[src/netbsd-6]: src/crypto/external/bsd/openssl/dist/ssl Pull up following re...

[riz <riz%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/0d3e8b4177c4
branches:  netbsd-6
changeset: 774145:0d3e8b4177c4
user:      riz <riz%NetBSD.org@localhost>
date:      Tue May 22 18:44:46 2012 +0000

description:
Pull up following revision(s) (requested by drochner in ticket #276):
        crypto/external/bsd/openssl/dist/ssl/t1_enc.c: revision 1.4
        crypto/external/bsd/openssl/dist/ssl/d1_enc.c: revision 1.2
pull in upstream rev.22547:
Sanity check record length before skipping explicit IV in TLS 1.2, 1.1
and DTLS to fix DoS attack.
(CVE-2012-2333)

diffstat:

 crypto/external/bsd/openssl/dist/ssl/d1_enc.c |  2 +-
 crypto/external/bsd/openssl/dist/ssl/t1_enc.c |  2 ++
 2 files changed, 3 insertions(+), 1 deletions(-)

diffs (24 lines):

diff -r 1a86df3b2347 -r 0d3e8b4177c4 crypto/external/bsd/openssl/dist/ssl/d1_enc.c
--- a/crypto/external/bsd/openssl/dist/ssl/d1_enc.c     Tue May 22 18:38:59 2012 +0000
+++ b/crypto/external/bsd/openssl/dist/ssl/d1_enc.c     Tue May 22 18:44:46 2012 +0000
@@ -260,7 +260,7 @@
                                }
                        /* TLS 1.0 does not bound the number of padding bytes by the block size.
                         * All of them must have value 'padding_length'. */
-                       if (i > (int)rec->length)
+                       if (i + bs > (int)rec->length)
                                {
                                /* Incorrect padding. SSLerr() and ssl3_alert are done
                                 * by caller: we don't want to reveal whether this is
diff -r 1a86df3b2347 -r 0d3e8b4177c4 crypto/external/bsd/openssl/dist/ssl/t1_enc.c
--- a/crypto/external/bsd/openssl/dist/ssl/t1_enc.c     Tue May 22 18:38:59 2012 +0000
+++ b/crypto/external/bsd/openssl/dist/ssl/t1_enc.c     Tue May 22 18:44:46 2012 +0000
@@ -823,6 +823,8 @@
                        if (s->version >= TLS1_1_VERSION
                                && EVP_CIPHER_CTX_mode(ds) == EVP_CIPH_CBC_MODE)
                                {
+                               if (bs > (int)rec->length)
+                                       return -1;
                                rec->data += bs;    /* skip the explicit IV */
                                rec->input += bs;
                                rec->length -= bs;