Fix seg fault with 0 p val in SKE
authorGuy Leaver (guleaver) <guleaver@cisco.com>
Fri, 7 Aug 2015 14:45:21 +0000 (15:45 +0100)
committerMatt Caswell <matt@openssl.org>
Tue, 11 Aug 2015 18:57:01 +0000 (19:57 +0100)
commit61e72d761c945e128ca13599a98a187ac23650dd
tree0b44d9a8ab9565b493f6281db36ac0aa15bd4b0e
parent870063c83db6514b0cb637b86cadbc9f5c2270a9
Fix seg fault with 0 p val in SKE

If a client receives a ServerKeyExchange for an anon DH ciphersuite with the
value of p set to 0 then a seg fault can occur. This commits adds a test to
reject p, g and pub key parameters that have a 0 value (in accordance with
RFC 5246)

The security vulnerability only affects master and 1.0.2, but the fix is
additionally applied to 1.0.1 for additional confidence.

CVE-2015-1794

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
include/openssl/ssl.h
ssl/s3_clnt.c
ssl/ssl_err.c