import OpenSSL 1.0.0e

1 files changed, 60 insertions, 28 deletions

diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index e8bc34c111..85371c87b8 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -714,14 +714,23 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                 switch (servname_type)
                                         {
                                 case TLSEXT_NAMETYPE_host_name:
-                                        if (s->session->tlsext_hostname == NULL)
+                                        if (!s->hit)
                                                 {
-                                                if (len > TLSEXT_MAXLEN_host_name || 
-                                                        ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
+                                                if(s->session->tlsext_hostname)
+                                                        {
+                                                        *al = SSL_AD_DECODE_ERROR;
+                                                        return 0;
+                                                        }
+                                                if (len > TLSEXT_MAXLEN_host_name)
                                                         {
                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
                                                         return 0;
                                                         }
+                                                if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
+                                                        {
+                                                        *al = TLS1_AD_INTERNAL_ERROR;
+                                                        return 0;
+                                                        }
                                                 memcpy(s->session->tlsext_hostname, sdata, len);
                                                 s->session->tlsext_hostname[len]='\0';
                                                 if (strlen(s->session->tlsext_hostname) != len) {
@@ -734,7 +743,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 
                                                 }
                                         else 
-                                                s->servername_done = strlen(s->session->tlsext_hostname) == len 
+                                                s->servername_done = s->session->tlsext_hostname
+                                                        && strlen(s->session->tlsext_hostname) == len 
                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
                                         
                                         break;
@@ -765,15 +775,22 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                 *al = TLS1_AD_DECODE_ERROR;
                                 return 0;
                                 }
-                        s->session->tlsext_ecpointformatlist_length = 0;
-                        if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
-                        if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
+                        if (!s->hit)
                                 {
-                                *al = TLS1_AD_INTERNAL_ERROR;
-                                return 0;
+                                if(s->session->tlsext_ecpointformatlist)
+                                        {
+                                        OPENSSL_free(s->session->tlsext_ecpointformatlist);
+                                        s->session->tlsext_ecpointformatlist = NULL;
+                                        }
+                                s->session->tlsext_ecpointformatlist_length = 0;
+                                if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
+                                        {
+                                        *al = TLS1_AD_INTERNAL_ERROR;
+                                        return 0;
+                                        }
+                                s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
+                                memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
                                 }
-                        s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
-                        memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 #if 0
                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
                         sdata = s->session->tlsext_ecpointformatlist;
@@ -794,15 +811,22 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                 *al = TLS1_AD_DECODE_ERROR;
                                 return 0;
                                 }
-                        s->session->tlsext_ellipticcurvelist_length = 0;
-                        if (s->session->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->session->tlsext_ellipticcurvelist);
-                        if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
+                        if (!s->hit)
                                 {
-                                *al = TLS1_AD_INTERNAL_ERROR;
-                                return 0;
+                                if(s->session->tlsext_ellipticcurvelist)
+                                        {
+                                        *al = TLS1_AD_DECODE_ERROR;
+                                        return 0;
+                                        }
+                                s->session->tlsext_ellipticcurvelist_length = 0;
+                                if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
+                                        {
+                                        *al = TLS1_AD_INTERNAL_ERROR;
+                                        return 0;
+                                        }
+                                s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
+                                memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
                                 }
-                        s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
-                        memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 #if 0
                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
                         sdata = s->session->tlsext_ellipticcurvelist;
@@ -893,6 +917,7 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                                 }
                                         n2s(data, idsize);
                                         dsize -= 2 + idsize;
+                                        size -= 2 + idsize;
                                         if (dsize < 0)
                                                 {
                                                 *al = SSL_AD_DECODE_ERROR;
@@ -931,9 +956,14 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                         }
 
                                 /* Read in request_extensions */
+                                if (size < 2)
+                                        {
+                                        *al = SSL_AD_DECODE_ERROR;
+                                        return 0;
+                                        }
                                 n2s(data,dsize);
                                 size -= 2;
-                                if (dsize > size) 
+                                if (dsize != size)
                                         {
                                         *al = SSL_AD_DECODE_ERROR;
                                         return 0;
@@ -983,9 +1013,9 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 
 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
         {
+        unsigned short length;
         unsigned short type;
         unsigned short size;
-        unsigned short len;  
         unsigned char *data = *p;
         int tlsext_servername = 0;
         int renegotiate_seen = 0;
@@ -993,7 +1023,12 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
         if (data >= (d+n-2))
                 goto ri_check;
 
-        n2s(data,len);
+        n2s(data,length);
+        if (data+length != d+n)
+                {
+                *al = SSL_AD_DECODE_ERROR;
+                return 0;
+                }
 
         while(data <= (d+n-4))
                 {
@@ -1423,23 +1458,20 @@ int ssl_check_serverhello_tlsext(SSL *s)
         int al = SSL_AD_UNRECOGNIZED_NAME;
 
 #ifndef OPENSSL_NO_EC
-        /* If we are client and using an elliptic curve cryptography cipher suite, then server
-         * must return a an EC point formats lists containing uncompressed.
+        /* If we are client and using an elliptic curve cryptography cipher
+         * suite, then if server returns an EC point formats lists extension
+         * it must contain uncompressed.
          */
         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) && 
+            (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && 
             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
                 {
                 /* we are using an ECC cipher */
                 size_t i;
                 unsigned char *list;
                 int found_uncompressed = 0;
-                if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
-                        {
-                        SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
-                        return -1;
-                        }
                 list = s->session->tlsext_ecpointformatlist;
                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
                         {