Menu
▾
▴
[Yassl-commit] yassl/src buffer.cpp, 1.4, 1.5 handshake.cpp, 1.28, 1.29 yassl_imp.cpp, 1.29, 1.30 yassl_int.cpp, 1.36, 1.37
|
From: Todd O. <to...@us...> - 2014-09-18 15:17:25
|
Update of /cvsroot/yassl/yassl/src In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv3275/src Modified Files: buffer.cpp handshake.cpp yassl_imp.cpp yassl_int.cpp Log Message: version 2.3.4 Index: yassl_imp.cpp =================================================================== RCS file: /cvsroot/yassl/yassl/src/yassl_imp.cpp,v retrieving revision 1.29 retrieving revision 1.30 diff -C2 -d -r1.29 -r1.30 *** yassl_imp.cpp 23 Aug 2013 18:13:55 -0000 1.29 --- yassl_imp.cpp 18 Sep 2014 15:17:22 -0000 1.30 *************** *** 229,232 **** --- 229,237 ---- void EncryptedPreMasterSecret::read(SSL& ssl, input_buffer& input) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + const CertManager& cert = ssl.getCrypto().get_certManager(); RSA rsa(cert.get_privateKey(), cert.get_privateKeyLength(), false); *************** *** 234,242 **** if (ssl.isTLS()) { byte len[2]; ! input.read(len, sizeof(len)); ato16(len, cipherLen); } alloc(cipherLen); input.read(secret_, length_); opaque preMasterSecret[SECRET_LEN]; --- 239,252 ---- if (ssl.isTLS()) { byte len[2]; ! len[0] = input[AUTO]; ! len[1] = input[AUTO]; ato16(len, cipherLen); } alloc(cipherLen); input.read(secret_, length_); + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } opaque preMasterSecret[SECRET_LEN]; *************** *** 286,289 **** --- 296,304 ---- void ClientDiffieHellmanPublic::read(SSL& ssl, input_buffer& input) { + if (input.get_error() || input.get_remaining() < (uint)LENGTH_SZ) { + ssl.SetError(bad_input); + return; + } + DiffieHellman& dh = ssl.useCrypto().use_dh(); *************** *** 296,299 **** --- 311,318 ---- alloc(keyLength); input.read(Yc_, keyLength); + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } dh.makeAgreement(Yc_, keyLength); *************** *** 340,343 **** --- 359,366 ---- void DH_Server::read(SSL& ssl, input_buffer& input) { + if (input.get_error() || input.get_remaining() < (uint)LENGTH_SZ) { + ssl.SetError(bad_input); + return; + } uint16 length, messageTotal = 6; // pSz + gSz + pubSz byte tmp[2]; *************** *** 350,353 **** --- 373,380 ---- input.read(parms_.alloc_p(length), length); + if (input.get_error() || input.get_remaining() < (uint)LENGTH_SZ) { + ssl.SetError(bad_input); + return; + } // g *************** *** 358,361 **** --- 385,392 ---- input.read(parms_.alloc_g(length), length); + if (input.get_error() || input.get_remaining() < (uint)LENGTH_SZ) { + ssl.SetError(bad_input); + return; + } // pub *************** *** 366,369 **** --- 397,404 ---- input.read(parms_.alloc_pub(length), length); + if (input.get_error() || input.get_remaining() < (uint)LENGTH_SZ) { + ssl.SetError(bad_input); + return; + } // save message for hash verify *************** *** 372,375 **** --- 407,414 ---- input.read(message.get_buffer(), messageTotal); message.add_size(messageTotal); + if (input.get_error() || input.get_remaining() < (uint)LENGTH_SZ) { + ssl.SetError(bad_input); + return; + } // signature *************** *** 380,383 **** --- 419,426 ---- signature_ = NEW_YS byte[length]; input.read(signature_, length); + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } // verify signature *************** *** 654,657 **** --- 697,704 ---- ssl.verifyState(*this); if (ssl.GetError()) return; + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } const HandShakeFactory& hsf = ssl.getFactory().getHandShake(); mySTL::auto_ptr<HandShakeBase> hs(hsf.CreateObject(type_)); *************** *** 819,824 **** // CipherSpec processing handler ! void ChangeCipherSpec::Process(input_buffer&, SSL& ssl) { ssl.useSecurity().use_parms().pending_ = false; if (ssl.getSecurity().get_resuming()) { --- 866,876 ---- // CipherSpec processing handler ! void ChangeCipherSpec::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + ssl.useSecurity().use_parms().pending_ = false; if (ssl.getSecurity().get_resuming()) { *************** *** 882,885 **** --- 934,942 ---- void Alert::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + if (ssl.getSecurity().get_parms().pending_ == false) { // encrypted alert int aSz = get_length(); // alert size already read on input *************** *** 909,912 **** --- 966,974 ---- } + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + // verify if (memcmp(mac, verify, digestSz)) { *************** *** 1123,1126 **** --- 1185,1193 ---- void Data::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + int msgSz = ssl.getSecurity().get_parms().encrypt_size_; int pad = 0, padByte = 0; *************** *** 1165,1169 **** int dataSz = msgSz - ivExtra - digestSz - pad - padByte; ! if (dataSz < 0) { ssl.SetError(bad_input); return; --- 1232,1236 ---- int dataSz = msgSz - ivExtra - digestSz - pad - padByte; ! if (dataSz < 0 || dataSz > (MAX_RECORD_SIZE + COMPRESS_EXTRA)) { ssl.SetError(bad_input); return; *************** *** 1191,1194 **** --- 1258,1265 ---- // advance past mac and fill input.set_current(input.get_current() + digestSz + pad + padByte); + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } } *************** *** 1255,1258 **** --- 1326,1334 ---- void Certificate::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + CertManager& cm = ssl.useCrypto().use_certManager(); *************** *** 1423,1426 **** --- 1499,1506 ---- // Session hello.id_len_ = input[AUTO]; + if (hello.id_len_ > ID_LEN) { + input.set_error(); + return input; + } if (hello.id_len_) input.read(hello.session_id_, hello.id_len_); *************** *** 1463,1468 **** // Server Hello processing handler ! void ServerHello::Process(input_buffer&, SSL& ssl) { if (ssl.GetMultiProtocol()) { // SSLv23 support if (ssl.isTLS() && server_version_.minor_ < 1) --- 1543,1553 ---- // Server Hello processing handler ! void ServerHello::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + if (ssl.GetMultiProtocol()) { // SSLv23 support if (ssl.isTLS() && server_version_.minor_ < 1) *************** *** 1558,1563 **** // Server Hello Done processing handler ! void ServerHelloDone::Process(input_buffer&, SSL& ssl) { ssl.useStates().useClient() = serverHelloDoneComplete; } --- 1643,1652 ---- // Server Hello Done processing handler ! void ServerHelloDone::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } ssl.useStates().useClient() = serverHelloDoneComplete; } *************** *** 1678,1683 **** // Client Hello processing handler ! void ClientHello::Process(input_buffer&, SSL& ssl) { // store version for pre master secret ssl.useSecurity().use_connection().chVersion_ = client_version_; --- 1767,1777 ---- // Client Hello processing handler ! void ClientHello::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + // store version for pre master secret ssl.useSecurity().use_connection().chVersion_ = client_version_; *************** *** 1811,1817 **** --- 1905,1919 ---- void ServerKeyExchange::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } createKey(ssl); if (ssl.GetError()) return; server_key_->read(ssl, input); + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } ssl.useStates().useClient() = serverKeyExchangeComplete; *************** *** 1935,1943 **** // types request.typeTotal_ = input[AUTO]; for (int i = 0; i < request.typeTotal_; i++) request.certificate_types_[i] = ClientCertificateType(input[AUTO]); ! byte tmp[REQUEST_HEADER]; ! input.read(tmp, sizeof(tmp)); uint16 sz; ato16(tmp, sz); --- 2037,2050 ---- // types request.typeTotal_ = input[AUTO]; + if (request.typeTotal_ > CERT_TYPES) { + input.set_error(); + return input; + } for (int i = 0; i < request.typeTotal_; i++) request.certificate_types_[i] = ClientCertificateType(input[AUTO]); ! byte tmp[2]; ! tmp[0] = input[AUTO]; ! tmp[1] = input[AUTO]; uint16 sz; ato16(tmp, sz); *************** *** 1946,1950 **** while (sz) { uint16 dnSz; ! input.read(tmp, sizeof(tmp)); ato16(tmp, dnSz); --- 2053,2058 ---- while (sz) { uint16 dnSz; ! tmp[0] = input[AUTO]; ! tmp[1] = input[AUTO]; ato16(tmp, dnSz); *************** *** 1956,1959 **** --- 2064,2070 ---- sz -= dnSz + REQUEST_HEADER; + + if (input.get_error()) + break; } *************** *** 1994,1999 **** // CertificateRequest processing handler ! void CertificateRequest::Process(input_buffer&, SSL& ssl) { CertManager& cm = ssl.useCrypto().use_certManager(); --- 2105,2114 ---- // CertificateRequest processing handler ! void CertificateRequest::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } CertManager& cm = ssl.useCrypto().use_certManager(); *************** *** 2078,2082 **** { byte tmp[VERIFY_HEADER]; ! input.read(tmp, sizeof(tmp)); uint16 sz = 0; --- 2193,2198 ---- { byte tmp[VERIFY_HEADER]; ! tmp[0] = input[AUTO]; ! tmp[1] = input[AUTO]; uint16 sz = 0; *************** *** 2102,2107 **** // CertificateVerify processing handler ! void CertificateVerify::Process(input_buffer&, SSL& ssl) { const Hashes& hashVerify = ssl.getHashes().get_certVerify(); const CertManager& cert = ssl.getCrypto().get_certManager(); --- 2218,2228 ---- // CertificateVerify processing handler ! void CertificateVerify::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } + const Hashes& hashVerify = ssl.getHashes().get_certVerify(); const CertManager& cert = ssl.getCrypto().get_certManager(); *************** *** 2142,2148 **** --- 2263,2277 ---- void ClientKeyExchange::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } createKey(ssl); if (ssl.GetError()) return; client_key_->read(ssl, input); + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } if (ssl.getCrypto().get_certManager().verifyPeer()) *************** *** 2231,2234 **** --- 2360,2367 ---- void Finished::Process(input_buffer& input, SSL& ssl) { + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } // verify hashes const Finished& verify = ssl.getHashes().get_verify(); *************** *** 2236,2239 **** --- 2369,2376 ---- input.read(hashes_.md5_, finishedSz); + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } if (memcmp(&hashes_, &verify.hashes_, finishedSz)) { *************** *** 2257,2260 **** --- 2394,2401 ---- int digestSz = ssl.getCrypto().get_digest().get_digestSize(); input.read(mac, digestSz); + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } uint ivExtra = 0; *************** *** 2268,2271 **** --- 2409,2416 ---- for (int i = 0; i < padSz; i++) fill = input[AUTO]; + if (input.get_error()) { + ssl.SetError(bad_input); + return; + } // verify mac Index: buffer.cpp =================================================================== RCS file: /cvsroot/yassl/yassl/src/buffer.cpp,v retrieving revision 1.4 retrieving revision 1.5 diff -C2 -d -r1.4 -r1.5 *** buffer.cpp 26 Jan 2010 22:46:02 -0000 1.4 --- buffer.cpp 18 Sep 2014 15:17:22 -0000 1.5 *************** *** 41,46 **** ! void NoCheck::check(uint, uint) { } --- 41,57 ---- ! /* return 0 on check success, always true for NoCheck policy */ ! int NoCheck::check(uint, uint) ! { ! return 0; ! } ! ! /* return 0 on check success */ ! int Check::check(uint i, uint max) { + if (i < max) + return 0; + + return -1; } *************** *** 57,66 **** input_buffer::input_buffer() ! : size_(0), current_(0), buffer_(0), end_(0) {} input_buffer::input_buffer(uint s) ! : size_(0), current_(0), buffer_(NEW_YS byte[s]), end_(buffer_ + s) {} --- 68,78 ---- input_buffer::input_buffer() ! : size_(0), current_(0), buffer_(0), end_(0), error_(0), zero_(0) {} input_buffer::input_buffer(uint s) ! : size_(0), current_(0), buffer_(NEW_YS byte[s]), end_(buffer_ + s), ! error_(0), zero_(0) {} *************** *** 68,72 **** // with assign input_buffer::input_buffer(uint s, const byte* t, uint len) ! : size_(0), current_(0), buffer_(NEW_YS byte[s]), end_(buffer_ + s) { assign(t, len); --- 80,85 ---- // with assign input_buffer::input_buffer(uint s, const byte* t, uint len) ! : size_(0), current_(0), buffer_(NEW_YS byte[s]), end_(buffer_ + s), ! error_(0), zero_(0) { assign(t, len); *************** *** 83,88 **** void input_buffer::allocate(uint s) { ! buffer_ = NEW_YS byte[s]; ! end_ = buffer_ + s; } --- 96,103 ---- void input_buffer::allocate(uint s) { ! if (error_ == 0) { ! buffer_ = NEW_YS byte[s]; ! end_ = buffer_ + s; ! } } *************** *** 99,104 **** void input_buffer::add_size(uint i) { ! check(size_ + i-1, get_capacity()); ! size_ += i; } --- 114,121 ---- void input_buffer::add_size(uint i) { ! if (error_ == 0 && check(size_ + i-1, get_capacity()) == 0) ! size_ += i; ! else ! error_ = -1; } *************** *** 106,110 **** uint input_buffer::get_capacity() const { ! return end_ - buffer_; } --- 123,130 ---- uint input_buffer::get_capacity() const { ! if (error_ == 0) ! return end_ - buffer_; ! ! return 0; } *************** *** 112,116 **** uint input_buffer::get_current() const { ! return current_; } --- 132,139 ---- uint input_buffer::get_current() const { ! if (error_ == 0) ! return current_; ! ! return 0; } *************** *** 118,122 **** uint input_buffer::get_size() const { ! return size_; } --- 141,148 ---- uint input_buffer::get_size() const { ! if (error_ == 0) ! return size_; ! ! return 0; } *************** *** 124,128 **** uint input_buffer::get_remaining() const { ! return size_ - current_; } --- 150,169 ---- uint input_buffer::get_remaining() const { ! if (error_ == 0) ! return size_ - current_; ! ! return 0; ! } ! ! ! int input_buffer::get_error() const ! { ! return error_; ! } ! ! ! void input_buffer::set_error() ! { ! error_ = -1; } *************** *** 130,136 **** void input_buffer::set_current(uint i) { ! if (i) ! check(i - 1, size_); ! current_ = i; } --- 171,178 ---- void input_buffer::set_current(uint i) { ! if (error_ == 0 && i && check(i - 1, size_) == 0) ! current_ = i; ! else ! error_ = -1; } *************** *** 140,145 **** const byte& input_buffer::operator[](uint i) { ! check(current_, size_); ! return buffer_[current_++]; } --- 182,190 ---- const byte& input_buffer::operator[](uint i) { ! if (error_ == 0 && check(current_, size_) == 0) ! return buffer_[current_++]; ! ! error_ = -1; ! return zero_; } *************** *** 148,151 **** --- 193,199 ---- bool input_buffer::eof() { + if (error_ != 0) + return true; + return current_ >= size_; } *************** *** 153,159 **** // peek ahead ! byte input_buffer::peek() const { ! return buffer_[current_]; } --- 201,211 ---- // peek ahead ! byte input_buffer::peek() { ! if (error_ == 0 && check(current_, size_) == 0) ! return buffer_[current_]; ! ! error_ = -1; ! return 0; } *************** *** 162,168 **** void input_buffer::assign(const byte* t, uint s) { ! check(current_, get_capacity()); ! add_size(s); ! memcpy(&buffer_[current_], t, s); } --- 214,226 ---- void input_buffer::assign(const byte* t, uint s) { ! if (t && error_ == 0 && check(current_, get_capacity()) == 0) { ! add_size(s); ! if (error_ == 0) { ! memcpy(&buffer_[current_], t, s); ! return; // success ! } ! } ! ! error_ = -1; } *************** *** 171,177 **** void input_buffer::read(byte* dst, uint length) { ! check(current_ + length - 1, size_); ! memcpy(dst, &buffer_[current_], length); ! current_ += length; } --- 229,238 ---- void input_buffer::read(byte* dst, uint length) { ! if (dst && error_ == 0 && check(current_ + length - 1, size_) == 0) { ! memcpy(dst, &buffer_[current_], length); ! current_ += length; ! } else { ! error_ = -1; ! } } Index: yassl_int.cpp =================================================================== RCS file: /cvsroot/yassl/yassl/src/yassl_int.cpp,v retrieving revision 1.36 retrieving revision 1.37 diff -C2 -d -r1.36 -r1.37 *** yassl_int.cpp 19 Sep 2011 19:28:51 -0000 1.36 --- yassl_int.cpp 18 Sep 2014 15:17:22 -0000 1.37 *************** *** 2543,2548 **** { byte tmp[LENGTH_SZ]; ! ! in.read(tmp, sizeof(tmp)); uint16 len; --- 2543,2549 ---- { byte tmp[LENGTH_SZ]; ! ! tmp[0] = in[AUTO]; ! tmp[1] = in[AUTO]; uint16 len; Index: handshake.cpp =================================================================== RCS file: /cvsroot/yassl/yassl/src/handshake.cpp,v retrieving revision 1.28 retrieving revision 1.29 diff -C2 -d -r1.28 -r1.29 *** handshake.cpp 23 Aug 2013 18:13:55 -0000 1.28 --- handshake.cpp 18 Sep 2014 15:17:22 -0000 1.29 *************** *** 531,535 **** void ProcessOldClientHello(input_buffer& input, SSL& ssl) { ! if (input.get_remaining() < 2) { ssl.SetError(bad_input); return; --- 531,535 ---- void ProcessOldClientHello(input_buffer& input, SSL& ssl) { ! if (input.get_error() || input.get_remaining() < 2) { ssl.SetError(bad_input); return; *************** *** 558,575 **** byte len[2]; ! input.read(len, sizeof(len)); ato16(len, ch.suite_len_); ! input.read(len, sizeof(len)); uint16 sessionLen; ato16(len, sessionLen); ch.id_len_ = sessionLen; ! input.read(len, sizeof(len)); uint16 randomLen; ato16(len, randomLen); ! if (ch.suite_len_ > MAX_SUITE_SZ || sessionLen > ID_LEN || ! randomLen > RAN_LEN) { ssl.SetError(bad_input); return; --- 558,579 ---- byte len[2]; ! len[0] = input[AUTO]; ! len[1] = input[AUTO]; ato16(len, ch.suite_len_); ! len[0] = input[AUTO]; ! len[1] = input[AUTO]; uint16 sessionLen; ato16(len, sessionLen); ch.id_len_ = sessionLen; ! len[0] = input[AUTO]; ! len[1] = input[AUTO]; uint16 randomLen; ato16(len, randomLen); ! if (input.get_error() || ch.suite_len_ > MAX_SUITE_SZ || ! ch.suite_len_ > input.get_remaining() || ! sessionLen > ID_LEN || randomLen > RAN_LEN) { ssl.SetError(bad_input); return; *************** *** 589,593 **** if (ch.id_len_) ! input.read(ch.session_id_, ch.id_len_); if (randomLen < RAN_LEN) --- 593,597 ---- if (ch.id_len_) ! input.read(ch.session_id_, ch.id_len_); // id_len_ from sessionLen if (randomLen < RAN_LEN) *************** *** 595,599 **** input.read(&ch.random_[RAN_LEN - randomLen], randomLen); - ch.Process(input, ssl); } --- 599,602 ---- *************** *** 796,799 **** --- 799,805 ---- } + if (ssl.GetError()) + return 0; + // make sure we have enough input in buffer to process this record if (needHdr || hdr.length_ > buffer.get_remaining()) { *************** *** 809,812 **** --- 815,821 ---- // each message in record, can be more than 1 if not encrypted + if (ssl.GetError()) + return 0; + if (ssl.getSecurity().get_parms().pending_ == false) { // cipher on // sanity check for malicious/corrupted/illegal input |