package/openssl/patches/400-cve_2008_5077.patch

   1 diff -ur openssl-0.9.8i-ORIG/apps/speed.c openssl-0.9.8i/apps/speed.c
   2 --- openssl-0.9.8i/apps/speed.c 2007-11-15 13:33:47.000000000 +0000
   3 +++ openssl-0.9.8i/apps/speed-new.c     2008-12-04 00:00:00.000000000 +0000
   4 @@ -2132,7 +2132,7 @@
   5                                 {
   6                                 ret=RSA_verify(NID_md5_sha1, buf,36, buf2,
   7                                         rsa_num, rsa_key[j]);
   8 -                               if (ret == 0)
   9 +                               if (ret <= 0)
  10                                         {
  11                                         BIO_printf(bio_err,
  12                                                 "RSA verify failure\n");
  13 diff -ur openssl-0.9.8i-ORIG/apps/spkac.c openssl-0.9.8i/apps/spkac.c
  14 --- openssl-0.9.8i-ORIG/apps/spkac.c    2005-04-05 19:11:18.000000000 +0000
  15 +++ openssl-0.9.8i/apps/spkac.c 2008-12-04 00:00:00.000000000 +0000
  16 @@ -285,7 +285,7 @@
  17         pkey = NETSCAPE_SPKI_get_pubkey(spki);
  18         if(verify) {
  19                 i = NETSCAPE_SPKI_verify(spki, pkey);
  20 -               if(i) BIO_printf(bio_err, "Signature OK\n");
  21 +               if (i > 0) BIO_printf(bio_err, "Signature OK\n");
  22                 else {
  23                         BIO_printf(bio_err, "Signature Failure\n");
  24                         ERR_print_errors(bio_err);
  25 diff -ur openssl-0.9.8i-ORIG/apps/verify.c openssl-0.9.8i/apps/verify.c
  26 --- openssl-0.9.8i-ORIG/apps/verify.c   2004-11-29 11:28:07.000000000 +0000
  27 +++ openssl-0.9.8i/apps/verify.c        2008-12-04 00:00:00.600000000 +0000
  28 @@ -266,7 +266,7 @@
  29
  30         ret=0;
  31  end:
  32 -       if (i)
  33 +       if (i > 0)
  34                 {
  35                 fprintf(stdout,"OK\n");
  36                 ret=1;
  37 @@ -367,4 +367,3 @@
  38                 ERR_clear_error();
  39         return(ok);
  40         }
  41 -
  42 diff -ur openssl-0.9.8i-ORIG/apps/x509.c openssl-0.9.8i/apps/x509.c
  43 --- openssl-0.9.8i-ORIG/apps/x509.c     2007-10-12 00:00:10.000000000 +0000
  44 +++ openssl-0.9.8i/apps/x509.c  2008-12-04 00:00:00.400000000 +0000
  45 @@ -1151,7 +1151,7 @@
  46         /* NOTE: this certificate can/should be self signed, unless it was
  47          * a certificate request in which case it is not. */
  48         X509_STORE_CTX_set_cert(&xsc,x);
  49 -       if (!reqfile && !X509_verify_cert(&xsc))
  50 +       if (!reqfile && X509_verify_cert(&xsc) <= 0)
  51                 goto end;
  52
  53         if (!X509_check_private_key(xca,pkey))
  54 diff -ur openssl-0.9.8i-ORIG/crypto/cms/cms_sd.c openssl-0.9.8i/crypto/cms/cms_sd.c
  55 --- openssl-0.9.8i-ORIG/crypto/cms/cms_sd.c     2008-04-06 16:30:38.000000000 +0000
  56 +++ openssl-0.9.8i/crypto/cms/cms_sd.c  2008-12-04 00:00:00.400000000 +0000
  57 @@ -830,7 +830,7 @@
  58         cms_fixup_mctx(&mctx, si->pkey);
  59         r = EVP_VerifyFinal(&mctx,
  60                         si->signature->data, si->signature->length, si->pkey);
  61 -       if (!r)
  62 +       if (r <= 0)
  63                 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE);
  64         err:
  65         EVP_MD_CTX_cleanup(&mctx);
  66 diff -ur openssl-0.9.8i-ORIG/ssl/s2_clnt.c openssl-0.9.8i/ssl/s2_clnt.c
  67 --- openssl-0.9.8i-ORIG/ssl/s2_clnt.c   2007-09-06 12:43:53.000000000 +0000
  68 +++ openssl-0.9.8i/ssl/s2_clnt.c        2008-12-04 00:00:00.100000000 +0000
  69 @@ -1044,7 +1044,7 @@
  70
  71         i=ssl_verify_cert_chain(s,sk);
  72
  73 -       if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
  74 +       if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0))
  75                 {
  76                 SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
  77                 goto err;
  78 diff -ur openssl-0.9.8i-ORIG/ssl/s2_srvr.c openssl-0.9.8i/ssl/s2_srvr.c
  79 --- openssl-0.9.8i-ORIG/ssl/s2_srvr.c   2007-09-06 12:43:53.000000000 +0000
  80 +++ openssl-0.9.8i/ssl/s2_srvr.c        2008-12-04 00:00:00.900000000 +0000
  81 @@ -1054,7 +1054,7 @@
  82
  83         i=ssl_verify_cert_chain(s,sk);
  84
  85 -       if (i)  /* we like the packet, now check the chksum */
  86 +       if (i > 0)      /* we like the packet, now check the chksum */
  87                 {
  88                 EVP_MD_CTX ctx;
  89                 EVP_PKEY *pkey=NULL;
  90 @@ -1083,7 +1083,7 @@
  91                 EVP_PKEY_free(pkey);
  92                 EVP_MD_CTX_cleanup(&ctx);
  93
  94 -               if (i)
  95 +               if (i > 0)
  96                         {
  97                         if (s->session->peer != NULL)
  98                                 X509_free(s->session->peer);
  99 diff -ur openssl-0.9.8i-ORIG/ssl/s3_clnt.c openssl-0.9.8i/ssl/s3_clnt.c
 100 --- openssl-0.9.8i-ORIG/ssl/s3_clnt.c   2008-06-16 16:56:41.000000000 +0000
 101 +++ openssl-0.9.8i/ssl/s3_clnt.c        2008-12-04 00:00:00.100000000 +0000
 102 @@ -972,7 +972,7 @@
 103                 }
 104
 105         i=ssl_verify_cert_chain(s,sk);
 106 -       if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
 107 +       if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
 108  #ifndef OPENSSL_NO_KRB5
 109                 && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
 110                 != (SSL_aKRB5|SSL_kKRB5)
 111 @@ -1459,7 +1459,7 @@
 112                         EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
 113                         EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
 114                         EVP_VerifyUpdate(&md_ctx,param,param_len);
 115 -                       if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
 116 +                       if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
 117                                 {
 118                                 /* bad signature */
 119                                 al=SSL_AD_DECRYPT_ERROR;
 120 @@ -1477,7 +1477,7 @@
 121                         EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
 122                         EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
 123                         EVP_VerifyUpdate(&md_ctx,param,param_len);
 124 -                       if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
 125 +                       if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
 126                                 {
 127                                 /* bad signature */
 128                                 al=SSL_AD_DECRYPT_ERROR;
 129 diff -ur openssl-0.9.8i-ORIG/ssl/s3_srvr.c openssl-0.9.8i/ssl/s3_srvr.c
 130 --- openssl-0.9.8i-ORIG/ssl/s3_srvr.c   2008-09-14 18:16:09.000000000 +0000
 131 +++ openssl-0.9.8i/ssl/s3_srvr.c        2008-12-04 00:00:00.100000000 +0000
 132 @@ -2560,7 +2560,7 @@
 133         else
 134                 {
 135                 i=ssl_verify_cert_chain(s,sk);
 136 -               if (!i)
 137 +               if (i <= 0)
 138                         {
 139                         al=ssl_verify_alarm_type(s->verify_result);
 140                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);
 141 diff -ur openssl-0.9.8i-ORIG/ssl/ssltest.c openssl-0.9.8i/ssl/ssltest.c
 142 --- openssl-0.9.8i-ORIG/ssl/ssltest.c   2008-06-16 16:56:42.000000000 +0000
 143 +++ openssl-0.9.8i/ssl/ssltest.c        2008-12-04 00:00:00.900000000 +0000
 144 @@ -2093,7 +2093,7 @@
 145
 146         if (cb_arg->proxy_auth)
 147                 {
 148 -               if (ok)
 149 +               if (ok > 0)
 150                         {
 151                         const char *cond_end = NULL;