Fix two possible crash causing defects.OPENBSD_5_5

CVE-2015-0286 - Apply fix from OpenSSL for ASN1_TYPE_cmp.
CVE-2015-0292 - Backport existing fix for Base64 decoding.

2 files changed, 16 insertions, 0 deletions

diff --git a/src/lib/libssl/src/crypto/asn1/a_type.c b/src/lib/libssl/src/crypto/asn1/a_type.c
index a45d2f9d12..b968cf0170 100644
--- a/src/lib/libssl/src/crypto/asn1/a_type.c
+++ b/src/lib/libssl/src/crypto/asn1/a_type.c
@@ -124,6 +124,9 @@ int ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b)
         case V_ASN1_OBJECT:
                 result = OBJ_cmp(a->value.object, b->value.object);
                 break;
+        case V_ASN1_BOOLEAN:
+                result = a->value.boolean - b->value.boolean;
+                break;
         case V_ASN1_NULL:
                 result = 0;     /* They do not have content. */
                 break;
diff --git a/src/lib/libssl/src/crypto/evp/encode.c b/src/lib/libssl/src/crypto/evp/encode.c
index 28546a84bc..6a867668f3 100644
--- a/src/lib/libssl/src/crypto/evp/encode.c
+++ b/src/lib/libssl/src/crypto/evp/encode.c
@@ -269,6 +269,13 @@ int EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
                         goto end;
                         }
 
+                /* There should not be base64 data after padding. */
+                if (eof && tmp != '=' && tmp != '\r' && tmp != '\n' &&
+                    v != B64_EOF) {
+                        rv = -1;
+                        goto end;
+                }
+
                 /* have we seen a '=' which is 'definitly' the last
                  * input line.  seof will point to the character that
                  * holds it. and eof will hold how many characters to
@@ -279,6 +286,12 @@ int EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
                         eof++;
                         }
 
+                /* There should be no more than two padding markers. */
+                if (eof > 2) {
+                        rv = -1;
+                        goto end;
+                }
+
                 if (v == B64_CR)
                         {
                         ln = 0;