Commit 0294b2be authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Check EVP errors for handshake digests. 

Partial mitigation of PR#3200
parent f1068a1a

ssl/s3_both.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -161,6 +161,8 @@ int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen) 




		i=s->method->ssl3_enc->final_finish_mac(s,

		i=s->method->ssl3_enc->final_finish_mac(s,

			sender,slen,s->s3->tmp.finish_md);

			sender,slen,s->s3->tmp.finish_md);

		if (i == 0)

			return 0;

		s->s3->tmp.finish_md_len = i;

		s->s3->tmp.finish_md_len = i;

		memcpy(p, s->s3->tmp.finish_md, i);

		memcpy(p, s->s3->tmp.finish_md, i);

		p+=i;

		p+=i;

ssl/s3_pkt.c

+7 −1
Original line number Original line Diff line number Diff line
@@ -1459,8 +1459,14 @@ int ssl3_do_change_cipher_spec(SSL *s) 
		slen=s->method->ssl3_enc->client_finished_label_len;

		slen=s->method->ssl3_enc->client_finished_label_len;

		}

		}





	s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,

	i = s->method->ssl3_enc->final_finish_mac(s,

		sender,slen,s->s3->tmp.peer_finish_md);

		sender,slen,s->s3->tmp.peer_finish_md);

	if (i == 0)

		{

		SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);

		return 0;

		}

	s->s3->tmp.peer_finish_md_len = i;





	return(1);

	return(1);

	}

	}

ssl/t1_enc.c

+6 −5
Original line number Original line Diff line number Diff line
@@ -915,18 +915,19 @@ int tls1_final_finish_mac(SSL *s, 
		if (mask & ssl_get_algorithm2(s))

		if (mask & ssl_get_algorithm2(s))

			{

			{

			int hashsize = EVP_MD_size(md);

			int hashsize = EVP_MD_size(md);

			if (hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf)))

			EVP_MD_CTX *hdgst = s->s3->handshake_dgst[idx];

			if (!hdgst || hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf)))

				{

				{

				/* internal error: 'buf' is too small for this cipersuite! */

				/* internal error: 'buf' is too small for this cipersuite! */

				err = 1;

				err = 1;

				}

				}

			else

			else

				{

				{

				EVP_MD_CTX_copy_ex(&ctx,s->s3->handshake_dgst[idx]);

				if (!EVP_MD_CTX_copy_ex(&ctx, hdgst) ||

				EVP_DigestFinal_ex(&ctx,q,&i);

					!EVP_DigestFinal_ex(&ctx,q,&i) ||

				if (i != (unsigned int)hashsize) /* can't really happen */

					(i != (unsigned int)hashsize))

					err = 1;

					err = 1;

				q+=i;

				q+=hashsize;

				}

				}

			}

			}

		}

		}