[openssl-commits] [openssl] OpenSSL_1_0_2-stable update

[Rich Salz]

The branch OpenSSL_1_0_2-stable has been updated
       via  1acdbb3eef4c992c9cebec3cbdf8104761aa7d63 (commit)
      from  d0f38a1b8dbced5366177d41490c6fabe0014e56 (commit)


- Log -----------------------------------------------------------------
commit 1acdbb3eef4c992c9cebec3cbdf8104761aa7d63
Author: Rich Salz <rsalz at openssl.org>
Date:   Tue Feb 21 13:07:13 2017 -0500

    Prevent OOB in SRP base64 code.
    
    Change size comparison from > (GT) to >= (GTE) to ensure an additional
    byte of output buffer, to prevent OOB reads/writes later in the function
    Reject input strings larger than 2GB
    Detect invalid output buffer size and return early
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/2672)
    
    (cherry picked from commit ecca16632a73bb80ee27cdec8a97f6def0a4714d)

-----------------------------------------------------------------------

Summary of changes:
 crypto/srp/srp_vfy.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c
index a8ec52a..c8bc7a9 100644
--- a/crypto/srp/srp_vfy.c
+++ b/crypto/srp/srp_vfy.c
@@ -86,10 +86,13 @@ static int t_fromb64(unsigned char *a, size_t alen, const char *src)
     int i, j;
     int size;
 
+    if (alen == 0 || alen > INT_MAX)
+        return -1;
+
     while (*src && (*src == ' ' || *src == '\t' || *src == '\n'))
         ++src;
     size = strlen(src);
-    if (alen > INT_MAX || size > (int)alen)
+    if (size < 0 || size >= (int)alen)
         return -1;
 
     i = 0;
@@ -127,7 +130,7 @@ static int t_fromb64(unsigned char *a, size_t alen, const char *src)
         if (--i < 0)
             break;
     }
-    while (a[j] == 0 && j <= size)
+    while (j <= size && a[j] == 0)
         ++j;
     i = 0;
     while (j <= size)