The pointer to the cipher object is not yet set, when session was reloaded

[oweals/openssl.git] / ssl / s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 2699b5863b60149ba66106c0c742a22ec1c0c370..44ad368d0e0855b40c01bd9a1a6d5e3ee8f2f3d8 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -146,11 +146,18 @@ SSL_METHOD *SSLv3_client_method(void)
 
        if (init)
                {
-               init=0;
-               memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(),
-                       sizeof(SSL_METHOD));
-               SSLv3_client_data.ssl_connect=ssl3_connect;
-               SSLv3_client_data.get_ssl_method=ssl3_get_client_method;
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
+               if (init)
+                       {
+                       memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(),
+                               sizeof(SSL_METHOD));
+                       SSLv3_client_data.ssl_connect=ssl3_connect;
+                       SSLv3_client_data.get_ssl_method=ssl3_get_client_method;
+                       init=0;
+                       }
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&SSLv3_client_data);
        }
@@ -546,7 +553,11 @@ static int ssl3_client_hello(SSL *s)
                *(p++)=i;
                if (i != 0)
                        {
-                       die(i <= sizeof s->session->session_id);
+                       if (i > sizeof s->session->session_id)
+                               {
+                               SSLerr(SSL_F_SSL3_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                               goto err;
+                               }
                        memcpy(p,s->session->session_id,i);
                        p+=i;
                        }
@@ -628,30 +639,20 @@ static int ssl3_get_server_hello(SSL *s)
        /* get the session-id */
        j= *(p++);
 
-       if(j > sizeof s->session->session_id)
-               {
-               al=SSL_AD_ILLEGAL_PARAMETER;
-               SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,
-                      SSL_R_SSL3_SESSION_ID_TOO_LONG);
-               goto f_err;
-               }
-
-       if ((j != 0) && (j != SSL3_SESSION_ID_SIZE))
+       if ((j > sizeof s->session->session_id) || (j > SSL3_SESSION_ID_SIZE))
                {
-               /* SSLref returns 16 :-( */
-               if (j < SSL2_SSL_SESSION_ID_LENGTH)
-                       {
-                       al=SSL_AD_ILLEGAL_PARAMETER;
-                       SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_SHORT);
-                       goto f_err;
-                       }
+               al=SSL_AD_ILLEGAL_PARAMETER;
+               SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_LONG);
+               goto f_err;
                }
+
        if (j != 0 && j == s->session->session_id_length
            && memcmp(p,s->session->session_id,j) == 0)
            {
            if(s->sid_ctx_length != s->session->sid_ctx_length
               || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length))
                {
+               /* actually a client application bug */
                al=SSL_AD_ILLEGAL_PARAMETER;
                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
                goto f_err;
@@ -695,7 +696,7 @@ static int ssl3_get_server_hello(SSL *s)
                goto f_err;
                }
 
-       if (s->hit && (s->session->cipher != c))
+       if (s->hit && (s->session->cipher_id != c->id))
                {
                if (!(s->options &
                        SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
@@ -1453,16 +1454,16 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                
                        tmp_buf[0]=s->client_version>>8;
                        tmp_buf[1]=s->client_version&0xff;
-                       if (RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2) <= 0)
+                       if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
                                        goto err;
 
-                       s->session->master_key_length=SSL_MAX_MASTER_KEY_LENGTH;
+                       s->session->master_key_length=sizeof tmp_buf;
 
                        q=p;
                        /* Fix buf for TLS and beyond */
                        if (s->version > SSL3_VERSION)
                                p+=2;
-                       n=RSA_public_encrypt(SSL_MAX_MASTER_KEY_LENGTH,
+                       n=RSA_public_encrypt(sizeof tmp_buf,
                                tmp_buf,p,rsa,RSA_PKCS1_PADDING);
 #ifdef PKCS1_CHECK
                        if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++;
@@ -1484,8 +1485,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
                        s->session->master_key_length=
                                s->method->ssl3_enc->generate_master_secret(s,
                                        s->session->master_key,
-                                       tmp_buf,SSL_MAX_MASTER_KEY_LENGTH);
-                       memset(tmp_buf,0,SSL_MAX_MASTER_KEY_LENGTH);
+                                       tmp_buf,sizeof tmp_buf);
+                       memset(tmp_buf,0,sizeof tmp_buf);
                        }
 #endif
 #ifndef OPENSSL_NO_KRB5
@@ -1581,7 +1582,7 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                n+=2;
                                }
  
-                       if (RAND_bytes(tmp_buf,SSL_MAX_MASTER_KEY_LENGTH) <= 0)
+                       if (RAND_bytes(tmp_buf,sizeof tmp_buf) <= 0)
                            goto err;
 
                        /*  20010420 VRS.  Tried it this way; failed.
@@ -1591,14 +1592,18 @@ static int ssl3_send_client_key_exchange(SSL *s)
                        **      EVP_EncryptInit_ex(&ciph_ctx,NULL, key,iv);
                        */
 
-                       memset(iv, 0, EVP_MAX_IV_LENGTH);  /* per RFC 1510 */
+                       memset(iv, 0, sizeof iv);  /* per RFC 1510 */
                        EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,
                                kssl_ctx->key,iv);
                        EVP_EncryptUpdate(&ciph_ctx,epms,&outl,tmp_buf,
-                               SSL_MAX_MASTER_KEY_LENGTH);
+                               sizeof tmp_buf);
                        EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
                        outl += padl;
-                       die(outl <= sizeof epms);
+                       if (outl > sizeof epms)
+                               {
+                               SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                               goto err;
+                               }
                        EVP_CIPHER_CTX_cleanup(&ciph_ctx);
 
                        /*  KerberosWrapper.EncryptedPreMasterSecret    */
@@ -1610,9 +1615,9 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         s->session->master_key_length=
                                 s->method->ssl3_enc->generate_master_secret(s,
                                        s->session->master_key,
-                                       tmp_buf, SSL_MAX_MASTER_KEY_LENGTH);
+                                       tmp_buf, sizeof tmp_buf);
 
-                       memset(tmp_buf, 0, SSL_MAX_MASTER_KEY_LENGTH);
+                       memset(tmp_buf, 0, sizeof tmp_buf);
                        memset(epms, 0, outl);
                         }
 #endif