diff options
author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2013-12-12 16:25:36 +0100 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2013-12-18 17:09:07 +0100 |
commit | 62979333a2b871ca928963813985571a3217ba2f (patch) | |
tree | 5d41e95d0cb3c89088d120811f915ebb653f60df | |
parent | 2e426bc5113e651a0e197720a15d30526cb3d2d5 (diff) | |
download | gnutls-62979333a2b871ca928963813985571a3217ba2f.tar.gz |
Enforce the DEFAULT_MAX_VERIFY_BITS for DH prime size as well.
Conflicts:
lib/auth/dh_common.c
Conflicts:
lib/auth/dh_common.c
-rw-r--r-- | lib/auth/dh_common.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/lib/auth/dh_common.c b/lib/auth/dh_common.c index 0d7f088cb7..0bb1ac7af2 100644 --- a/lib/auth/dh_common.c +++ b/lib/auth/dh_common.c @@ -203,7 +203,7 @@ _gnutls_proc_dh_common_server_kx (gnutls_session_t session, uint8_t *data_p; uint8_t *data_g; uint8_t *data_Y; - int i, bits, ret; + int i, bits, ret, p_bits; ssize_t data_size = _data_size; i = 0; @@ -259,7 +259,8 @@ _gnutls_proc_dh_common_server_kx (gnutls_session_t session, return bits; } - if (_gnutls_mpi_get_nbits (session->key.client_p) < (size_t) bits) + p_bits = _gnutls_mpi_get_nbits(session->key.client_p); + if (p_bits < bits) { /* the prime used by the peer is not acceptable */ @@ -269,6 +270,16 @@ _gnutls_proc_dh_common_server_kx (gnutls_session_t session, return GNUTLS_E_DH_PRIME_UNACCEPTABLE; } + if (p_bits >= DEFAULT_MAX_VERIFY_BITS) + { + gnutls_assert(); + _gnutls_debug_log + ("Received a prime of %u bits, limit is %u\n", + (unsigned) p_bits, + (unsigned) DEFAULT_MAX_VERIFY_BITS); + return GNUTLS_E_DH_PRIME_UNACCEPTABLE; + } + _gnutls_dh_set_group (session, session->key.client_g, session->key.client_p); _gnutls_dh_set_peer_public (session, session->key.client_Y); |