[openssl-commits] [openssl] OpenSSL_0_9_8-stable update

[Dr. Stephen Henson]

The branch OpenSSL_0_9_8-stable has been updated
       via  303845a3b5ee7b999bf79e2e42c1489c2cc9f371 (commit)
      from  1a38987de0d57286fac67f19ebb35c82fc1555b3 (commit)


- Log -----------------------------------------------------------------
commit 303845a3b5ee7b999bf79e2e42c1489c2cc9f371
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Thu Apr 16 16:43:09 2015 +0100

    Fix encoding bug in i2c_ASN1_INTEGER
    
    Fix bug where i2c_ASN1_INTEGER mishandles zero if it is marked as
    negative.
    
    Thanks to Huzaifa Sidhpurwala <huzaifas at redhat.com> and
    Hanno Böck <hanno at hboeck.de> for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit a0eed48d37a4b7beea0c966caf09ad46f4a92a44)

-----------------------------------------------------------------------

Summary of changes:
 crypto/asn1/a_int.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c
index b788617..4ff7826 100644
--- a/crypto/asn1/a_int.c
+++ b/crypto/asn1/a_int.c
@@ -124,6 +124,8 @@ int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
     else {
         ret = a->length;
         i = a->data[0];
+        if (ret == 1 && i == 0)
+            neg = 0;
         if (!neg && (i > 127)) {
             pad = 1;
             pb = 0;
@@ -162,7 +164,7 @@ int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
         p += a->length - 1;
         i = a->length;
         /* Copy zeros to destination as long as source is zero */
-        while (!*n) {
+        while (!*n && i > 1) {
             *(p--) = 0;
             n--;
             i--;
@@ -419,7 +421,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
         ASN1err(ASN1_F_BN_TO_ASN1_INTEGER, ERR_R_NESTED_ASN1_ERROR);
         goto err;
     }
-    if (BN_is_negative(bn))
+    if (BN_is_negative(bn) && !BN_is_zero(bn))
         ret->type = V_ASN1_NEG_INTEGER;
     else
         ret->type = V_ASN1_INTEGER;