openssl/sme8/openssl-0.9.8b-cve-2007-5135.patch

Possible one byte buffer overflow in SSL_get_shared_ciphers.
CVE-2007-5135
diff -up openssl-0.9.8b/ssl/ssl_lib.c.orig openssl-0.9.8b/ssl/ssl_lib.c
--- openssl-0.9.8b/ssl/ssl_lib.c.orig   2007-10-08 10:20:42.000000000 +0200
+++ openssl-0.9.8b/ssl/ssl_lib.c        2007-10-08 17:32:29.000000000 +0200
@@ -1201,7 +1201,6 @@ int SSL_set_cipher_list(SSL *s,const cha
 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
        {
        char *p;
-       const char *cp;
        STACK_OF(SSL_CIPHER) *sk;
        SSL_CIPHER *c;
        int i;
@@ -1214,20 +1213,21 @@ char *SSL_get_shared_ciphers(const SSL *
        sk=s->session->ciphers;
        for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
                {
-               /* Decrement for either the ':' or a '\0' */
-               len--;
+               int n;
+
                c=sk_SSL_CIPHER_value(sk,i);
-               for (cp=c->name; *cp; )
+               n=strlen(c->name);
+               if (n+1 > len)
                        {
-                       if (len-- <= 0)
-                               {
-                               *p='\0';
-                               return(buf);
-                               }
-                       else
-                               *(p++)= *(cp++);
+                       if (p != buf)
+                               --p;
+                       *p='\0';
+                       return buf;
                        }
+               strcpy(p,c->name);
+               p+=n;
                *(p++)=':';
+               len-=n+1;
                }
        p[-1]='\0';
        return(buf);
1	Possible one byte buffer overflow in SSL_get_shared_ciphers.
2	CVE-2007-5135
3	diff -up openssl-0.9.8b/ssl/ssl_lib.c.orig openssl-0.9.8b/ssl/ssl_lib.c
4	--- openssl-0.9.8b/ssl/ssl_lib.c.orig 2007-10-08 10:20:42.000000000 +0200
5	+++ openssl-0.9.8b/ssl/ssl_lib.c 2007-10-08 17:32:29.000000000 +0200
6	@@ -1201,7 +1201,6 @@ int SSL_set_cipher_list(SSL *s,const cha
7	char SSL_get_shared_ciphers(const SSL s,char *buf,int len)
8	{
9	char *p;
10	- const char *cp;
11	STACK_OF(SSL_CIPHER) *sk;
12	SSL_CIPHER *c;
13	int i;
14	@@ -1214,20 +1213,21 @@ char SSL_get_shared_ciphers(const SSL
15	sk=s->session->ciphers;
16	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
17	{
18	- /* Decrement for either the ':' or a '\0' */
19	- len--;
20	+ int n;
21	+
22	c=sk_SSL_CIPHER_value(sk,i);
23	- for (cp=c->name; *cp; )
24	+ n=strlen(c->name);
25	+ if (n+1 > len)
26	{
27	- if (len-- <= 0)
28	- {
29	- *p='\0';
30	- return(buf);
31	- }
32	- else
33	- (p++)= (cp++);
34	+ if (p != buf)
35	+ --p;
36	+ *p='\0';
37	+ return buf;
38	}
39	+ strcpy(p,c->name);
40	+ p+=n;
41	*(p++)=':';
42	+ len-=n+1;
43	}
44	p[-1]='\0';
45	return(buf);