[Pkg-openssl-changes] r596 - in openssl/trunk/debian: . patches
Kurt Roeckx
kroeckx at alioth.debian.org
Mon Mar 18 19:29:47 UTC 2013
Author: kroeckx
Date: 2013-03-18 19:29:46 +0000 (Mon, 18 Mar 2013)
New Revision: 596
Added:
openssl/trunk/debian/patches/aesni-mac.patch
Modified:
openssl/trunk/debian/changelog
openssl/trunk/debian/patches/series
Log:
Fix problem with AES-NI causing bad record mac (Closes: #701868, #702635, #678353)
Modified: openssl/trunk/debian/changelog
===================================================================
--- openssl/trunk/debian/changelog 2013-03-10 20:56:22 UTC (rev 595)
+++ openssl/trunk/debian/changelog 2013-03-18 19:29:46 UTC (rev 596)
@@ -1,9 +1,10 @@
-openssl (1.0.1e-2) unstable; urgency=low
+openssl (1.0.1e-2) unstable; urgency=high
* Bump shlibs. It's needed for the udeb.
* Make cpuid work on cpu's that don't set ecx (Closes: #699692)
+ * Fix problem with AES-NI causing bad record mac (Closes: #701868, #702635, #678353)
- -- Kurt Roeckx <kurt at roeckx.be> Sun, 10 Mar 2013 21:55:08 +0100
+ -- Kurt Roeckx <kurt at roeckx.be> Mon, 18 Mar 2013 20:19:58 +0100
openssl (1.0.1e-1) unstable; urgency=high
Added: openssl/trunk/debian/patches/aesni-mac.patch
===================================================================
--- openssl/trunk/debian/patches/aesni-mac.patch (rev 0)
+++ openssl/trunk/debian/patches/aesni-mac.patch 2013-03-18 19:29:46 UTC (rev 596)
@@ -0,0 +1,26 @@
+From: Andy Polyakov <appro at openssl.org>
+Date: Mon, 18 Mar 2013 19:29:41 +0100
+Subject: e_aes_cbc_hmac_sha1.c: fix rare bad record mac on AES-NI plaforms.
+Origin: upstream: http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=9ab3ce124616cb12bd39c6aa1e1bde0f46969b29
+Bug-Debian: http://bugs.debian.org/701868
+Bug: http://rt.openssl.org/Ticket/Display.html?id=3002&user=guest&pass=guest
+
+diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c
+index 483e04b..fb2c884 100644
+--- a/crypto/evp/e_aes_cbc_hmac_sha1.c
++++ b/crypto/evp/e_aes_cbc_hmac_sha1.c
+@@ -328,10 +328,11 @@ static int aesni_cbc_hmac_sha1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+
+ if (res!=SHA_CBLOCK) continue;
+
+- mask = 0-((inp_len+8-j)>>(sizeof(j)*8-1));
++ /* j is not incremented yet */
++ mask = 0-((inp_len+7-j)>>(sizeof(j)*8-1));
+ data->u[SHA_LBLOCK-1] |= bitlen&mask;
+ sha1_block_data_order(&key->md,data,1);
+- mask &= 0-((j-inp_len-73)>>(sizeof(j)*8-1));
++ mask &= 0-((j-inp_len-72)>>(sizeof(j)*8-1));
+ pmac->u[0] |= key->md.h0 & mask;
+ pmac->u[1] |= key->md.h1 & mask;
+ pmac->u[2] |= key->md.h2 & mask;
+
Modified: openssl/trunk/debian/patches/series
===================================================================
--- openssl/trunk/debian/patches/series 2013-03-10 20:56:22 UTC (rev 595)
+++ openssl/trunk/debian/patches/series 2013-03-18 19:29:46 UTC (rev 596)
@@ -33,3 +33,4 @@
default_bits.patch
ssltest_no_sslv2.patch
cpuid.patch
+aesni-mac.patch
More information about the Pkg-openssl-changes
mailing list