Commit dab4c282 authored by Bodo Möller's avatar Bodo Möller
Browse files

pay attention to blocksize before attempting decryption

parent 19352b79

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -4,6 +4,10 @@ 


 Changes between 0.9.6a and 0.9.6b  [XX xxx XXXX]



  *) Verify that incoming data obeys the block size in

     ssl3_enc (ssl/s3_enc.c) and tls1_enc (ssl/t1_enc.c).

     [Bodo Moeller]



  *) Fix OAEP check.

     [Ulf Möller, Bodo Möller]

ssl/s3_enc.c

+13 −2
Original line number Diff line number Diff line
@@ -366,7 +366,6 @@ int ssl3_enc(SSL *s, int send) 


		/* COMPRESS */



		/* This should be using (bs-1) and bs instead of 7 and 8 */

		if ((bs != 1) && send)

			{

			i=bs-((int)l%bs);
@@ -377,11 +376,23 @@ int ssl3_enc(SSL *s, int send) 
			rec->input[l-1]=(i-1);

			}

		

		if (!send)

			{

			if (l == 0 || l%bs != 0)

				{

				SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);

				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPT_ERROR);

				return(0);

				}

			}

		

		EVP_Cipher(ds,rec->data,rec->input,l);



		if ((bs != 1) && !send)

			{

			i=rec->data[l-1]+1;

			/* SSL 3.0 bounds the number of padding bytes by the block size;

			 * padding bytes (except that last) are arbitrary */

			if (i > bs)

				{

				SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);

ssl/t1_enc.c

+13 −1
Original line number Diff line number Diff line
@@ -447,11 +447,21 @@ int tls1_enc(SSL *s, int send) 
			rec->length+=i;

			}



		if (!send)

			{

			if (l == 0 || l%bs != 0)

				{

				SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);

				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPT_ERROR);

				return(0);

				}

			}

		

		EVP_Cipher(ds,rec->data,rec->input,l);



		if ((bs != 1) && !send)

			{

			ii=i=rec->data[l-1];

			ii=i=rec->data[l-1]; /* padding_length */

			i++;

			if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)

				{
@@ -462,6 +472,8 @@ int tls1_enc(SSL *s, int send) 
				if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)

					i--;

				}

			/* TLS 1.0 does not bound the number of padding bytes by the block size.

			 * All of them must have value 'padding_length'. */

			if (i > (int)rec->length)

				{

				SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);