Changeset 105945 in vbox for trunk/src/libs/openssl-3.1.7/crypto/dsa/dsa_check.c

Timestamp:

Sep 4, 2024 11:32:47 AM (6 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

164679

Message:

openssl-3.1.7: Applied and adjusted our OpenSSL changes to 3.1.7. bugref:10757

Location:

trunk/src/libs/openssl-3.1.7

Files:

• . (modified) (1 prop)
• crypto/dsa/dsa_check.c (modified) (6 diffs)

trunk/src/libs/openssl-3.1.7

@@ -25 +25 @@
 /vendor/openssl/3.0.3:151497-151729
 /vendor/openssl/3.0.7:154371
+/vendor/openssl/3.1.7:164675-164677

@@ -25 +25 @@
 /vendor/openssl/3.0.3:151497-151729
 /vendor/openssl/3.0.7:154371
+/vendor/openssl/3.1.7:164675-164677

trunk/src/libs/openssl-3.1.7/crypto/dsa/dsa_check.c

@@ -1 +1 @@
 /*
- * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -20 +20 @@
 #include "crypto/dsa.h"
 
+static int dsa_precheck_params(const DSA *dsa, int *ret)
+{
+    if (dsa->params.p == NULL || dsa->params.q == NULL) {
+        ERR_raise(ERR_LIB_DSA, DSA_R_BAD_FFC_PARAMETERS);
+        *ret = FFC_CHECK_INVALID_PQ;
+        return 0;
+    }
+
+    if (BN_num_bits(dsa->params.p) > OPENSSL_DSA_MAX_MODULUS_BITS) {
+        ERR_raise(ERR_LIB_DSA, DSA_R_MODULUS_TOO_LARGE);
+        *ret = FFC_CHECK_INVALID_PQ;
+        return 0;
+    }
+
+    if (BN_num_bits(dsa->params.q) >= BN_num_bits(dsa->params.p)) {
+        ERR_raise(ERR_LIB_DSA, DSA_R_BAD_Q_VALUE);
+        *ret = FFC_CHECK_INVALID_PQ;
+        return 0;
+    }
+
+    return 1;
+}
+
 int ossl_dsa_check_params(const DSA *dsa, int checktype, int *ret)
 {
+    if (!dsa_precheck_params(dsa, ret))
+        return 0;
+
     if (checktype == OSSL_KEYMGMT_VALIDATE_QUICK_CHECK)
         return ossl_ffc_params_simple_validate(dsa->libctx, &dsa->params,
@@ -40 +66 @@
 int ossl_dsa_check_pub_key(const DSA *dsa, const BIGNUM *pub_key, int *ret)
 {
+    if (!dsa_precheck_params(dsa, ret))
+        return 0;
+
     return ossl_ffc_validate_public_key(&dsa->params, pub_key, ret)
            && *ret == 0;
@@ -51 +80 @@
 int ossl_dsa_check_pub_key_partial(const DSA *dsa, const BIGNUM *pub_key, int *ret)
 {
+    if (!dsa_precheck_params(dsa, ret))
+        return 0;
+
     return ossl_ffc_validate_public_key_partial(&dsa->params, pub_key, ret)
            && *ret == 0;
@@ -59 +91 @@
     *ret = 0;
 
-    return (dsa->params.q != NULL
-            && ossl_ffc_validate_private_key(dsa->params.q, priv_key, ret));
+    if (!dsa_precheck_params(dsa, ret))
+        return 0;
+
+    return ossl_ffc_validate_private_key(dsa->params.q, priv_key, ret);
 }
 
@@ -73 +107 @@
     BIGNUM *pub_key = NULL;
 
-    if (dsa->params.p == NULL
-        || dsa->params.g == NULL
+    if (!dsa_precheck_params(dsa, &ret))
+        return 0;
+
+    if (dsa->params.g == NULL
         || dsa->priv_key == NULL
         || dsa->pub_key == NULL)

@@ -25 +25 @@
 /vendor/openssl/3.0.3:151497-151729
 /vendor/openssl/3.0.7:154371
+/vendor/openssl/3.1.7:164675-164677