Fix CVE-2014-3570: properly calculate the square of a BIGNUM value.

See https://www.openssl.org/news/secadv_20150108.txt for a more detailed
discussion.

Original OpenSSL patch here:
https://github.com/openssl/openssl/commit/a7a44ba55cb4f884c6bc9ceac90072dea38e66d0

The regression test is modified a little for KNF.
ok miod@

1 files changed, 66 insertions, 23 deletions

diff --git a/src/regress/lib/libcrypto/bn/general/bntest.c b/src/regress/lib/libcrypto/bn/general/bntest.c
index 9debc00042..6a9c2e8a53 100644
--- a/src/regress/lib/libcrypto/bn/general/bntest.c
+++ b/src/regress/lib/libcrypto/bn/general/bntest.c
@@ -690,42 +690,85 @@ test_mul(BIO *bp)
 int
 test_sqr(BIO *bp, BN_CTX *ctx)
 {
-        BIGNUM a, c,d, e;
-        int i;
-        int rc = 1;
+        BIGNUM *a, *c, *d, *e;
+        int i, ret = 0;
 
-        BN_init(&a);
-        BN_init(&c);
-        BN_init(&d);
-        BN_init(&e);
+        a = BN_new();
+        c = BN_new();
+        d = BN_new();
+        e = BN_new();
 
         for (i = 0; i < num0; i++) {
-                BN_bntest_rand(&a, 40 + i*10, 0, 0);
-                a.neg = rand_neg();
-                BN_sqr(&c, &a, ctx);
+                BN_bntest_rand(a, 40 + i * 10, 0, 0);
+                a->neg = rand_neg();
+                BN_sqr(c, a, ctx);
                 if (bp != NULL) {
                         if (!results) {
-                                BN_print(bp, &a);
+                                BN_print(bp, a);
                                 BIO_puts(bp, " * ");
-                                BN_print(bp, &a);
+                                BN_print(bp, a);
                                 BIO_puts(bp, " - ");
                         }
-                        BN_print(bp, &c);
+                        BN_print(bp, c);
                         BIO_puts(bp, "\n");
                 }
-                BN_div(&d, &e, &c, &a, ctx);
-                BN_sub(&d, &d, &a);
-                if (!BN_is_zero(&d) || !BN_is_zero(&e)) {
+                BN_div(d, e, c, a, ctx);
+                BN_sub(d, d, a);
+                if (!BN_is_zero(d) || !BN_is_zero(e)) {
                         fprintf(stderr, "Square test failed!\n");
-                        rc = 0;
-                        break;
+                        goto err;
                 }
         }
-        BN_free(&a);
-        BN_free(&c);
-        BN_free(&d);
-        BN_free(&e);
-        return (rc);
+
+        /* Regression test for a BN_sqr overflow bug. */
+        BN_hex2bn(&a, "80000000000000008000000000000001"
+            "FFFFFFFFFFFFFFFE0000000000000000");
+        BN_sqr(c, a, ctx);
+        if (bp != NULL) {
+                if (!results) {
+                        BN_print(bp, a);
+                        BIO_puts(bp, " * ");
+                        BN_print(bp, a);
+                        BIO_puts(bp, " - ");
+                }
+                BN_print(bp, c);
+                BIO_puts(bp, "\n");
+        }
+        BN_mul(d, a, a, ctx);
+        if (BN_cmp(c, d)) {
+                fprintf(stderr,
+                    "Square test failed: BN_sqr and BN_mul produce "
+                    "different results!\n");
+                goto err;
+        }
+
+        /* Regression test for a BN_sqr overflow bug. */
+        BN_hex2bn(&a, "80000000000000000000000080000001"
+            "FFFFFFFE000000000000000000000000");
+        BN_sqr(c, a, ctx);
+        if (bp != NULL) {
+                if (!results) {
+                        BN_print(bp, a);
+                        BIO_puts(bp, " * ");
+                        BN_print(bp, a);
+                        BIO_puts(bp, " - ");
+                }
+                BN_print(bp, c);
+                BIO_puts(bp, "\n");
+        }
+        BN_mul(d, a, a, ctx);
+        if (BN_cmp(c, d)) {
+                fprintf(stderr, "Square test failed: BN_sqr and BN_mul produce "
+                                "different results!\n");
+                goto err;
+        }
+        ret = 1;
+ err:
+        BN_free(a);
+        BN_free(c);
+        BN_free(d);
+        BN_free(e);
+        return ret;
 }
 
 int