From: Rich Salz <rsalz@openssl.org>
Date: Tue, 21 Feb 2017 18:07:13 +0000 (-0500)
Subject: Prevent OOB in SRP base64 code.
X-Git-Tag: OpenSSL_1_0_2l~85
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=1acdbb3eef4c992c9cebec3cbdf8104761aa7d63;p=oweals%2Fopenssl.git

Prevent OOB in SRP base64 code.

Change size comparison from > (GT) to >= (GTE) to ensure an additional
byte of output buffer, to prevent OOB reads/writes later in the function
Reject input strings larger than 2GB
Detect invalid output buffer size and return early

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2672)

(cherry picked from commit ecca16632a73bb80ee27cdec8a97f6def0a4714d)
---

diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c
index a8ec52a4da..c8bc7a94b2 100644
--- a/crypto/srp/srp_vfy.c
+++ b/crypto/srp/srp_vfy.c
@@ -86,10 +86,13 @@ static int t_fromb64(unsigned char *a, size_t alen, const char *src)
     int i, j;
     int size;
 
+    if (alen == 0 || alen > INT_MAX)
+        return -1;
+
     while (*src && (*src == ' ' || *src == '\t' || *src == '\n'))
         ++src;
     size = strlen(src);
-    if (alen > INT_MAX || size > (int)alen)
+    if (size < 0 || size >= (int)alen)
         return -1;
 
     i = 0;
@@ -127,7 +130,7 @@ static int t_fromb64(unsigned char *a, size_t alen, const char *src)
         if (--i < 0)
             break;
     }
-    while (a[j] == 0 && j <= size)
+    while (j <= size && a[j] == 0)
         ++j;
     i = 0;
     while (j <= size)