some cleanups in the record protocol processing.

diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index 3c7eabdd70fba82ac291a173ac977e4b662fb9a3..cca6a8fed4d3c23193063d9fd2e604739c2c9058 100644 (file)
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -332,7 +332,7 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
        uint8 MAC[MAX_HASH_SIZE];
        uint16 c_length;
        uint8 pad;
-       uint16 length;
+       int length;
        GNUTLS_MAC_HANDLE td;
        uint16 blocksize;
        int ret, i, pad_failed = 0;
@@ -407,7 +407,8 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
                 */
                if ( ver == GNUTLS_TLS1)
                for (i=2;i<pad;i++) {
-                       if (ciphertext.data[ciphertext.size-i] != ciphertext.data[ciphertext.size - 1]) {
+                       if (ciphertext.data[ciphertext.size-i] != ciphertext.data[ciphertext.size - 1]) 
+                       {
                                pad_failed = GNUTLS_E_DECRYPTION_FAILED;
                        }
                }
@@ -418,15 +419,7 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
                return GNUTLS_E_INTERNAL_ERROR;
        }
 
-       /* copy the decrypted stuff to compress_data.
-        */
-       if (compress_size < length) {
-               gnutls_assert();
-               return GNUTLS_E_INTERNAL_ERROR;
-       }
-
-       memcpy( compress_data, ciphertext.data, length);
-
+       if (length < 0) length = 0;
        c_length = _gnutls_conv_uint16((uint16) length);
 
        /* Pass the type, version, length and compressed through
@@ -442,12 +435,17 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
                }
                _gnutls_hmac(td, &c_length, 2);
                
-               if (length!=0)
-                       _gnutls_hmac(td, compress_data, length);
+               if (length > 0)
+                       _gnutls_hmac(td, ciphertext.data, length);
 
                mac_deinit( td, MAC, ver);
        }
 
+       /* This one was introduced to avoid a timing attack against the TLS
+        * 1.0 protocol.
+        */
+       if (pad_failed != 0) return pad_failed;
+
        /* HMAC was not the same. 
         */
        if (memcmp
@@ -455,11 +453,14 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
                gnutls_assert();
                return GNUTLS_E_DECRYPTION_FAILED;
        }
-       
-       /* This one was introduced to avoid a timing attack against the TLS
-        * 1.0 protocol.
+
+       /* copy the decrypted stuff to compress_data.
         */
-       if (pad_failed != 0) return pad_failed;
+       if (compress_size < length) {
+               gnutls_assert();
+               return GNUTLS_E_INTERNAL_ERROR;
+       }
+       memcpy( compress_data, ciphertext.data, length);
 
        return length;
 }

diff --git a/lib/gnutls_cipher_int.c b/lib/gnutls_cipher_int.c
index caddcebcd6b45e58dacfd386c7c90258a07de56e..05267fff1b8c09254950726afaf76efe096be89d 100644 (file)
--- a/lib/gnutls_cipher_int.c
+++ b/lib/gnutls_cipher_int.c
@@ -66,7 +66,9 @@ gcry_error_t err = GPG_ERR_GENERAL; /* doesn't matter */
        return ret;     
 }
 
-int _gnutls_cipher_encrypt(GNUTLS_CIPHER_HANDLE handle, void* text, int textlen) {
+int _gnutls_cipher_encrypt(GNUTLS_CIPHER_HANDLE handle, void* text, 
+       int textlen) 
+{
        if (handle!=GNUTLS_CIPHER_FAILED) {
                if (gcry_cipher_encrypt( handle, text, textlen, NULL, textlen)!=0) {
                        gnutls_assert();
@@ -76,7 +78,9 @@ int _gnutls_cipher_encrypt(GNUTLS_CIPHER_HANDLE handle, void* text, int textlen)
        return 0;
 }
 
-int _gnutls_cipher_decrypt(GNUTLS_CIPHER_HANDLE handle, void* ciphertext, int ciphertextlen) {
+int _gnutls_cipher_decrypt(GNUTLS_CIPHER_HANDLE handle, void* ciphertext, 
+       int ciphertextlen) 
+{
        if (handle!=GNUTLS_CIPHER_FAILED) {
                if (gcry_cipher_decrypt( handle, ciphertext, ciphertextlen, NULL, ciphertextlen)!=0) {
                        gnutls_assert();
@@ -86,7 +90,8 @@ int _gnutls_cipher_decrypt(GNUTLS_CIPHER_HANDLE handle, void* ciphertext, int ci
        return 0;
 }
 
-void _gnutls_cipher_deinit(GNUTLS_CIPHER_HANDLE handle) {
+void _gnutls_cipher_deinit(GNUTLS_CIPHER_HANDLE handle) 
+{
        if (handle!=GNUTLS_CIPHER_FAILED) {
                gcry_cipher_close(handle);
        }