File openssl-CVE-2016-2178.patch of Package compat-openssl098.16428

commit 3681a4558c13198944e6f7f149c4be188e076e14
Author: Matt Caswell <matt@openssl.org>
Date:   Tue Jun 7 09:12:51 2016 +0100

    More fix DSA, preserve BN_FLG_CONSTTIME
    
    The previous "fix" still left "k" exposed to constant time problems in
    the later BN_mod_inverse() call. Ensure both k and kq have the
    BN_FLG_CONSTTIME flag set at the earliest opportunity after creation.
    
    CVE-2016-2178
    
    Reviewed-by: Rich Salz <rsalz@openssl.org>
    (cherry picked from commit b7d0f2834e139a20560d64c73e2565e93715ce2b)

Index: openssl-1.0.1i/crypto/dsa/dsa_ossl.c
===================================================================
--- openssl-1.0.1i.orig/crypto/dsa/dsa_ossl.c	2016-08-08 14:31:52.358173351 +0200
+++ openssl-1.0.1i/crypto/dsa/dsa_ossl.c	2016-08-08 14:33:05.147441424 +0200
@@ -278,6 +278,7 @@ static int dsa_sign_setup(DSA *dsa, BN_C
 		{
 		if (!BN_copy(&kq, &k)) goto err;
 
+		BN_set_flags(&kq, BN_FLG_CONSTTIME);
 		/* We do not want timing information to leak the length of k,
 		 * so we compute g^k using an equivalent exponent of fixed length.
 		 *