summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/libcrypto/bn/bn.h17
-rw-r--r--src/lib/libcrypto/bn/bn_print.c19
-rw-r--r--src/lib/libssl/src/crypto/bn/bn.h17
-rw-r--r--src/lib/libssl/src/crypto/bn/bn_print.c19
4 files changed, 52 insertions, 20 deletions
diff --git a/src/lib/libcrypto/bn/bn.h b/src/lib/libcrypto/bn/bn.h
index 2c648ba2ee..5efccd180b 100644
--- a/src/lib/libcrypto/bn/bn.h
+++ b/src/lib/libcrypto/bn/bn.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: bn.h,v 1.28 2015/10/21 19:02:22 miod Exp $ */ 1/* $OpenBSD: bn.h,v 1.29 2016/03/02 06:16:11 doug Exp $ */
2/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -125,6 +125,7 @@
125#ifndef HEADER_BN_H 125#ifndef HEADER_BN_H
126#define HEADER_BN_H 126#define HEADER_BN_H
127 127
128#include <limits.h>
128#include <stdio.h> 129#include <stdio.h>
129#include <stdlib.h> 130#include <stdlib.h>
130 131
@@ -619,10 +620,20 @@ const BIGNUM *BN_get0_nist_prime_521(void);
619 620
620/* library internal functions */ 621/* library internal functions */
621 622
622#define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->dmax)?\
623 (a):bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2))
624#define bn_wexpand(a,words) (((words) <= (a)->dmax)?(a):bn_expand2((a),(words))) 623#define bn_wexpand(a,words) (((words) <= (a)->dmax)?(a):bn_expand2((a),(words)))
625BIGNUM *bn_expand2(BIGNUM *a, int words); 624BIGNUM *bn_expand2(BIGNUM *a, int words);
625
626static inline BIGNUM *bn_expand(BIGNUM *a, int bits)
627{
628 if (bits > (INT_MAX - BN_BITS2 + 1))
629 return (NULL);
630
631 if (((bits + BN_BITS2 - 1) / BN_BITS2) <= a->dmax)
632 return (a);
633
634 return bn_expand2(a, (bits + BN_BITS2 - 1) / BN_BITS2);
635}
636
626#ifndef OPENSSL_NO_DEPRECATED 637#ifndef OPENSSL_NO_DEPRECATED
627BIGNUM *bn_dup_expand(const BIGNUM *a, int words); /* unused */ 638BIGNUM *bn_dup_expand(const BIGNUM *a, int words); /* unused */
628#endif 639#endif
diff --git a/src/lib/libcrypto/bn/bn_print.c b/src/lib/libcrypto/bn/bn_print.c
index 1614a11449..2c1681a2c0 100644
--- a/src/lib/libcrypto/bn/bn_print.c
+++ b/src/lib/libcrypto/bn/bn_print.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: bn_print.c,v 1.28 2015/09/28 18:58:33 deraadt Exp $ */ 1/* $OpenBSD: bn_print.c,v 1.29 2016/03/02 06:16:11 doug Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -57,6 +57,7 @@
57 */ 57 */
58 58
59#include <ctype.h> 59#include <ctype.h>
60#include <limits.h>
60#include <stdio.h> 61#include <stdio.h>
61 62
62#include <openssl/opensslconf.h> 63#include <openssl/opensslconf.h>
@@ -119,7 +120,7 @@ BN_bn2dec(const BIGNUM *a)
119 if (buf == NULL) { 120 if (buf == NULL) {
120 BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE); 121 BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);
121 goto err; 122 goto err;
122 } 123 }
123 p = buf; 124 p = buf;
124 if (BN_is_negative(a)) 125 if (BN_is_negative(a))
125 *p++ = '-'; 126 *p++ = '-';
@@ -127,7 +128,7 @@ BN_bn2dec(const BIGNUM *a)
127 *p++ = '\0'; 128 *p++ = '\0';
128 return (buf); 129 return (buf);
129 } 130 }
130 131
131 /* get an upper bound for the length of the decimal integer 132 /* get an upper bound for the length of the decimal integer
132 * num <= (BN_num_bits(a) + 1) * log(2) 133 * num <= (BN_num_bits(a) + 1) * log(2)
133 * <= 3 * BN_num_bits(a) * 0.1001 + log(2) + 1 (rounding error) 134 * <= 3 * BN_num_bits(a) * 0.1001 + log(2) + 1 (rounding error)
@@ -197,8 +198,10 @@ BN_hex2bn(BIGNUM **bn, const char *a)
197 a++; 198 a++;
198 } 199 }
199 200
200 for (i = 0; isxdigit((unsigned char)a[i]); i++) 201 for (i = 0; i <= (INT_MAX / 4) && isxdigit((unsigned char)a[i]); i++)
201 ; 202 ;
203 if (i > INT_MAX / 4)
204 goto err;
202 205
203 num = i + neg; 206 num = i + neg;
204 if (bn == NULL) 207 if (bn == NULL)
@@ -213,7 +216,7 @@ BN_hex2bn(BIGNUM **bn, const char *a)
213 BN_zero(ret); 216 BN_zero(ret);
214 } 217 }
215 218
216 /* i is the number of hex digests; */ 219 /* i is the number of hex digits */
217 if (bn_expand(ret, i * 4) == NULL) 220 if (bn_expand(ret, i * 4) == NULL)
218 goto err; 221 goto err;
219 222
@@ -271,8 +274,10 @@ BN_dec2bn(BIGNUM **bn, const char *a)
271 a++; 274 a++;
272 } 275 }
273 276
274 for (i = 0; isdigit((unsigned char)a[i]); i++) 277 for (i = 0; i <= (INT_MAX / 4) && isdigit((unsigned char)a[i]); i++)
275 ; 278 ;
279 if (i > INT_MAX / 4)
280 goto err;
276 281
277 num = i + neg; 282 num = i + neg;
278 if (bn == NULL) 283 if (bn == NULL)
@@ -288,7 +293,7 @@ BN_dec2bn(BIGNUM **bn, const char *a)
288 BN_zero(ret); 293 BN_zero(ret);
289 } 294 }
290 295
291 /* i is the number of digests, a bit of an over expand; */ 296 /* i is the number of digits, a bit of an over expand */
292 if (bn_expand(ret, i * 4) == NULL) 297 if (bn_expand(ret, i * 4) == NULL)
293 goto err; 298 goto err;
294 299
diff --git a/src/lib/libssl/src/crypto/bn/bn.h b/src/lib/libssl/src/crypto/bn/bn.h
index 2c648ba2ee..5efccd180b 100644
--- a/src/lib/libssl/src/crypto/bn/bn.h
+++ b/src/lib/libssl/src/crypto/bn/bn.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: bn.h,v 1.28 2015/10/21 19:02:22 miod Exp $ */ 1/* $OpenBSD: bn.h,v 1.29 2016/03/02 06:16:11 doug Exp $ */
2/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -125,6 +125,7 @@
125#ifndef HEADER_BN_H 125#ifndef HEADER_BN_H
126#define HEADER_BN_H 126#define HEADER_BN_H
127 127
128#include <limits.h>
128#include <stdio.h> 129#include <stdio.h>
129#include <stdlib.h> 130#include <stdlib.h>
130 131
@@ -619,10 +620,20 @@ const BIGNUM *BN_get0_nist_prime_521(void);
619 620
620/* library internal functions */ 621/* library internal functions */
621 622
622#define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->dmax)?\
623 (a):bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2))
624#define bn_wexpand(a,words) (((words) <= (a)->dmax)?(a):bn_expand2((a),(words))) 623#define bn_wexpand(a,words) (((words) <= (a)->dmax)?(a):bn_expand2((a),(words)))
625BIGNUM *bn_expand2(BIGNUM *a, int words); 624BIGNUM *bn_expand2(BIGNUM *a, int words);
625
626static inline BIGNUM *bn_expand(BIGNUM *a, int bits)
627{
628 if (bits > (INT_MAX - BN_BITS2 + 1))
629 return (NULL);
630
631 if (((bits + BN_BITS2 - 1) / BN_BITS2) <= a->dmax)
632 return (a);
633
634 return bn_expand2(a, (bits + BN_BITS2 - 1) / BN_BITS2);
635}
636
626#ifndef OPENSSL_NO_DEPRECATED 637#ifndef OPENSSL_NO_DEPRECATED
627BIGNUM *bn_dup_expand(const BIGNUM *a, int words); /* unused */ 638BIGNUM *bn_dup_expand(const BIGNUM *a, int words); /* unused */
628#endif 639#endif
diff --git a/src/lib/libssl/src/crypto/bn/bn_print.c b/src/lib/libssl/src/crypto/bn/bn_print.c
index 1614a11449..2c1681a2c0 100644
--- a/src/lib/libssl/src/crypto/bn/bn_print.c
+++ b/src/lib/libssl/src/crypto/bn/bn_print.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: bn_print.c,v 1.28 2015/09/28 18:58:33 deraadt Exp $ */ 1/* $OpenBSD: bn_print.c,v 1.29 2016/03/02 06:16:11 doug Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -57,6 +57,7 @@
57 */ 57 */
58 58
59#include <ctype.h> 59#include <ctype.h>
60#include <limits.h>
60#include <stdio.h> 61#include <stdio.h>
61 62
62#include <openssl/opensslconf.h> 63#include <openssl/opensslconf.h>
@@ -119,7 +120,7 @@ BN_bn2dec(const BIGNUM *a)
119 if (buf == NULL) { 120 if (buf == NULL) {
120 BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE); 121 BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);
121 goto err; 122 goto err;
122 } 123 }
123 p = buf; 124 p = buf;
124 if (BN_is_negative(a)) 125 if (BN_is_negative(a))
125 *p++ = '-'; 126 *p++ = '-';
@@ -127,7 +128,7 @@ BN_bn2dec(const BIGNUM *a)
127 *p++ = '\0'; 128 *p++ = '\0';
128 return (buf); 129 return (buf);
129 } 130 }
130 131
131 /* get an upper bound for the length of the decimal integer 132 /* get an upper bound for the length of the decimal integer
132 * num <= (BN_num_bits(a) + 1) * log(2) 133 * num <= (BN_num_bits(a) + 1) * log(2)
133 * <= 3 * BN_num_bits(a) * 0.1001 + log(2) + 1 (rounding error) 134 * <= 3 * BN_num_bits(a) * 0.1001 + log(2) + 1 (rounding error)
@@ -197,8 +198,10 @@ BN_hex2bn(BIGNUM **bn, const char *a)
197 a++; 198 a++;
198 } 199 }
199 200
200 for (i = 0; isxdigit((unsigned char)a[i]); i++) 201 for (i = 0; i <= (INT_MAX / 4) && isxdigit((unsigned char)a[i]); i++)
201 ; 202 ;
203 if (i > INT_MAX / 4)
204 goto err;
202 205
203 num = i + neg; 206 num = i + neg;
204 if (bn == NULL) 207 if (bn == NULL)
@@ -213,7 +216,7 @@ BN_hex2bn(BIGNUM **bn, const char *a)
213 BN_zero(ret); 216 BN_zero(ret);
214 } 217 }
215 218
216 /* i is the number of hex digests; */ 219 /* i is the number of hex digits */
217 if (bn_expand(ret, i * 4) == NULL) 220 if (bn_expand(ret, i * 4) == NULL)
218 goto err; 221 goto err;
219 222
@@ -271,8 +274,10 @@ BN_dec2bn(BIGNUM **bn, const char *a)
271 a++; 274 a++;
272 } 275 }
273 276
274 for (i = 0; isdigit((unsigned char)a[i]); i++) 277 for (i = 0; i <= (INT_MAX / 4) && isdigit((unsigned char)a[i]); i++)
275 ; 278 ;
279 if (i > INT_MAX / 4)
280 goto err;
276 281
277 num = i + neg; 282 num = i + neg;
278 if (bn == NULL) 283 if (bn == NULL)
@@ -288,7 +293,7 @@ BN_dec2bn(BIGNUM **bn, const char *a)
288 BN_zero(ret); 293 BN_zero(ret);
289 } 294 }
290 295
291 /* i is the number of digests, a bit of an over expand; */ 296 /* i is the number of digits, a bit of an over expand */
292 if (bn_expand(ret, i * 4) == NULL) 297 if (bn_expand(ret, i * 4) == NULL)
293 goto err; 298 goto err;
294 299
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 15:58:45 +0000