aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSimon L. B. Nielsen <simon@FreeBSD.org>2007-10-03 21:42:32 +0000
committerSimon L. B. Nielsen <simon@FreeBSD.org>2007-10-03 21:42:32 +0000
commit36cf2a86b4cd33c821387edc40f82254724a0851 (patch)
tree6b3caef7bf88700a798aad35c8a7e666ccb0993b
parent6c74b7e589a31e23b44a1b1611bd0fcf91c9f887 (diff)
downloadsrc-36cf2a86b4cd33c821387edc40f82254724a0851.tar.gz
src-36cf2a86b4cd33c821387edc40f82254724a0851.zip
Correct a buffer overflow in OpenSSL SSL_get_shared_ciphers().
Security: FreeBSD-SA-07:08.openssl Approved by: so (simon)
Notes
Notes: svn path=/releng/5.5/; revision=172432
-rw-r--r--UPDATING3
-rw-r--r--crypto/openssl/ssl/ssl_lib.c22
-rw-r--r--sys/conf/newvers.sh2
3 files changed, 15 insertions, 12 deletions
diff --git a/UPDATING b/UPDATING
index aa3aa03c9000..5c996821c40a 100644
--- a/UPDATING
+++ b/UPDATING
@@ -8,6 +8,9 @@ Items affecting the ports and packages system can be found in
/usr/ports/UPDATING. Please read that file before running
portupgrade.
+20071003: p16 FreeBSD-SA-07:08.openssl
+ Correct a buffer overflow in OpenSSL SSL_get_shared_ciphers().
+
20070801: p15 FreeBSD-SA-07:01.jail, FreeBSD-SA-07:06.tcpdump,
FreeBSD-SA-07:07.bind
Correct a bug in the patch for FreeBSD-SA-07:01.jail. [07:01]
diff --git a/crypto/openssl/ssl/ssl_lib.c b/crypto/openssl/ssl/ssl_lib.c
index c50b58a20458..30661a06145e 100644
--- a/crypto/openssl/ssl/ssl_lib.c
+++ b/crypto/openssl/ssl/ssl_lib.c
@@ -1149,7 +1149,6 @@ int SSL_set_cipher_list(SSL *s,const char *str)
char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
{
char *p;
- const char *cp;
STACK_OF(SSL_CIPHER) *sk;
SSL_CIPHER *c;
int i;
@@ -1162,20 +1161,21 @@ char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
sk=s->session->ciphers;
for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
{
- /* Decrement for either the ':' or a '\0' */
- len--;
+ int n;
+
c=sk_SSL_CIPHER_value(sk,i);
- for (cp=c->name; *cp; )
+ n=strlen(c->name);
+ if (n+1 > len)
{
- if (len-- <= 0)
- {
- *p='\0';
- return(buf);
- }
- else
- *(p++)= *(cp++);
+ if (p != buf)
+ --p;
+ *p='\0';
+ return buf;
}
+ strcpy(p,c->name);
+ p+=n;
*(p++)=':';
+ len-=n+1;
}
p[-1]='\0';
return(buf);
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 986aa9091cc0..6093ef844841 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="5.5"
-BRANCH="RELEASE-p15"
+BRANCH="RELEASE-p16"
RELEASE="${REVISION}-${BRANCH}"
VERSION="${TYPE} ${RELEASE}"