From: Stefan Bühler <stbuehler@web.de>
Date: Wed, 17 Jul 2013 21:51:51 +0000 (+0200)
Subject: gnutls priority string parsing bug fix
X-Git-Tag: gnutls_3_2_3pre0~29
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=913f03ccfafc37277f0a88287d02cdbb9bbfb652;p=thirdparty%2Fgnutls.git

gnutls priority string parsing bug fix

Fix priority string parsing (example: "NONE:+MAC-ALL:-SHA1:+SHA1" misses SHA1 and has MD5 twice)

prio_remove doesn't zero the removed element, prio_add (and perhaps
other functions) assumes the list to be zero terminated.

Make prio_remove zero the element at the end, and use the actual length
of the list in prio_add.

Relying on the trailing zero will fail if the list is full, and might
lead to invalid memory accesses as the loop won't stop until it finds
either the algorithm identifier or 0.
---

diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index d85707e5c4..95bc696477 100644
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -565,6 +565,7 @@ prio_remove (priority_st * priority_list, unsigned int algo)
           priority_list->algorithms--;
           if ((priority_list->algorithms-i) > 0)
             memmove(&priority_list->priority[i], &priority_list->priority[i+1], (priority_list->algorithms-i)*sizeof(priority_list->priority[0]));
+          priority_list->priority[priority_list->algorithms] = 0;
           break;
         }
     }
@@ -575,19 +576,19 @@ prio_remove (priority_st * priority_list, unsigned int algo)
 static void
 prio_add (priority_st * priority_list, unsigned int algo)
 {
-  register int i = 0;
-  while (priority_list->priority[i] != 0)
+  unsigned int i, l = priority_list->algorithms;
+
+  if (l >= MAX_ALGOS)
+    return;                     /* can't add it anyway */
+
+  for (i = 0; i < l; ++i)
     {
       if (algo == priority_list->priority[i])
         return;                 /* if it exists */
-      i++;
     }
 
-  if (i < MAX_ALGOS)
-    {
-      priority_list->priority[i] = algo;
-      priority_list->algorithms++;
-    }
+  priority_list->priority[l] = algo;
+  priority_list->algorithms++;
 
   return;
 }