Corrected nicely hidden bug that caused accesses to uninitialized variables

if the gcry_mpi_print() functions were pessimists and returned more size than
actually needed for the print.

diff --git a/lib/auth_dh_common.c b/lib/auth_dh_common.c
index c1c62d8b334f0734c4f1ce368423466dc439ab71..178572ccf9072f6d9b4bf0084e29dfb7ae79ec91 100644 (file)
--- a/lib/auth_dh_common.c
+++ b/lib/auth_dh_common.c
@@ -95,7 +95,7 @@ _gnutls_proc_dh_common_client_kx (gnutls_session_t session,
     {
       ret = _gnutls_mpi_dprint (session->key->KEY, &session->key->key);
     }
-  else                         /* In DHE_PSK the key is set differently */
+  else /* In DHE_PSK the key is set differently */
     {
       gnutls_datum_t tmp_dh_key;
       ret = _gnutls_mpi_dprint (session->key->KEY, &tmp_dh_key);
@@ -176,7 +176,7 @@ _gnutls_gen_dh_common_client_kx (gnutls_session_t session, opaque ** data)
     {
       ret = _gnutls_mpi_dprint (session->key->KEY, &session->key->key);
     }
-  else                         /* In DHE_PSK the key is set differently */
+  else /* In DHE_PSK the key is set differently */
     {
       gnutls_datum_t tmp_dh_key;
       ret = _gnutls_mpi_dprint (session->key->KEY, &tmp_dh_key);
@@ -363,7 +363,10 @@ _gnutls_dh_common_print_server_kx (gnutls_session_t session,
 
   _gnutls_write_uint16 (n_X, &pdata[pos]);
 
-  ret = data_size;
+  /* do not use data_size. _gnutls_mpi_print() might
+   * have been pessimist and might have returned initially
+   * more data */
+  ret = n_g + n_p + n_X + 6;
 
   return ret;
 }

diff --git a/lib/gcrypt/mpi.c b/lib/gcrypt/mpi.c
index 6adbb1bc9c4d6688c1ffb48f54d33543b6aa2f59..30e0d23fc3f97d7dc2db6b1075c70021b3e4abb2 100644 (file)
--- a/lib/gcrypt/mpi.c
+++ b/lib/gcrypt/mpi.c
@@ -78,7 +78,12 @@ wrap_gcry_mpi_print (const bigint_t a, void *buffer, size_t * nbytes,
   ret = gcry_mpi_print (format, buffer, *nbytes, nbytes, a);
   if (!ret) {
     if (buffer==NULL || init_bytes < *nbytes) {
-      (*nbytes)++;
+
+      /* in STD format we may want to include
+        * an extra byte for zero. Sometimes the gcry_
+        * function doesn't add it.
+        */
+      if (format == GNUTLS_MPI_FORMAT_STD) (*nbytes)++;
       return GNUTLS_E_SHORT_MEMORY_BUFFER;
     }
     return 0;

diff --git a/lib/gnutls_mpi.c b/lib/gnutls_mpi.c
index 98501087204e89f74286958fad98dad05abc9f60..b3d5760ce0d358ca2084aecc8df7d8ee8124b75f 100644 (file)
--- a/lib/gnutls_mpi.c
+++ b/lib/gnutls_mpi.c
@@ -256,8 +256,6 @@ _gnutls_mpi_dprint_size (const bigint_t a, gnutls_datum_t * dest, size_t size)
   if (buf == NULL)
     return GNUTLS_E_MEMORY_ERROR;
 
-  dest->size = MAX (size, bytes);
-
   if (bytes <= size)
     {
       size_t diff = size - bytes;