[openssl-commits] [openssl] OpenSSL_1_1_0-stable update

[Richard Levitte]

The branch OpenSSL_1_1_0-stable has been updated
       via  29cbeb9f0279678706dc9f5d96bcb64fc766658f (commit)
      from  831a2b0637b0eb21c9c2f8cc67f4579368637077 (commit)


- Log -----------------------------------------------------------------
commit 29cbeb9f0279678706dc9f5d96bcb64fc766658f
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Aug 7 04:55:47 2018 +0200

    Make EVP_PKEY_asn1_new() stricter with its input
    
    Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre at ncp-e.com>
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/6880)
    
    (cherry picked from commit 38eca7fed09a57c1b7a05d651af2c667b3e87719)

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                 |  5 +++++
 crypto/asn1/ameth_lib.c | 12 ++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/CHANGES b/CHANGES
index 277654d..13cc641 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,11 @@
 
  Changes between 1.1.0h and 1.1.0i [xx XXX xxxx]
 
+  *) Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
+     parameter is no longer accepted, as it leads to a corrupt table.  NULL
+     pem_str is reserved for alias entries only.
+     [Richard Levitte]
+
   *) Revert blinding in ECDSA sign and instead make problematic addition
      length-invariant. Switch even to fixed-length Montgomery multiplication.
      [Andy Polyakov]
diff --git a/crypto/asn1/ameth_lib.c b/crypto/asn1/ameth_lib.c
index b8ba067..9b0a2cc 100644
--- a/crypto/asn1/ameth_lib.c
+++ b/crypto/asn1/ameth_lib.c
@@ -255,6 +255,18 @@ EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_new(int id, int flags,
             goto err;
     }
 
+    /*
+     * One of the following must be true:
+     *
+     * pem_str == NULL AND ASN1_PKEY_ALIAS is set
+     * pem_str != NULL AND ASN1_PKEY_ALIAS is clear
+     *
+     * Anything else is an error and may lead to a corrupt ASN1 method table
+     */
+    if (!((pem_str == NULL && (flags & ASN1_PKEY_ALIAS) != 0)
+          || (pem_str != NULL && (flags & ASN1_PKEY_ALIAS) == 0)))
+        goto err;
+
     if (pem_str) {
         ameth->pem_str = OPENSSL_strdup(pem_str);
         if (!ameth->pem_str)