openssl/patches/openssl-0.9.8e-CVE-2007-3108.patch

http://bugs.gentoo.org/188799

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --- openssl-0.9.8e/crypto/bn/bn_mont.c	2006-06-16 03:01:14.000000000 +0200
+++ openssl-0.9.8-cvs/crypto/bn/bn_mont.c	2007-06-29 10:13:25.000000000 +0200
@@ -176,7 +176,6 @@
 
 	max=(nl+al+1); /* allow for overflow (no?) XXX */
 	if (bn_wexpand(r,max) == NULL) goto err;
- -	if (bn_wexpand(ret,max) == NULL) goto err;
 
 	r->neg=a->neg^n->neg;
 	np=n->d;
@@ -228,19 +227,70 @@
 		}
 	bn_correct_top(r);
 	
- -	/* mont->ri will be a multiple of the word size */
- -#if 0
- -	BN_rshift(ret,r,mont->ri);
- -#else
- -	ret->neg = r->neg;
- -	x=ri;
+	/* mont->ri will be a multiple of the word size and below code
+	 * is kind of BN_rshift(ret,r,mont->ri) equivalent */
+	if (r->top <= ri)
+		{
+		ret->top=0;
+		retn=1;
+		goto err;
+		}
+	al=r->top-ri;
+
+# define BRANCH_FREE 1
+# if BRANCH_FREE
+	if (bn_wexpand(ret,ri) == NULL) goto err;
+	x=0-(((al-ri)>>(sizeof(al)*8-1))&1);
+	ret->top=x=(ri&~x)|(al&x);	/* min(ri,al) */
+	ret->neg=r->neg;
+
 	rp=ret->d;
- -	ap= &(r->d[x]);
- -	if (r->top < x)
- -		al=0;
- -	else
- -		al=r->top-x;
+	ap=&(r->d[ri]);
+
+	{
+	size_t m1,m2;
+
+	v=bn_sub_words(rp,ap,np,ri);
+	/* this ----------------^^ works even in al<ri case
+	 * thanks to zealous zeroing of top of the vector in the
+	 * beginning. */
+
+	/* if (al==ri && !v) || al>ri) nrp=rp; else nrp=ap; */
+	/* in other words if subtraction result is real, then
+	 * trick unconditional memcpy below to perform in-place
+	 * "refresh" instead of actual copy. */
+	m1=0-(size_t)(((al-ri)>>(sizeof(al)*8-1))&1);	/* al<ri */
+	m2=0-(size_t)(((ri-al)>>(sizeof(al)*8-1))&1);	/* al>ri */
+	m1|=m2;			/* (al!=ri) */
+	m1|=(0-(size_t)v);	/* (al!=ri || v) */
+	m1&=~m2;		/* (al!=ri || v) && !al>ri */
+	nrp=(BN_ULONG *)(((size_t)rp&~m1)|((size_t)ap&m1));
+	}
+
+	/* 'i<ri' is chosen to eliminate dependency on input data, even
+	 * though it results in redundant copy in al<ri case. */
+	for (i=0,ri-=4; i<ri; i+=4)
+		{
+		BN_ULONG t1,t2,t3,t4;
+		
+		t1=nrp[i+0];
+		t2=nrp[i+1];
+		t3=nrp[i+2];	ap[i+0]=0;
+		t4=nrp[i+3];	ap[i+1]=0;
+		rp[i+0]=t1;	ap[i+2]=0;
+		rp[i+1]=t2;	ap[i+3]=0;
+		rp[i+2]=t3;
+		rp[i+3]=t4;
+		}
+	for (ri+=4; i<ri; i++)
+		rp[i]=nrp[i], ap[i]=0;
+# else
+	if (bn_wexpand(ret,al) == NULL) goto err;
 	ret->top=al;
+	ret->neg=r->neg;
+
+	rp=ret->d;
+	ap=&(r->d[ri]);
 	al-=4;
 	for (i=0; i<al; i+=4)
 		{
@@ -258,7 +308,7 @@
 	al+=4;
 	for (; i<al; i++)
 		rp[i]=ap[i];
- -#endif
+# endif
 #else /* !MONT_WORD */ 
 	BIGNUM *t1,*t2;
 
@@ -278,10 +328,12 @@
 	if (!BN_rshift(ret,t2,mont->ri)) goto err;
 #endif /* MONT_WORD */
 
+#if !defined(BRANCH_FREE) || BRANCH_FREE==0
 	if (BN_ucmp(ret, &(mont->N)) >= 0)
 		{
 		if (!BN_usub(ret,ret,&(mont->N))) goto err;
 		}
+#endif
 	retn=1;
 	bn_check_top(ret);
  err:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQCVAwUBRrGk++6tTP1JpWPZAQJbjwP/W/6mROtxOVU1gvvq/uFHCytNWHVaJfKA
7zh+v4OPQEIYekIBkEpNFgTJbHcyIZoyDNnwOetkRXvI4LDqvV1V5/pA5bzrKqDj
zv7Hj8R7DGqG8ad0Esf3l7SqqirI3curkIzm5/cALJBJxz/Pp7qyXNzzQgp55UPz
iBDdynBpa+s=
=aquq
-----END PGP SIGNATURE-----
1	http://bugs.gentoo.org/188799
2
3	-----BEGIN PGP SIGNED MESSAGE-----
4	Hash: SHA1
5
6	- --- openssl-0.9.8e/crypto/bn/bn_mont.c 2006-06-16 03:01:14.000000000 +0200
7	+++ openssl-0.9.8-cvs/crypto/bn/bn_mont.c 2007-06-29 10:13:25.000000000 +0200
8	@@ -176,7 +176,6 @@
9
10	max=(nl+al+1); /* allow for overflow (no?) XXX */
11	if (bn_wexpand(r,max) == NULL) goto err;
12	- - if (bn_wexpand(ret,max) == NULL) goto err;
13
14	r->neg=a->neg^n->neg;
15	np=n->d;
16	@@ -228,19 +227,70 @@
17	}
18	bn_correct_top(r);
19
20	- - /* mont->ri will be a multiple of the word size */
21	- -#if 0
22	- - BN_rshift(ret,r,mont->ri);
23	- -#else
24	- - ret->neg = r->neg;
25	- - x=ri;
26	+ /* mont->ri will be a multiple of the word size and below code
27	+ * is kind of BN_rshift(ret,r,mont->ri) equivalent */
28	+ if (r->top <= ri)
29	+ {
30	+ ret->top=0;
31	+ retn=1;
32	+ goto err;
33	+ }
34	+ al=r->top-ri;
35	+
36	+# define BRANCH_FREE 1
37	+# if BRANCH_FREE
38	+ if (bn_wexpand(ret,ri) == NULL) goto err;
39	+ x=0-(((al-ri)>>(sizeof(al)*8-1))&1);
40	+ ret->top=x=(ri&~x)\|(al&x); /* min(ri,al) */
41	+ ret->neg=r->neg;
42	+
43	rp=ret->d;
44	- - ap= &(r->d[x]);
45	- - if (r->top < x)
46	- - al=0;
47	- - else
48	- - al=r->top-x;
49	+ ap=&(r->d[ri]);
50	+
51	+ {
52	+ size_t m1,m2;
53	+
54	+ v=bn_sub_words(rp,ap,np,ri);
55	+ /* this ----------------^^ works even in al<ri case
56	+ * thanks to zealous zeroing of top of the vector in the
57	+ * beginning. */
58	+
59	+ /* if (al==ri && !v) \|\| al>ri) nrp=rp; else nrp=ap; */
60	+ /* in other words if subtraction result is real, then
61	+ * trick unconditional memcpy below to perform in-place
62	+ * "refresh" instead of actual copy. */
63	+ m1=0-(size_t)(((al-ri)>>(sizeof(al)8-1))&1); / al<ri */
64	+ m2=0-(size_t)(((ri-al)>>(sizeof(al)8-1))&1); / al>ri */
65	+ m1\|=m2; /* (al!=ri) */
66	+ m1\|=(0-(size_t)v); /* (al!=ri \|\| v) */
67	+ m1&=~m2; /* (al!=ri \|\| v) && !al>ri */
68	+ nrp=(BN_ULONG *)(((size_t)rp&~m1)\|((size_t)ap&m1));
69	+ }
70	+
71	+ /* 'i<ri' is chosen to eliminate dependency on input data, even
72	+ * though it results in redundant copy in al<ri case. */
73	+ for (i=0,ri-=4; i<ri; i+=4)
74	+ {
75	+ BN_ULONG t1,t2,t3,t4;
76	+
77	+ t1=nrp[i+0];
78	+ t2=nrp[i+1];
79	+ t3=nrp[i+2]; ap[i+0]=0;
80	+ t4=nrp[i+3]; ap[i+1]=0;
81	+ rp[i+0]=t1; ap[i+2]=0;
82	+ rp[i+1]=t2; ap[i+3]=0;
83	+ rp[i+2]=t3;
84	+ rp[i+3]=t4;
85	+ }
86	+ for (ri+=4; i<ri; i++)
87	+ rp[i]=nrp[i], ap[i]=0;
88	+# else
89	+ if (bn_wexpand(ret,al) == NULL) goto err;
90	ret->top=al;
91	+ ret->neg=r->neg;
92	+
93	+ rp=ret->d;
94	+ ap=&(r->d[ri]);
95	al-=4;
96	for (i=0; i<al; i+=4)
97	{
98	@@ -258,7 +308,7 @@
99	al+=4;
100	for (; i<al; i++)
101	rp[i]=ap[i];
102	- -#endif
103	+# endif
104	#else /* !MONT_WORD */
105	BIGNUM t1,t2;
106
107	@@ -278,10 +328,12 @@
108	if (!BN_rshift(ret,t2,mont->ri)) goto err;
109	#endif /* MONT_WORD */
110
111	+#if !defined(BRANCH_FREE) \|\| BRANCH_FREE==0
112	if (BN_ucmp(ret, &(mont->N)) >= 0)
113	{
114	if (!BN_usub(ret,ret,&(mont->N))) goto err;
115	}
116	+#endif
117	retn=1;
118	bn_check_top(ret);
119	err:
120	-----BEGIN PGP SIGNATURE-----
121	Version: GnuPG v1.4.5 (GNU/Linux)
122
123	iQCVAwUBRrGk++6tTP1JpWPZAQJbjwP/W/6mROtxOVU1gvvq/uFHCytNWHVaJfKA
124	7zh+v4OPQEIYekIBkEpNFgTJbHcyIZoyDNnwOetkRXvI4LDqvV1V5/pA5bzrKqDj
125	zv7Hj8R7DGqG8ad0Esf3l7SqqirI3curkIzm5/cALJBJxz/Pp7qyXNzzQgp55UPz
126	iBDdynBpa+s=
127	=aquq
128	-----END PGP SIGNATURE-----