File gnutls-CVE-2014-8564.patch of Package gnutls

Overview Repositories Revisions Requests Users Attributes Meta

File gnutls-CVE-2014-8564.patch of Package gnutls (Revision 9d29c87c40d62d928ff3ca856e5f0199)

Currently displaying revision 9d29c87c40d62d928ff3ca856e5f0199 , Show latest

commit a737abecf1affa08469ca2e9804eb3b6e95027e9
Author: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date:   Mon Nov 10 07:44:11 2014 +0100

when exporting curve coordinates to X9.63 format, perform additional sanity checks on input
    
    Reported by Sean Burford.

diff --git a/lib/gnutls_ecc.c b/lib/gnutls_ecc.c
index 774b5b6..abc532b 100644
--- a/lib/gnutls_ecc.c
+++ b/lib/gnutls_ecc.c
@@ -53,24 +53,41 @@ _gnutls_ecc_ansi_x963_export(gnutls_ecc_curve_t curve, bigint_t x,
 
 	/* pad and store x */
 	byte_size = (_gnutls_mpi_get_nbits(x) + 7) / 8;
+	if (numlen < byte_size) {
+		ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+		goto cleanup;
+	}
+
 	size = out->size - (1 + (numlen - byte_size));
 	ret =
 	    _gnutls_mpi_print(x, &out->data[1 + (numlen - byte_size)],
 			      &size);
-	if (ret < 0)
-		return gnutls_assert_val(ret);
+	if (ret < 0) {
+		gnutls_assert();
+		goto cleanup;
+	}
 
 	byte_size = (_gnutls_mpi_get_nbits(y) + 7) / 8;
+	if (numlen < byte_size) {
+		ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+		goto cleanup;
+	}
+
 	size = out->size - (1 + (numlen + numlen - byte_size));
 	ret =
 	    _gnutls_mpi_print(y,
 			      &out->data[1 + numlen + numlen - byte_size],
 			      &size);
-	if (ret < 0)
-		return gnutls_assert_val(ret);
+	if (ret < 0) {
+		gnutls_assert();
+		goto cleanup;
+	}
 
 	/* pad and store y */
 	return 0;
+ cleanup:
+ 	_gnutls_free_datum(out);
+ 	return ret;
 }

Places

File gnutls-CVE-2014-8564.patch of Package gnutls (Revision 9d29c87c40d62d928ff3ca856e5f0199)

Places