File openssl-CVE-2022-0778.patch of Package compat-openssl098.29129

From 72082ae738bbfdc552a0af55320cdc3c6fe16e1a Mon Sep 17 00:00:00 2001
From: Tomas Mraz <tomas@openssl.org>
Date: Mon, 28 Feb 2022 18:26:21 +0100
Subject: [PATCH] Fix possible infinite loop in BN_mod_sqrt()

The calculation in some cases does not finish for non-prime p.

This fixes CVE-2022-0778.

Based on patch by David Benjamin <davidben@google.com>.
---
 crypto/bn/bn_sqrt.c | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

Index: openssl-1.0.1g/crypto/bn/bn_sqrt.c
===================================================================
--- openssl-1.0.1g.orig/crypto/bn/bn_sqrt.c
+++ openssl-1.0.1g/crypto/bn/bn_sqrt.c
@@ -64,7 +64,8 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BI
  *      ret^2 == a (mod p),
  * using the Tonelli/Shanks algorithm (cf. Henri Cohen, "A Course
  * in Algebraic Computational Number Theory", algorithm 1.5.1).
- * 'p' must be prime!
+ * 'p' must be prime, otherwise an error or an incorrect "result"
+ *  will be returned.
  */
 	{
 	BIGNUM *ret = in;
@@ -334,21 +335,24 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BI
 			goto vrfy;
 			}
 
-
-		/* find smallest  i  such that  b^(2^i) = 1 */
-		i = 1;
-		if (!BN_mod_sqr(t, b, p, ctx)) goto end;
-		while (!BN_is_one(t))
-			{
-			i++;
-			if (i == e)
-				{
-				BNerr(BN_F_BN_MOD_SQRT, BN_R_NOT_A_SQUARE);
-				goto end;
-				}
-			if (!BN_mod_mul(t, t, t, p, ctx)) goto end;
-			}
-		
+		/* Find the smallest i, 0 < i < e, such that b^(2^i) = 1. */
+		for (i = 1; i < e; i++) {
+	 	    if (i == 1) {
+		        if (!BN_mod_sqr(t, b, p, ctx))
+			    goto end;
+
+		    } else {
+		        if (!BN_mod_mul(t, t, t, p, ctx))
+			    goto end;
+		    }
+		    if (BN_is_one(t))
+		        break;
+		}
+               /* If not found, a is not a square or p is not prime. */
+		if (i >= e) {
+		    BNerr(BN_F_BN_MOD_SQRT, BN_R_NOT_A_SQUARE);
+		    goto end;
+		}
 
 		/* t := y^2^(e - i - 1) */
 		if (!BN_copy(t, y)) goto end;