Author: delphij
Date: Wed Nov 29 05:59:50 2017
New Revision: 326359
URL: https://svnweb.freebsd.org/changeset/base/326359
Log:
Fix OpenSSL out-of-bounds read vulnerability.
Security: FreeBSD-SA-17:11
Approved by: so
Modified:
releng/10.3/UPDATING
releng/10.3/crypto/openssl/crypto/x509v3/v3_addr.c
releng/10.3/sys/conf/newvers.sh
releng/10.4/UPDATING
releng/10.4/crypto/openssl/crypto/x509v3/v3_addr.c
releng/10.4/sys/conf/newvers.sh
Modified: releng/10.3/UPDATING
==============================================================================
--- releng/10.3/UPDATING Wed Nov 29 05:59:12 2017 (r326358)
+++ releng/10.3/UPDATING Wed Nov 29 05:59:50 2017 (r326359)
@@ -16,6 +16,10 @@ from older versions of FreeBSD, try WITHOUT_CLANG to b
stable/10, and then rebuild without this option. The bootstrap process from
older version of current is a bit fragile.
+20171129 p25 FreeBSD-SA-17:11.openssl
+
+ Fix OpenSSL out-of-bounds read vulnerability.
+
20171115 p24 FreeBSD-SA-17:08.ptrace
FreeBSD-SA-17:09.shm
FreeBSD-SA-17:10.kldstat
Modified: releng/10.3/crypto/openssl/crypto/x509v3/v3_addr.c
==============================================================================
--- releng/10.3/crypto/openssl/crypto/x509v3/v3_addr.c Wed Nov 29 05:59:12 2017 (r326358)
+++ releng/10.3/crypto/openssl/crypto/x509v3/v3_addr.c Wed Nov 29 05:59:50 2017 (r326359)
@@ -130,10 +130,12 @@ static int length_from_afi(const unsigned afi)
*/
unsigned int v3_addr_get_afi(const IPAddressFamily *f)
{
- return ((f != NULL &&
- f->addressFamily != NULL && f->addressFamily->data != NULL)
- ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
- : 0);
+ if (f == NULL
+ || f->addressFamily == NULL
+ || f->addressFamily->data == NULL
+ || f->addressFamily->length < 2)
+ return 0;
+ return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
}
/*
Modified: releng/10.3/sys/conf/newvers.sh
==============================================================================
--- releng/10.3/sys/conf/newvers.sh Wed Nov 29 05:59:12 2017 (r326358)
+++ releng/10.3/sys/conf/newvers.sh Wed Nov 29 05:59:50 2017 (r326359)
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="10.3"
-BRANCH="RELEASE-p24"
+BRANCH="RELEASE-p25"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
Modified: releng/10.4/UPDATING
==============================================================================
--- releng/10.4/UPDATING Wed Nov 29 05:59:12 2017 (r326358)
+++ releng/10.4/UPDATING Wed Nov 29 05:59:50 2017 (r326359)
@@ -16,6 +16,10 @@ from older versions of FreeBSD, try WITHOUT_CLANG to b
stable/10, and then rebuild without this option. The bootstrap process from
older version of current is a bit fragile.
+20171129 p4 FreeBSD-SA-17:11.openssl
+
+ Fix OpenSSL out-of-bounds read vulnerability.
+
20171115 p3 FreeBSD-SA-17:08.ptrace
FreeBSD-SA-17:09.shm
FreeBSD-SA-17:10.kldstat
Modified: releng/10.4/crypto/openssl/crypto/x509v3/v3_addr.c
==============================================================================
--- releng/10.4/crypto/openssl/crypto/x509v3/v3_addr.c Wed Nov 29 05:59:12 2017 (r326358)
+++ releng/10.4/crypto/openssl/crypto/x509v3/v3_addr.c Wed Nov 29 05:59:50 2017 (r326359)
@@ -130,10 +130,12 @@ static int length_from_afi(const unsigned afi)
*/
unsigned int v3_addr_get_afi(const IPAddressFamily *f)
{
- return ((f != NULL &&
- f->addressFamily != NULL && f->addressFamily->data != NULL)
- ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
- : 0);
+ if (f == NULL
+ || f->addressFamily == NULL
+ || f->addressFamily->data == NULL
+ || f->addressFamily->length < 2)
+ return 0;
+ return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
}
/*
Modified: releng/10.4/sys/conf/newvers.sh
==============================================================================
--- releng/10.4/sys/conf/newvers.sh Wed Nov 29 05:59:12 2017 (r326358)
+++ releng/10.4/sys/conf/newvers.sh Wed Nov 29 05:59:50 2017 (r326359)
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="10.4"
-BRANCH="RELEASE-p3"
+BRANCH="RELEASE-p4"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi