From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sun, 23 May 2010 17:42:14 +0000 (+0200)
Subject: Corrected nicely hidden bug that caused accesses to uninitialized variables
X-Git-Tag: gnutls_2_11_3~257
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=71df305f042f9d54486cfb1122c4671a19559b69;p=thirdparty%2Fgnutls.git

Corrected nicely hidden bug that caused accesses to uninitialized variables
if the gcry_mpi_print() functions were pessimists and returned more size than
actually needed for the print.
---

diff --git a/lib/auth_dh_common.c b/lib/auth_dh_common.c
index c1c62d8b33..178572ccf9 100644
--- a/lib/auth_dh_common.c
+++ b/lib/auth_dh_common.c
@@ -95,7 +95,7 @@ _gnutls_proc_dh_common_client_kx (gnutls_session_t session,
     {
       ret = _gnutls_mpi_dprint (session->key->KEY, &session->key->key);
     }
-  else				/* In DHE_PSK the key is set differently */
+  else	/* In DHE_PSK the key is set differently */
     {
       gnutls_datum_t tmp_dh_key;
       ret = _gnutls_mpi_dprint (session->key->KEY, &tmp_dh_key);
@@ -176,7 +176,7 @@ _gnutls_gen_dh_common_client_kx (gnutls_session_t session, opaque ** data)
     {
       ret = _gnutls_mpi_dprint (session->key->KEY, &session->key->key);
     }
-  else				/* In DHE_PSK the key is set differently */
+  else	/* In DHE_PSK the key is set differently */
     {
       gnutls_datum_t tmp_dh_key;
       ret = _gnutls_mpi_dprint (session->key->KEY, &tmp_dh_key);
@@ -363,7 +363,10 @@ _gnutls_dh_common_print_server_kx (gnutls_session_t session,
 
   _gnutls_write_uint16 (n_X, &pdata[pos]);
 
-  ret = data_size;
+  /* do not use data_size. _gnutls_mpi_print() might
+   * have been pessimist and might have returned initially
+   * more data */
+  ret = n_g + n_p + n_X + 6;
 
   return ret;
 }
diff --git a/lib/gcrypt/mpi.c b/lib/gcrypt/mpi.c
index 6adbb1bc9c..30e0d23fc3 100644
--- a/lib/gcrypt/mpi.c
+++ b/lib/gcrypt/mpi.c
@@ -78,7 +78,12 @@ wrap_gcry_mpi_print (const bigint_t a, void *buffer, size_t * nbytes,
   ret = gcry_mpi_print (format, buffer, *nbytes, nbytes, a);
   if (!ret) {
     if (buffer==NULL || init_bytes < *nbytes) {
-      (*nbytes)++;
+
+      /* in STD format we may want to include
+        * an extra byte for zero. Sometimes the gcry_
+        * function doesn't add it.
+        */
+      if (format == GNUTLS_MPI_FORMAT_STD) (*nbytes)++;
       return GNUTLS_E_SHORT_MEMORY_BUFFER;
     }
     return 0;
diff --git a/lib/gnutls_mpi.c b/lib/gnutls_mpi.c
index 9850108720..b3d5760ce0 100644
--- a/lib/gnutls_mpi.c
+++ b/lib/gnutls_mpi.c
@@ -256,8 +256,6 @@ _gnutls_mpi_dprint_size (const bigint_t a, gnutls_datum_t * dest, size_t size)
   if (buf == NULL)
     return GNUTLS_E_MEMORY_ERROR;
 
-  dest->size = MAX (size, bytes);
-
   if (bytes <= size)
     {
       size_t diff = size - bytes;