[Pkg-openssl-changes] r238 - in openssl/branches/etch: debian ssl

[kroeckx at alioth.debian.org]

Author: kroeckx
Date: 2007-09-28 17:59:54 +0000 (Fri, 28 Sep 2007)
New Revision: 238

Modified:
   openssl/branches/etch/debian/changelog
   openssl/branches/etch/debian/libssl0.9.8.postinst
   openssl/branches/etch/ssl/ssl_lib.c
Log:
CVE-2007-5135: Fix off by one error in SSL_get_shared_ciphers().
(Closes: #444435)


Modified: openssl/branches/etch/debian/changelog
===================================================================
--- openssl/branches/etch/debian/changelog	2007-09-28 17:55:34 UTC (rev 237)
+++ openssl/branches/etch/debian/changelog	2007-09-28 17:59:54 UTC (rev 238)
@@ -1,3 +1,10 @@
+openssl (0.9.8c-4etch1) stable-security; urgency=low
+
+  * CVE-2007-5135: Fix off by one error in SSL_get_shared_ciphers().
+    (Closes: #444435)
+
+ -- Kurt Roeckx <kurt at roeckx.be>  Fri, 28 Sep 2007 19:57:00 +0200
+
 openssl (0.9.8c-4) unstable; urgency=low
 
   * Add German debconf translation.  Thanks to

Modified: openssl/branches/etch/debian/libssl0.9.8.postinst
===================================================================
--- openssl/branches/etch/debian/libssl0.9.8.postinst	2007-09-28 17:55:34 UTC (rev 237)
+++ openssl/branches/etch/debian/libssl0.9.8.postinst	2007-09-28 17:59:54 UTC (rev 238)
@@ -57,7 +57,7 @@
 if [ "$1" = "configure" ]
 then
     if [ ! -z "$2" ]; then
-	if dpkg --compare-versions "$2" lt 0.9.8c-2; then
+	if dpkg --compare-versions "$2" lt 0.9.8c-4etch1; then
 	    echo -n "Checking for services that may need to be restarted..."
 
 	    check="sendmail openssh-server"

Modified: openssl/branches/etch/ssl/ssl_lib.c
===================================================================
--- openssl/branches/etch/ssl/ssl_lib.c	2007-09-28 17:55:34 UTC (rev 237)
+++ openssl/branches/etch/ssl/ssl_lib.c	2007-09-28 17:59:54 UTC (rev 238)
@@ -1201,7 +1201,6 @@
 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
 	{
 	char *p;
-	const char *cp;
 	STACK_OF(SSL_CIPHER) *sk;
 	SSL_CIPHER *c;
 	int i;
@@ -1214,20 +1213,21 @@
 	sk=s->session->ciphers;
 	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
 		{
-		/* Decrement for either the ':' or a '\0' */
-		len--;
+		int n;
+
 		c=sk_SSL_CIPHER_value(sk,i);
-		for (cp=c->name; *cp; )
+		n=strlen(c->name);
+		if (n+1 > len)
 			{
-			if (len-- <= 0)
-				{
-				*p='\0';
-				return(buf);
-				}
-			else
-				*(p++)= *(cp++);
+			if (p != buf)
+				--p;
+			*p='\0';
+			return buf;
 			}
+		strcpy(p,c->name);
+		p+=n;
 		*(p++)=':';
+		len-=n+1;
 		}
 	p[-1]='\0';
 	return(buf);