add a check for invalid DH parameters.

diff --git a/lib/auth/dh_common.c b/lib/auth/dh_common.c
index 3451e8236e991f2650f9d32d6bafc0b782a54046..54a47bd8ba4fbf34ce73ce0f03fcafad57e49944 100644 (file)
--- a/lib/auth/dh_common.c
+++ b/lib/auth/dh_common.c
@@ -301,6 +301,12 @@ _gnutls_dh_common_print_server_kx(gnutls_session_t session,
        int ret;
        unsigned q_bits = session->key.dh_params.flags;
 
+       if (q_bits < 192) {
+               gnutls_assert();
+               _gnutls_debug_log("too small q_bits value for DH: %u\n", q_bits);
+               q_bits = 0; /* auto-detect */
+       }
+
        /* Y=g^x mod p */
        ret =
            _gnutls_pk_generate_keys(GNUTLS_PK_DH, q_bits,