diff options
Diffstat (limited to 'chromium/net')
| -rw-r--r-- | chromium/net/third_party/nss/README.chromium | 3 | ||||
| -rwxr-xr-x | chromium/net/third_party/nss/patches/applypatches.sh | 2 | ||||
| -rw-r--r-- | chromium/net/third_party/nss/ssl/ssl3con.c | 3 |
3 files changed, 7 insertions, 1 deletions
diff --git a/chromium/net/third_party/nss/README.chromium b/chromium/net/third_party/nss/README.chromium index a1c53038b13..b3f98533c73 100644 --- a/chromium/net/third_party/nss/README.chromium +++ b/chromium/net/third_party/nss/README.chromium @@ -109,6 +109,9 @@ Patches: patches/ignorechangecipherspec.patch https://bugzilla.mozilla.org/show_bug.cgi?id=1009227 + * Increase the minimum DH group size to 1024 + patches/dh1024.patch + Apply the patches to NSS by running the patches/applypatches.sh script. Read the comments at the top of patches/applypatches.sh for instructions. diff --git a/chromium/net/third_party/nss/patches/applypatches.sh b/chromium/net/third_party/nss/patches/applypatches.sh index b5f9d30a197..f8c1f6c3edd 100755 --- a/chromium/net/third_party/nss/patches/applypatches.sh +++ b/chromium/net/third_party/nss/patches/applypatches.sh @@ -50,3 +50,5 @@ patch -p4 < $patches_dir/nssrwlock.patch patch -p4 < $patches_dir/paddingextvalue.patch patch -p4 < $patches_dir/reorderextensions.patch + +patch -p2 < $patches_dir/dh1024.patch diff --git a/chromium/net/third_party/nss/ssl/ssl3con.c b/chromium/net/third_party/nss/ssl/ssl3con.c index 7ff7beacbc1..67fdfe1d28f 100644 --- a/chromium/net/third_party/nss/ssl/ssl3con.c +++ b/chromium/net/third_party/nss/ssl/ssl3con.c @@ -6922,7 +6922,8 @@ ssl3_HandleServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length) if (rv != SECSuccess) { goto loser; /* malformed. */ } - if (dh_p.len < 512/8) { + if (dh_p.len < 1024/8 || + (dh_p.len == 1024/8 && (dh_p.data[0] & 0x80) == 0)) { errCode = SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY; goto alert_loser; } |