1 files changed, 33 insertions, 42 deletions

diff --git a/src/lib/libssl/src/crypto/rsa/rsa_pk1.c b/src/lib/libssl/src/crypto/rsa/rsa_pk1.c
index 2791291b94..c1edd6764f 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_pk1.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_pk1.c
@@ -58,27 +58,12 @@
 
 #include <stdio.h>
 #include "cryptlib.h"
-#include "bn.h"
-#include "rsa.h"
-#include "rand.h"
-
-#ifndef NOPROTO
-int RSA_padding_add_PKCS1_type_1();
-int RSA_padding_check_PKCS1_type_1();
-int RSA_padding_add_PKCS1_type_2();
-int RSA_padding_check_PKCS1_type_2();
-int RSA_padding_add_SSLv23();
-int RSA_padding_check_SSLv23();
-int RSA_padding_add_none();
-int RSA_padding_check_none();
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/rand.h>
 
-#endif
-
-int RSA_padding_add_PKCS1_type_1(to,tlen,from,flen)
-unsigned char *to;
-int tlen;
-unsigned char *from;
-int flen;
+int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
+             const unsigned char *from, int flen)
         {
         int j;
         unsigned char *p;
@@ -94,7 +79,7 @@ int flen;
         *(p++)=0;
         *(p++)=1; /* Private Key BT (Block Type) */
 
-        /* padd out with 0xff data */
+        /* pad out with 0xff data */
         j=tlen-3-flen;
         memset(p,0xff,j);
         p+=j;
@@ -103,17 +88,14 @@ int flen;
         return(1);
         }
 
-int RSA_padding_check_PKCS1_type_1(to,tlen,from,flen)
-unsigned char *to;
-int tlen;
-unsigned char *from;
-int flen;
+int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
+             const unsigned char *from, int flen, int num)
         {
         int i,j;
-        unsigned char *p;
+        const unsigned char *p;
 
         p=from;
-        if (*(p++) != 01)
+        if ((num != (flen+1)) || (*(p++) != 01))
                 {
                 RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_BLOCK_TYPE_IS_NOT_01);
                 return(-1);
@@ -148,16 +130,18 @@ int flen;
                 }
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);
         }
 
-int RSA_padding_add_PKCS1_type_2(to,tlen,from,flen)
-unsigned char *to;
-int tlen;
-unsigned char *from;
-int flen;
+int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
+             const unsigned char *from, int flen)
         {
         int i,j;
         unsigned char *p;
@@ -176,12 +160,14 @@ int flen;
         /* pad out with non-zero random data */
         j=tlen-3-flen;
 
-        RAND_bytes(p,j);
+        if (RAND_bytes(p,j) <= 0)
+                return(0);
         for (i=0; i<j; i++)
                 {
                 if (*p == '\0')
                         do      {
-                                RAND_bytes(p,1);
+                                if (RAND_bytes(p,1) <= 0)
+                                        return(0);
                                 } while (*p == '\0');
                 p++;
                 }
@@ -192,21 +178,21 @@ int flen;
         return(1);
         }
 
-int RSA_padding_check_PKCS1_type_2(to,tlen,from,flen)
-unsigned char *to;
-int tlen;
-unsigned char *from;
-int flen;
+int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
+             const unsigned char *from, int flen, int num)
         {
         int i,j;
-        unsigned char *p;
+        const unsigned char *p;
 
         p=from;
-        if (*(p++) != 02)
+        if ((num != (flen+1)) || (*(p++) != 02))
                 {
                 RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_BLOCK_TYPE_IS_NOT_02);
                 return(-1);
                 }
+#ifdef PKCS1_CHECK
+        return(num-11);
+#endif
 
         /* scan over padding data */
         j=flen-1; /* one for type. */
@@ -226,6 +212,11 @@ int flen;
                 }
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);