wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix error return value in SRP functions

Browse source 
The functions SRP_Calc_client_key() and SRP_Calc_server_key() were
incorrectly returning a valid pointer in the event of error.

Issue reported by Yuan Jochen Kang

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 308ff28673)
This commit is contained in:
Matt Caswell 2016-04-25 16:22:31 +01:00
parent d384bf39b1
commit e117522e75
1 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
crypto/srp/srp_lib.c
View file

@ -159,8 +159,7 @@ BIGNUM *SRP_Calc_server_key(BIGNUM *A, BIGNUM *v, BIGNUM *u, BIGNUM *b,
if (u == NULL || A == NULL || v == NULL || b == NULL || N == NULL) if (u == NULL || A == NULL || v == NULL || b == NULL || N == NULL)
return NULL; return NULL;
if ((bn_ctx = BN_CTX_new()) == NULL || if ((bn_ctx = BN_CTX_new()) == NULL || (tmp = BN_new()) == NULL)
(tmp = BN_new()) == NULL || (S = BN_new()) == NULL)
goto err; goto err;
/* S = (A*v**u) ** b */ /* S = (A*v**u) ** b */
@ -169,8 +168,12 @@ BIGNUM *SRP_Calc_server_key(BIGNUM *A, BIGNUM *v, BIGNUM *u, BIGNUM *b,
goto err; goto err;
if (!BN_mod_mul(tmp, A, tmp, N, bn_ctx)) if (!BN_mod_mul(tmp, A, tmp, N, bn_ctx))
goto err; goto err;
if (!BN_mod_exp(S, tmp, b, N, bn_ctx))
goto err; S = BN_new();
if (S != NULL && !BN_mod_exp(S, tmp, b, N, bn_ctx)) {
BN_free(S);
S = NULL;
}
err: err:
BN_CTX_free(bn_ctx); BN_CTX_free(bn_ctx);
BN_clear_free(tmp); BN_clear_free(tmp);
@ -267,7 +270,7 @@ BIGNUM *SRP_Calc_client_key(BIGNUM *N, BIGNUM *B, BIGNUM *g, BIGNUM *x,
if ((tmp = BN_new()) == NULL || if ((tmp = BN_new()) == NULL ||
(tmp2 = BN_new()) == NULL || (tmp2 = BN_new()) == NULL ||
(tmp3 = BN_new()) == NULL || (K = BN_new()) == NULL) (tmp3 = BN_new()) == NULL)
goto err; goto err;
if (!BN_mod_exp(tmp, g, x, N, bn_ctx)) if (!BN_mod_exp(tmp, g, x, N, bn_ctx))
@ -283,8 +286,11 @@ BIGNUM *SRP_Calc_client_key(BIGNUM *N, BIGNUM *B, BIGNUM *g, BIGNUM *x,
goto err; goto err;
if (!BN_add(tmp2, a, tmp3)) if (!BN_add(tmp2, a, tmp3))
goto err; goto err;
if (!BN_mod_exp(K, tmp, tmp2, N, bn_ctx)) K = BN_new();
goto err; if (K != NULL && !BN_mod_exp(K, tmp, tmp2, N, bn_ctx)) {
BN_free(K);
K = NULL;
}
err: err:
BN_CTX_free(bn_ctx); BN_CTX_free(bn_ctx);