[package] openssl: apply fix for CVE-2008-5077 to 8.09 version
[openwrt/svn-archive/archive.git] / package / openssl / patches / 400-cve_2008_5077.patch
1 diff -ur openssl-0.9.8i-ORIG/apps/speed.c openssl-0.9.8i/apps/speed.c
2 --- openssl-0.9.8i/apps/speed.c 2007-11-15 13:33:47.000000000 +0000
3 +++ openssl-0.9.8i/apps/speed-new.c 2008-12-04 00:00:00.000000000 +0000
4 @@ -2132,7 +2132,7 @@
5 {
6 ret=RSA_verify(NID_md5_sha1, buf,36, buf2,
7 rsa_num, rsa_key[j]);
8 - if (ret == 0)
9 + if (ret <= 0)
10 {
11 BIO_printf(bio_err,
12 "RSA verify failure\n");
13 diff -ur openssl-0.9.8i-ORIG/apps/spkac.c openssl-0.9.8i/apps/spkac.c
14 --- openssl-0.9.8i-ORIG/apps/spkac.c 2005-04-05 19:11:18.000000000 +0000
15 +++ openssl-0.9.8i/apps/spkac.c 2008-12-04 00:00:00.000000000 +0000
16 @@ -285,7 +285,7 @@
17 pkey = NETSCAPE_SPKI_get_pubkey(spki);
18 if(verify) {
19 i = NETSCAPE_SPKI_verify(spki, pkey);
20 - if(i) BIO_printf(bio_err, "Signature OK\n");
21 + if (i > 0) BIO_printf(bio_err, "Signature OK\n");
22 else {
23 BIO_printf(bio_err, "Signature Failure\n");
24 ERR_print_errors(bio_err);
25 diff -ur openssl-0.9.8i-ORIG/apps/verify.c openssl-0.9.8i/apps/verify.c
26 --- openssl-0.9.8i-ORIG/apps/verify.c 2004-11-29 11:28:07.000000000 +0000
27 +++ openssl-0.9.8i/apps/verify.c 2008-12-04 00:00:00.600000000 +0000
28 @@ -266,7 +266,7 @@
29
30 ret=0;
31 end:
32 - if (i)
33 + if (i > 0)
34 {
35 fprintf(stdout,"OK\n");
36 ret=1;
37 @@ -367,4 +367,3 @@
38 ERR_clear_error();
39 return(ok);
40 }
41 -
42 diff -ur openssl-0.9.8i-ORIG/apps/x509.c openssl-0.9.8i/apps/x509.c
43 --- openssl-0.9.8i-ORIG/apps/x509.c 2007-10-12 00:00:10.000000000 +0000
44 +++ openssl-0.9.8i/apps/x509.c 2008-12-04 00:00:00.400000000 +0000
45 @@ -1151,7 +1151,7 @@
46 /* NOTE: this certificate can/should be self signed, unless it was
47 * a certificate request in which case it is not. */
48 X509_STORE_CTX_set_cert(&xsc,x);
49 - if (!reqfile && !X509_verify_cert(&xsc))
50 + if (!reqfile && X509_verify_cert(&xsc) <= 0)
51 goto end;
52
53 if (!X509_check_private_key(xca,pkey))
54 diff -ur openssl-0.9.8i-ORIG/crypto/cms/cms_sd.c openssl-0.9.8i/crypto/cms/cms_sd.c
55 --- openssl-0.9.8i-ORIG/crypto/cms/cms_sd.c 2008-04-06 16:30:38.000000000 +0000
56 +++ openssl-0.9.8i/crypto/cms/cms_sd.c 2008-12-04 00:00:00.400000000 +0000
57 @@ -830,7 +830,7 @@
58 cms_fixup_mctx(&mctx, si->pkey);
59 r = EVP_VerifyFinal(&mctx,
60 si->signature->data, si->signature->length, si->pkey);
61 - if (!r)
62 + if (r <= 0)
63 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE);
64 err:
65 EVP_MD_CTX_cleanup(&mctx);
66 diff -ur openssl-0.9.8i-ORIG/ssl/s2_clnt.c openssl-0.9.8i/ssl/s2_clnt.c
67 --- openssl-0.9.8i-ORIG/ssl/s2_clnt.c 2007-09-06 12:43:53.000000000 +0000
68 +++ openssl-0.9.8i/ssl/s2_clnt.c 2008-12-04 00:00:00.100000000 +0000
69 @@ -1044,7 +1044,7 @@
70
71 i=ssl_verify_cert_chain(s,sk);
72
73 - if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
74 + if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0))
75 {
76 SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
77 goto err;
78 diff -ur openssl-0.9.8i-ORIG/ssl/s2_srvr.c openssl-0.9.8i/ssl/s2_srvr.c
79 --- openssl-0.9.8i-ORIG/ssl/s2_srvr.c 2007-09-06 12:43:53.000000000 +0000
80 +++ openssl-0.9.8i/ssl/s2_srvr.c 2008-12-04 00:00:00.900000000 +0000
81 @@ -1054,7 +1054,7 @@
82
83 i=ssl_verify_cert_chain(s,sk);
84
85 - if (i) /* we like the packet, now check the chksum */
86 + if (i > 0) /* we like the packet, now check the chksum */
87 {
88 EVP_MD_CTX ctx;
89 EVP_PKEY *pkey=NULL;
90 @@ -1083,7 +1083,7 @@
91 EVP_PKEY_free(pkey);
92 EVP_MD_CTX_cleanup(&ctx);
93
94 - if (i)
95 + if (i > 0)
96 {
97 if (s->session->peer != NULL)
98 X509_free(s->session->peer);
99 diff -ur openssl-0.9.8i-ORIG/ssl/s3_clnt.c openssl-0.9.8i/ssl/s3_clnt.c
100 --- openssl-0.9.8i-ORIG/ssl/s3_clnt.c 2008-06-16 16:56:41.000000000 +0000
101 +++ openssl-0.9.8i/ssl/s3_clnt.c 2008-12-04 00:00:00.100000000 +0000
102 @@ -972,7 +972,7 @@
103 }
104
105 i=ssl_verify_cert_chain(s,sk);
106 - if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
107 + if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
108 #ifndef OPENSSL_NO_KRB5
109 && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
110 != (SSL_aKRB5|SSL_kKRB5)
111 @@ -1459,7 +1459,7 @@
112 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
113 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
114 EVP_VerifyUpdate(&md_ctx,param,param_len);
115 - if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
116 + if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
117 {
118 /* bad signature */
119 al=SSL_AD_DECRYPT_ERROR;
120 @@ -1477,7 +1477,7 @@
121 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
122 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
123 EVP_VerifyUpdate(&md_ctx,param,param_len);
124 - if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
125 + if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
126 {
127 /* bad signature */
128 al=SSL_AD_DECRYPT_ERROR;
129 diff -ur openssl-0.9.8i-ORIG/ssl/s3_srvr.c openssl-0.9.8i/ssl/s3_srvr.c
130 --- openssl-0.9.8i-ORIG/ssl/s3_srvr.c 2008-09-14 18:16:09.000000000 +0000
131 +++ openssl-0.9.8i/ssl/s3_srvr.c 2008-12-04 00:00:00.100000000 +0000
132 @@ -2560,7 +2560,7 @@
133 else
134 {
135 i=ssl_verify_cert_chain(s,sk);
136 - if (!i)
137 + if (i <= 0)
138 {
139 al=ssl_verify_alarm_type(s->verify_result);
140 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);
141 diff -ur openssl-0.9.8i-ORIG/ssl/ssltest.c openssl-0.9.8i/ssl/ssltest.c
142 --- openssl-0.9.8i-ORIG/ssl/ssltest.c 2008-06-16 16:56:42.000000000 +0000
143 +++ openssl-0.9.8i/ssl/ssltest.c 2008-12-04 00:00:00.900000000 +0000
144 @@ -2093,7 +2093,7 @@
145
146 if (cb_arg->proxy_auth)
147 {
148 - if (ok)
149 + if (ok > 0)
150 {
151 const char *cond_end = NULL;