gnu/packages/patches/gnutls-CVE-2021-20231.patch

   1 From 15beb4b193b2714d88107e7dffca781798684e7e Mon Sep 17 00:00:00 2001
   2 From: Daiki Ueno <ueno@gnu.org>
   3 Date: Fri, 29 Jan 2021 14:06:05 +0100
   4 Subject: [PATCH 1/2] key_share: avoid use-after-free around realloc
   5
   6 Signed-off-by: Daiki Ueno <ueno@gnu.org>
   7 ---
   8  lib/ext/key_share.c | 12 +++++-------
   9  1 file changed, 5 insertions(+), 7 deletions(-)
  10
  11 diff --git a/lib/ext/key_share.c b/lib/ext/key_share.c
  12 index ab8abf8fe..a8c4bb5cf 100644
  13 --- a/lib/ext/key_share.c
  14 +++ b/lib/ext/key_share.c
  15 @@ -664,14 +664,14 @@ key_share_send_params(gnutls_session_t session,
  16  {
  17         unsigned i;
  18         int ret;
  19 -       unsigned char *lengthp;
  20 -       unsigned int cur_length;
  21         unsigned int generated = 0;
  22         const gnutls_group_entry_st *group;
  23         const version_entry_st *ver;
  24
  25         /* this extension is only being sent on client side */
  26         if (session->security_parameters.entity == GNUTLS_CLIENT) {
  27 +               unsigned int length_pos;
  28 +
  29                 ver = _gnutls_version_max(session);
  30                 if (unlikely(ver == NULL || ver->key_shares == 0))
  31                         return 0;
  32 @@ -679,16 +679,13 @@ key_share_send_params(gnutls_session_t session,
  33                 if (!have_creds_for_tls13(session))
  34                         return 0;
  35
  36 -               /* write the total length later */
  37 -               lengthp = &extdata->data[extdata->length];
  38 +               length_pos = extdata->length;
  39
  40                 ret =
  41                     _gnutls_buffer_append_prefix(extdata, 16, 0);
  42                 if (ret < 0)
  43                         return gnutls_assert_val(ret);
  44
  45 -               cur_length = extdata->length;
  46 -
  47                 if (session->internals.hsk_flags & HSK_HRR_RECEIVED) { /* we know the group */
  48                         group = get_group(session);
  49                         if (unlikely(group == NULL))
  50 @@ -736,7 +733,8 @@ key_share_send_params(gnutls_session_t session,
  51                 }
  52
  53                 /* copy actual length */
  54 -               _gnutls_write_uint16(extdata->length - cur_length, lengthp);
  55 +               _gnutls_write_uint16(extdata->length - length_pos - 2,
  56 +                                    &extdata->data[length_pos]);
  57
  58         } else { /* server */
  59                 ver = get_version(session);
  60 --
  61 2.30.2
  62