Stop bug triggering large recursion when presented with

certain ASN.1 tags (CAN-2003-0851)

diff --git a/CHANGES b/CHANGES
index 1d7e395b149f45f49f378997d383dcc179d8e10d..da33dfa0d9688c8da0e3af9d74d633ddac1378c9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,9 +2,13 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.6k and 0.9.6l  [xx XXX XXXX]
+ Changes between 0.9.6k and 0.9.6l  [04 Nov 2003]
 
-  *)
+  *) Fix additional bug revealed by the NISCC test suite:
+
+     Stop bug triggering large recursion when presented with
+     certain ASN.1 tags (CAN-2003-0851)
+     [Steve Henson]
 
  Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]
 

diff --git a/NEWS b/NEWS
index 611ffa5376d960795297dcbbf7c1dc77abea5398..79dea2d72c9e425915432dc8f726e52507af5a56 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,10 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
+  Major changes between OpenSSL 0.9.6k and OpenSSL 0.9.6l:
+
+      o Security: fix ASN1 bug leading to large recursion
+
   Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k:
 
       o Security: fix various ASN1 parsing bugs.

diff --git a/README b/README
index 244fd669979e1125d38c2b09f312b29d2254ec68..a0524a29c1af071f7a94a14a43341a75850ab1fe 100644 (file)
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
 
- OpenSSL 0.9.6k [engine] 30 Sep 2003
+ OpenSSL 0.9.6l [engine] 04 Nov 2003
 
  Copyright (c) 1998-2003 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

diff --git a/STATUS b/STATUS
index 228718997e1796fdd811f912465878340a84645c..018058c8aca57b93dfe819f16a8142acf0d15bf0 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -1,6 +1,6 @@
 
   OpenSSL STATUS                           Last modified at
-  ______________                           $Date: 2003/10/02 18:09:27 $
+  ______________                           $Date: 2003/11/04 11:33:10 $
 
   DEVELOPMENT STATE
 
@@ -9,6 +9,7 @@
     o  OpenSSL 0.9.7b: Released on April     10th, 2003
     o  OpenSSL 0.9.7a: Released on February  19th, 2003
     o  OpenSSL 0.9.7:  Released on December  31st, 2002
+    o  OpenSSL 0.9.6l: Released on November   4th, 2003
     o  OpenSSL 0.9.6k: Released on September 30th, 2003
     o  OpenSSL 0.9.6j: Released on April     10th, 2003
     o  OpenSSL 0.9.6i: Released on February  19th, 2003

diff --git a/crypto/asn1/a_bytes.c b/crypto/asn1/a_bytes.c
index 3a0c0c783551bca509e3efa230625a65e63b7e2c..6595255cf867d9705dedd473e7a166ba589796a6 100644 (file)
--- a/crypto/asn1/a_bytes.c
+++ b/crypto/asn1/a_bytes.c
@@ -201,7 +201,10 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                c.pp=pp;
                c.p=p;
                c.inf=inf;
-               c.slen=len;
+               if (inf & 1)
+                       c.slen = length - (p - *pp);
+               else
+                       c.slen=len;
                c.tag=Ptag;
                c.xclass=Pclass;
                c.max=(length == 0)?0:(p+length);
@@ -279,8 +282,7 @@ static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
                {
                if (c->inf & 1)
                        {
-                       c->eos=ASN1_check_infinite_end(&c->p,
-                               (long)(c->max-c->p));
+                       c->eos=ASN1_check_infinite_end(&c->p, c->slen);
                        if (c->eos) break;
                        }
                else
@@ -289,7 +291,7 @@ static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
                        }
 
                c->q=c->p;
-               if (d2i_ASN1_bytes(&os,&c->p,c->max-c->p,c->tag,c->xclass)
+               if (d2i_ASN1_bytes(&os,&c->p,c->slen,c->tag,c->xclass)
                        == NULL)
                        {
                        c->error=ERR_R_ASN1_LIB;
@@ -302,8 +304,7 @@ static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
                        goto err;
                        }
                memcpy(&(b.data[num]),os->data,os->length);
-               if (!(c->inf & 1))
-                       c->slen-=(c->p-c->q);
+               c->slen-=(c->p-c->q);
                num+=os->length;
                }
 

diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index 0e3aabc678f1850f1ac28ff1de24015925498a21..6f9e4c0570f28cb61787398d81ee8d60afe93904 100644 (file)
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -25,8 +25,8 @@
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-#define OPENSSL_VERSION_NUMBER 0x009060c0L
-#define OPENSSL_VERSION_TEXT   "OpenSSL 0.9.6l-dev [engine] xx XXX XXXX"
+#define OPENSSL_VERSION_NUMBER 0x009060cfL
+#define OPENSSL_VERSION_TEXT   "OpenSSL 0.9.6l [engine] 04 Nov 2003"
 #define OPENSSL_VERSION_PTEXT  " part of " OPENSSL_VERSION_TEXT
 
 

diff --git a/openssl.spec b/openssl.spec
index fa5e6dde7f717de0b9e54fc621606440148707ba..98f517e21a414b05ea452e13d3a6cec3d3602d39 100644 (file)
--- a/openssl.spec
+++ b/openssl.spec
@@ -1,7 +1,7 @@
 %define libmaj 0
 %define libmin 9
 %define librel 6
-%define librev k
+%define librev l
 Release: 1
 
 %define openssldir /var/ssl