static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx,
const char *sender, int len, unsigned char *p);
-static void ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
+static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
{
MD5_CTX m5;
SHA_CTX s1;
- unsigned char buf[8],smd[SHA_DIGEST_LENGTH];
+ unsigned char buf[16],smd[SHA_DIGEST_LENGTH];
unsigned char c='A';
int i,j,k;
for (i=0; i<num; i+=MD5_DIGEST_LENGTH)
{
k++;
+ if (k > sizeof buf)
+ {
+ /* bug: 'buf' is too small for this ciphersuite */
+ SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
+ return 0;
+ }
+
for (j=0; j<k; j++)
buf[j]=c;
c++;
km+=MD5_DIGEST_LENGTH;
}
memset(smd,0,SHA_DIGEST_LENGTH);
+ return 1;
}
int ssl3_change_cipher_state(SSL *s, int which)
if (n > s->s3->tmp.key_block_length)
{
- SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_INTERNAL_ERROR);
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR);
goto err2;
}
s->s3->tmp.key_block_length=num;
s->s3->tmp.key_block=p;
- ssl3_generate_key_block(s,p,num);
+ return ssl3_generate_key_block(s,p,num);
- return(1);
err:
SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
return(0);
EVP_DigestFinal( &md_ctx,md,&md_size);
for (i=7; i>=0; i--)
- if (++seq[i]) break;
+ {
+ ++seq[i];
+ if (seq[i] != 0) break;
+ }
return(md_size);
}