE
 	X509_ALGOR *xalg=NULL;
 	PKCS7_RECIP_INFO *ri=NULL;
 
+    if (p7 == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_INVALID_NULL_POINTER);
+        return NULL;
+    }
+
+    if (p7->d.ptr == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT);
+        return NULL;
+    }
+
 	i=OBJ_obj2nid(p7->type);
 	p7->state=PKCS7_S_HEADER;
 
@@ -639,6 +669,16 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
 	STACK_OF(PKCS7_SIGNER_INFO) *si_sk=NULL;
 	ASN1_OCTET_STRING *os=NULL;
 
+    if (p7 == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATAFINAL, PKCS7_R_INVALID_NULL_POINTER);
+        return 0;
+    }
+
+    if (p7->d.ptr == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATAFINAL, PKCS7_R_NO_CONTENT);
+        return 0;
+    }
+
 	EVP_MD_CTX_init(&ctx_tmp);
 	i=OBJ_obj2nid(p7->type);
 	p7->state=PKCS7_S_HEADER;
@@ -670,6 +710,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
 		/* If detached data then the content is excluded */
 		if(PKCS7_type_is_data(p7->d.sign->contents) && p7->detached) {
 			M_ASN1_OCTET_STRING_free(os);
+            os = NULL;
 			p7->d.sign->contents->d.data = NULL;
 		}
 		break;
@@ -680,6 +721,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
 		if(PKCS7_type_is_data(p7->d.digest->contents) && p7->detached)
 			{
 			M_ASN1_OCTET_STRING_free(os);
+            os = NULL;
 			p7->d.digest->contents->d.data = NULL;
 			}
 		break;
@@ -817,6 +859,12 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
 
 	if (!PKCS7_is_detached(p7))
 		{
+		/*
+		 * NOTE(emilia): I think we only reach os == NULL here because detached
+		 * digested data support is broken.
+		 */
+		if (os == NULL)
+		    goto err;
 		btmp=BIO_find_type(bio,BIO_TYPE_MEM);
 		if (btmp == NULL)
 			{
@@ -851,6 +899,16 @@ int PKCS7_dataVerify(X509_STORE *cert_st
 	STACK_OF(X509) *cert;
 	X509 *x509;
 
+    if (p7 == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATAVERIFY, PKCS7_R_INVALID_NULL_POINTER);
+        return 0;
+    }
+
+    if (p7->d.ptr == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATAVERIFY, PKCS7_R_NO_CONTENT);
+        return 0;
+    }
+
 	if (PKCS7_type_is_signed(p7))
 		{
 		cert=p7->d.sign->cert;
Index: openssl-0.9.8j/crypto/pkcs7/pk7_lib.c
===================================================================
--- openssl-0.9.8j.orig/crypto/pkcs7/pk7_lib.c	2015-03-16 18:29:50.592913678 +0100
+++ openssl-0.9.8j/crypto/pkcs7/pk7_lib.c	2015-03-16 18:39:33.930361105 +0100
@@ -70,6 +70,7 @@ long PKCS7_ctrl(PKCS7 *p7, int cmd, long
 
 	switch (cmd)
 		{
+    /* NOTE(emilia): does not support detached digested data. */
 	case PKCS7_OP_SET_DETACHED_SIGNATURE:
 		if (nid == NID_pkcs7_signed)
 			{
@@ -473,6 +474,8 @@ int PKCS7_set_digest(PKCS7 *p7, const EV
 
 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7)
 	{
+    if (p7 == NULL || p7->d.ptr == NULL)
+        return NULL;
 	if (PKCS7_type_is_signed(p7))
 		{
 		return(p7->d.sign->signer_info);

Places

File openssl-CVE-2015-0289.patch of Package compat-openssl098.2467

Places