[27715] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.11]: Ignore missing Q in dh_params
daemon@ATHENA.MIT.EDU (Tom Yu)
Thu Apr 25 14:22:58 2013
Date: Thu, 25 Apr 2013 14:22:55 -0400
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201304251822.r3PIMt6d006487@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/5d2c49df555fbf56d3b15a9096cad729525c5f74
commit 5d2c49df555fbf56d3b15a9096cad729525c5f74
Author: Tom Yu <tlyu@mit.edu>
Date: Thu Mar 28 19:09:04 2013 -0400
Ignore missing Q in dh_params
Some implementations don't send the required Q value in dh_params, so
allow it to be absent.
(cherry picked from commit ed77a25c53ed6afd41372838f205a98a561a89fb)
ticket: 7596
version_fixed: 1.11.3
status: resolved
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 390797a..2cd3440 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -2955,9 +2955,9 @@ pkinit_decode_dh_params(DH ** a, unsigned char **pp, unsigned int len)
}
}
- M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
- if (aip == NULL)
- return NULL;
+ M_ASN1_D2I_get_opt(aip, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
+ if (aip == NULL || ai.data == NULL)
+ (*a)->q = NULL;
else {
(*a)->q = ASN1_INTEGER_to_BN(aip, NULL);
if ((*a)->q == NULL)
@@ -3282,7 +3282,7 @@ pkinit_check_dh_params(BIGNUM * p1, BIGNUM * p2, BIGNUM * g1, BIGNUM * q1)
if (!BN_cmp(g1, g2)) {
q2 = BN_new();
BN_rshift1(q2, p1);
- if (!BN_cmp(q1, q2)) {
+ if (q1 == NULL || !BN_cmp(q1, q2)) {
pkiDebug("good %d dhparams\n", BN_num_bits(p1));
retval = 0;
} else
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
