From: Dr. Stephen Henson <steve@openssl.org>
Date: Fri, 2 Oct 2015 11:35:19 +0000 (+0100)
Subject: Add PSS parameter check.
X-Git-Tag: OpenSSL_1_0_2e~4
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=c394a488942387246653833359a5c94b5832674e;p=oweals%2Fopenssl.git

Add PSS parameter check.

Avoid seg fault by checking mgf1 parameter is not NULL. This can be
triggered during certificate verification so could be a DoS attack
against a client or a server enabling client authentication.

Thanks to Loïc Jonas Etienne (Qnective AG) for discovering this bug.

CVE-2015-3194

Reviewed-by: Richard Levitte <levitte@openssl.org>
---

diff --git a/crypto/rsa/rsa_ameth.c b/crypto/rsa/rsa_ameth.c
index ca3922e6c2..4e0621827c 100644
--- a/crypto/rsa/rsa_ameth.c
+++ b/crypto/rsa/rsa_ameth.c
@@ -268,7 +268,7 @@ static X509_ALGOR *rsa_mgf1_decode(X509_ALGOR *alg)
 {
     const unsigned char *p;
     int plen;
-    if (alg == NULL)
+    if (alg == NULL || alg->parameter == NULL)
         return NULL;
     if (OBJ_obj2nid(alg->algorithm) != NID_mgf1)
         return NULL;