sysmo-bts
/
generic-poky
9
0
Fork 0
Code Pull Requests Releases Activity

openssl: use upstream fix for CVE-2014-0198 

This replaces the fix for CVE-2014-0198 with one borrowed from Fedora,
which is the same as the patch which was actually applied upstream for
the issue, i.e.:

https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=b107586c0c3447ea22dba8698ebbcd81bb29d48c

(From OE-Core rev: 21fa437a37dad14145b6c8c8c16c95f1b074e09c)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Paul Eggleton 2014-06-09 16:53:44 +01:00 committed by Richard Purdie
parent c5d81c3386
commit d6f29c0154
3 changed files with 39 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
meta/recipes-connectivity/openssl/openssl-1.0.1e/openssl-1.0.1e-cve-2014-0198.patch Normal file
View File

@ -0,0 +1,38 @@
From: Matt Caswell <matt@openssl.org>
Date: Sun, 11 May 2014 23:38:37 +0000 (+0100)
Subject: Fixed NULL pointer dereference. See PR#3321
X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=b107586
Fixed NULL pointer dereference. See PR#3321
Patch borrowed from Fedora
Upstream-Status: Backport
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
---
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 40eb0dd..d961d12 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -657,9 +657,6 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
SSL3_BUFFER *wb=&(s->s3->wbuf);
SSL_SESSION *sess;
- if (wb->buf == NULL)
- if (!ssl3_setup_write_buffer(s))
- return -1;
/* first check if there is a SSL3_BUFFER still being written
* out. This will happen with non blocking IO */
@@ -675,6 +672,10 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
/* if it went, fall through and send more stuff */
}
+ if (wb->buf == NULL)
+ if (!ssl3_setup_write_buffer(s))
+ return -1;
+
if (len == 0 && !create_empty_fragment)
return 0;

23
meta/recipes-connectivity/openssl/openssl-1.0.1e/openssl-CVE-2014-0198-fix.patch
View File

@ -1,23 +0,0 @@
Upstream-Status: Backport
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1093837
CVE-2014-0198: An attacker can trigger generation of an SSL
alert which could cause a null pointer dereference.
Signed-off-by: Maxin B. John <maxin.john@enea.com>
---
diff -Naur openssl-1.0.1g-orig/ssl/s3_pkt.c openssl-1.0.1g/ssl/s3_pkt.c
--- openssl-1.0.1g-orig/ssl/s3_pkt.c 2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g/ssl/s3_pkt.c 2014-05-06 02:32:43.862587660 +0200
@@ -657,6 +657,10 @@
if (i <= 0)
return(i);
/* if it went, fall through and send more stuff */
+ /* we may have released our buffer, so get it again */
+ if (wb->buf == NULL)
+ if (!ssl3_setup_write_buffer(s))
+ return -1;
}
if (len == 0 && !create_empty_fragment)

2
meta/recipes-connectivity/openssl/openssl_1.0.1e.bb
View File

@ -38,8 +38,8 @@ SRC_URI += "file://configure-targets.patch \
file://0001-Fix-DTLS-retransmission-from-previous-session.patch \
file://0001-Use-version-in-SSL_METHOD-not-SSL-structure.patch \
file://CVE-2014-0160.patch \
file://openssl-CVE-2014-0198-fix.patch \
file://openssl-1.0.1e-cve-2014-0195.patch \
file://openssl-1.0.1e-cve-2014-0198.patch \
"
SRC_URI[md5sum] = "66bf6f10f060d561929de96f9dfe5b8c"