X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=blobdiff_plain;f=CryptoPkg%2FLibrary%2FBaseCryptLib%2FPk%2FCryptDh.c;h=9cbf182c70f5b292a39ab2b67107208fa0173e26;hp=30792d27ca08f6b30eceff3d185448f8d468825f;hb=1cae0c83bbd88822076542e2715077ca2a8bcadb;hpb=6b8ebcb8de52ae5cab543181712e53eeb94340a7

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c
index 30792d27ca..9cbf182c70 100644
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c
@@ -1,7 +1,7 @@
 /** @file
   Diffie-Hellman Wrapper Implementation over OpenSSL.
 
-Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -13,6 +13,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 **/
 
 #include "InternalCryptLib.h"
+#include <openssl/bn.h>
 #include <openssl/dh.h>
 
 
@@ -91,7 +92,7 @@ DhGenerateParameter (
   //
   // Check input parameters.
   //
-  if (DhContext == NULL || Prime == NULL) {
+  if (DhContext == NULL || Prime == NULL || PrimeLength > INT_MAX) {
     return FALSE;
   }
 
@@ -139,12 +140,13 @@ DhSetParameter (
   IN      CONST UINT8  *Prime
   )
 {
-  DH  *Dh;
+  DH      *Dh;
+  BIGNUM  *Bn;
 
   //
   // Check input parameters.
   //
-  if (DhContext == NULL || Prime == NULL) {
+  if (DhContext == NULL || Prime == NULL || PrimeLength > INT_MAX) {
     return FALSE;
   }
   
@@ -152,14 +154,46 @@ DhSetParameter (
     return FALSE;
   }
 
+  Bn = NULL;
+
   Dh = (DH *) DhContext;
-  Dh->p = BN_new();
-  Dh->g = BN_new();
+  Dh->g = NULL;
+  Dh->p = BN_new ();
+  if (Dh->p == NULL) {
+    goto Error;
+  }
+  
+  Dh->g = BN_new ();
+  if (Dh->g == NULL) {
+    goto Error;
+  }
 
-  BN_bin2bn (Prime, (UINT32) (PrimeLength / 8), Dh->p);
-  BN_set_word (Dh->g, (UINT32) Generator);
+  Bn = BN_bin2bn (Prime, (UINT32) (PrimeLength / 8), Dh->p);
+  if (Bn == NULL) {
+    goto Error;
+  }
+
+  if (BN_set_word (Dh->g, (UINT32) Generator) == 0) {
+    goto Error;
+  }
 
   return TRUE;
+
+Error:
+
+  if (Dh->p != NULL) {
+    BN_free (Dh->p);
+  }
+
+  if (Dh->g != NULL) {
+    BN_free (Dh->g);
+  }
+
+  if (Bn != NULL) {
+    BN_free (Bn);
+  }
+  
+  return FALSE;
 }
 
 /**
@@ -194,6 +228,7 @@ DhGenerateKey (
 {
   BOOLEAN RetVal;
   DH      *Dh;
+  INTN    Size;
 
   //
   // Check input parameters.
@@ -207,12 +242,17 @@ DhGenerateKey (
   }
   
   Dh = (DH *) DhContext;
-  *PublicKeySize = 0;
 
   RetVal = (BOOLEAN) DH_generate_key (DhContext);
   if (RetVal) {
+    Size = BN_num_bytes (Dh->pub_key);
+    if ((Size > 0) && (*PublicKeySize < (UINTN) Size)) {
+      *PublicKeySize = Size;
+      return FALSE;
+    }
+    
     BN_bn2bin (Dh->pub_key, PublicKey);
-    *PublicKeySize  = BN_num_bytes (Dh->pub_key);
+    *PublicKeySize = Size;
   }
 
   return RetVal;
@@ -227,7 +267,8 @@ DhGenerateKey (
   If DhContext is NULL, then return FALSE.
   If PeerPublicKey is NULL, then return FALSE.
   If KeySize is NULL, then return FALSE.
-  If KeySize is large enough but Key is NULL, then return FALSE.
+  If Key is NULL, then return FALSE.
+  If KeySize is not large enough, then return FALSE.
 
   @param[in, out]  DhContext          Pointer to the DH context.
   @param[in]       PeerPublicKey      Pointer to the peer's public key.
@@ -252,23 +293,37 @@ DhComputeKey (
   )
 {
   BIGNUM  *Bn;
+  INTN    Size;
 
   //
   // Check input parameters.
   //
-  if (DhContext == NULL || PeerPublicKey == NULL || KeySize == NULL) {
+  if (DhContext == NULL || PeerPublicKey == NULL || KeySize == NULL || Key == NULL) {
     return FALSE;
   }
 
-  if (Key == NULL && *KeySize != 0) {
+  if (PeerPublicKeySize > INT_MAX) {
     return FALSE;
   }
   
   Bn = BN_bin2bn (PeerPublicKey, (UINT32) PeerPublicKeySize, NULL);
+  if (Bn == NULL) {
+    return FALSE;
+  }
 
-  *KeySize = (BOOLEAN) DH_compute_key (Key, Bn, DhContext);
+  Size = DH_compute_key (Key, Bn, DhContext);
+  if (Size < 0) {
+    BN_free (Bn);
+    return FALSE;
+  }
 
-  BN_free (Bn);
+  if (*KeySize < (UINTN) Size) {
+    *KeySize = Size;
+    BN_free (Bn);
+    return FALSE;
+  }
 
+  *KeySize = Size;
+  BN_free (Bn);
   return TRUE;
 }