1 files changed, 19 insertions, 18 deletions

diff --git a/src/lib/libcrypto/rsa/rsa_ssl.c b/src/lib/libcrypto/rsa/rsa_ssl.c
index 9bcd4b2c03..ea72629494 100644
--- a/src/lib/libcrypto/rsa/rsa_ssl.c
+++ b/src/lib/libcrypto/rsa/rsa_ssl.c
@@ -58,15 +58,12 @@
 
 #include <stdio.h>
 #include "cryptlib.h"
-#include "bn.h"
-#include "rsa.h"
-#include "rand.h"
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/rand.h>
 
-int RSA_padding_add_SSLv23(to,tlen,from,flen)
-unsigned char *to;
-int tlen;
-unsigned char *from;
-int flen;
+int RSA_padding_add_SSLv23(unsigned char *to, int tlen,
+        const unsigned char *from, int flen)
         {
         int i,j;
         unsigned char *p;
@@ -85,12 +82,14 @@ int flen;
         /* pad out with non-zero random data */
         j=tlen-3-8-flen;
 
-        RAND_bytes(p,j);
+        if (RAND_bytes(p,j) <= 0)
+                return(0);
         for (i=0; i<j; i++)
                 {
                 if (*p == '\0')
                         do      {
-                                RAND_bytes(p,1);
+                                if (RAND_bytes(p,1) <= 0)
+                                        return(0);
                                 } while (*p == '\0');
                 p++;
                 }
@@ -103,14 +102,11 @@ int flen;
         return(1);
         }
 
-int RSA_padding_check_SSLv23(to,tlen,from,flen)
-unsigned char *to;
-int tlen;
-unsigned char *from;
-int flen;
+int RSA_padding_check_SSLv23(unsigned char *to, int tlen,
+        const unsigned char *from, int flen, int num)
         {
         int i,j,k;
-        unsigned char *p;
+        const unsigned char *p;
 
         p=from;
         if (flen < 10)
@@ -118,7 +114,7 @@ int flen;
                 RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,RSA_R_DATA_TOO_SMALL);
                 return(-1);
                 }
-        if (*(p++) != 02)
+        if ((num != (flen+1)) || (*(p++) != 02))
                 {
                 RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,RSA_R_BLOCK_TYPE_IS_NOT_02);
                 return(-1);
@@ -138,7 +134,7 @@ int flen;
                 {
                 if (p[k] !=  0x03) break;
                 }
-        if (k == 0)
+        if (k == -1)
                 {
                 RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,RSA_R_SSLV3_ROLLBACK_ATTACK);
                 return(-1);
@@ -146,6 +142,11 @@ int flen;
 
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);