[src/netbsd-3-0]: src/crypto/dist/openssl/ssl ull up following revision(s) (r...

[msaitoh <msaitoh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f0ecafd1929b
branches:  netbsd-3-0
changeset: 579466:f0ecafd1929b
user:      msaitoh <msaitoh%NetBSD.org@localhost>
date:      Wed Dec 19 17:54:47 2007 +0000

description:
ull up following revision(s) (requested by drochner in ticket #1891):
        crypto/dist/openssl/ssl/ssl_lib.c: revision 1.4
apply a patch from openssl CVS to fix a remaining off-by-one error in an older
security fix, see http://www.securityfocus.com/archive/1/480855/30/0/threaded
(CVE-2007-4995)

diffstat:

 crypto/dist/openssl/ssl/ssl_lib.c |  22 +++++++++++-----------
 1 files changed, 11 insertions(+), 11 deletions(-)

diffs (43 lines):

diff -r 119f81413dd2 -r f0ecafd1929b crypto/dist/openssl/ssl/ssl_lib.c
--- a/crypto/dist/openssl/ssl/ssl_lib.c Thu Nov 22 19:09:12 2007 +0000
+++ b/crypto/dist/openssl/ssl/ssl_lib.c Wed Dec 19 17:54:47 2007 +0000
@@ -1148,7 +1148,6 @@
 char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
        {
        char *p;
-       const char *cp;
        STACK_OF(SSL_CIPHER) *sk;
        SSL_CIPHER *c;
        int i;
@@ -1161,20 +1160,21 @@
        sk=s->session->ciphers;
        for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
                {
-               /* Decrement for either the ':' or a '\0' */
-               len--;
+               int n;
+
                c=sk_SSL_CIPHER_value(sk,i);
-               for (cp=c->name; *cp; )
+               n=strlen(c->name);
+               if (n+1 > len)
                        {
-                       if (len-- <= 0)
-                               {
-                               *p='\0';
-                               return(buf);
-                               }
-                       else
-                               *(p++)= *(cp++);
+                       if (p != buf)
+                               --p;
+                       *p='\0';
+                       return buf;
                        }
+               strcpy(p,c->name);
+               p+=n;
                *(p++)=':';
+               len-=n+1;
                }
        p[-1]='\0';
        return(buf);