changeset 1014:37c510c2ac7c coverity

merge
author Matt Johnston <matt@ucc.asn.au>
date Tue, 10 Feb 2015 21:47:43 +0800
parents 0aa1feb8adda (current diff) a1e79ffa5862 (diff)
children b8f4b7027191
files
diffstat 10 files changed, 32 insertions(+), 14 deletions(-) [+]
line wrap: on
line diff
--- a/.hgsigs	Wed Jan 28 22:49:55 2015 +0800
+++ b/.hgsigs	Tue Feb 10 21:47:43 2015 +0800
@@ -13,3 +13,4 @@
 96584b934d04ebab443f603e78d38fe692d36313 0 iEYEABECAAYFAlPVFrQACgkQjPn4sExkf7xr6ACglRiLE21vRrS1rJ809o2yMADIKtwAn1f5SyZUngSde8eE55JxCMwtMC5m
 caac692b366c153cea0e9cd59aa2d79a7d843d4e 0 iEYEABECAAYFAlPk1mcACgkQjPn4sExkf7wLpgCeOqMYqpkf4lYUuyrn9VYThNpc7PkAn3JOSNgIqkKUcmSy6FstrI8jwJzq
 2d421bc0545d1be6d59a4ebfe61606d94b124b0c 0 iEYEABECAAYFAlRJDCQACgkQjPn4sExkf7xUYACcCwVJkYWXJn5x/D5A+qMupy778lEAn0rg1oNiq96YU/4jOPsS5IMItihu
+1d2d81b1b7c1b100e9c369e40b9fa5b2d491eea9 0 iEYEABECAAYFAlTKOKUACgkQjPn4sExkf7xWMACfYFozyHiRk5GaocTa5z6Ws1uyB4kAoLubxoxcnM3E7AA9mHAzc3OB5M0Y
--- a/.hgtags	Wed Jan 28 22:49:55 2015 +0800
+++ b/.hgtags	Tue Feb 10 21:47:43 2015 +0800
@@ -46,3 +46,4 @@
 0d2d39957c029adb7f4327d37fe6b4900f0736d9 DROPBEAR_2014.64
 e9579816f20ea85affc6135e87f8477992808948 DROPBEAR_2014.65
 735511a4c761141416ad0e6728989d2dafa55bc2 DROPBEAR_2014.66
+cbd674d63cd4f3781464a8d4056a5506c8ae926f DROPBEAR_2015.67
--- a/common-algo.c	Wed Jan 28 22:49:55 2015 +0800
+++ b/common-algo.c	Tue Feb 10 21:47:43 2015 +0800
@@ -144,6 +144,12 @@
 #ifdef DROPBEAR_AES256
 	{"aes256-ctr", 0, &dropbear_aes256, 1, &dropbear_mode_ctr},
 #endif
+#ifdef DROPBEAR_TWOFISH256
+	{"twofish256-ctr", 0, &dropbear_twofish256, 1, &dropbear_mode_ctr},
+#endif
+#ifdef DROPBEAR_TWOFISH128
+	{"twofish128-ctr", 0, &dropbear_twofish128, 1, &dropbear_mode_ctr},
+#endif
 #endif /* DROPBEAR_ENABLE_CTR_MODE */
 
 #ifdef DROPBEAR_ENABLE_CBC_MODE
--- a/common-kex.c	Wed Jan 28 22:49:55 2015 +0800
+++ b/common-kex.c	Tue Feb 10 21:47:43 2015 +0800
@@ -629,16 +629,20 @@
 void kexdh_comb_key(struct kex_dh_param *param, mp_int *dh_pub_them,
 		sign_key *hostkey) {
 
-	mp_int dh_p;
+	DEF_MP_INT(dh_p);
+	DEF_MP_INT(dh_p_min1);
 	mp_int *dh_e = NULL, *dh_f = NULL;
 
-	/* read the prime and generator*/
-	m_mp_init(&dh_p);
+	m_mp_init_multi(&dh_p, &dh_p_min1, NULL);
 	load_dh_p(&dh_p);
 
-	/* Check that dh_pub_them (dh_e or dh_f) is in the range [1, p-1] */
-	if (mp_cmp(dh_pub_them, &dh_p) != MP_LT 
-			|| mp_cmp_d(dh_pub_them, 0) != MP_GT) {
+	if (mp_sub_d(&dh_p, 1, &dh_p_min1) != MP_OKAY) { 
+		dropbear_exit("Diffie-Hellman error");
+	}
+
+	/* Check that dh_pub_them (dh_e or dh_f) is in the range [2, p-2] */
+	if (mp_cmp(dh_pub_them, &dh_p_min1) != MP_LT 
+			|| mp_cmp_d(dh_pub_them, 1) != MP_GT) {
 		dropbear_exit("Diffie-Hellman error");
 	}
 	
@@ -649,7 +653,7 @@
 	}
 
 	/* clear no longer needed vars */
-	mp_clear_multi(&dh_p, NULL);
+	mp_clear_multi(&dh_p, &dh_p_min1, NULL);
 
 	/* From here on, the code needs to work with the _same_ vars on each side,
 	 * not vice-versaing for client/server */
--- a/dbrandom.c	Wed Jan 28 22:49:55 2015 +0800
+++ b/dbrandom.c	Tue Feb 10 21:47:43 2015 +0800
@@ -306,7 +306,7 @@
 
 		/* keep regenerating until we get one satisfying
 		 * 0 < rand < max    */
-	} while (mp_cmp(rand, max) != MP_LT);
+	} while (!(mp_cmp(rand, max) == MP_LT && mp_cmp_d(rand, 0) == MP_GT));
 	m_burn(randbuf, len);
 	m_free(randbuf);
 }
--- a/debian/changelog	Wed Jan 28 22:49:55 2015 +0800
+++ b/debian/changelog	Tue Feb 10 21:47:43 2015 +0800
@@ -1,3 +1,9 @@
+dropbear (2015.67-0.1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Matt Johnston <[email protected]>  Wed, 28 Jan 2015 22:53:59 +0800
+
 dropbear (2014.66-0.1) unstable; urgency=low
 
   * New upstream release.
--- a/debug.h	Wed Jan 28 22:49:55 2015 +0800
+++ b/debug.h	Tue Feb 10 21:47:43 2015 +0800
@@ -39,7 +39,7 @@
  * Caution: Don't use this in an unfriendly environment (ie unfirewalled),
  * since the printing may not sanitise strings etc. This will add a reasonable
  * amount to your executable size. */
-/* #define DEBUG_TRACE */
+#define DEBUG_TRACE
 
 /* All functions writing to the cleartext payload buffer call
  * CHECKCLEARTOWRITE() before writing. This is only really useful if you're
--- a/options.h	Wed Jan 28 22:49:55 2015 +0800
+++ b/options.h	Tue Feb 10 21:47:43 2015 +0800
@@ -95,8 +95,8 @@
 #define DROPBEAR_AES256
 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
 /*#define DROPBEAR_BLOWFISH*/
-/*#define DROPBEAR_TWOFISH256*/
-/*#define DROPBEAR_TWOFISH128*/
+#define DROPBEAR_TWOFISH256
+#define DROPBEAR_TWOFISH128
 
 /* Enable CBC mode for ciphers. This has security issues though
  * is the most compatible with older SSH implementations */
--- a/release.sh	Wed Jan 28 22:49:55 2015 +0800
+++ b/release.sh	Tue Feb 10 21:47:43 2015 +0800
@@ -7,7 +7,7 @@
 fi
 
 if ! head -n1 debian/changelog | grep -q $VERSION ; then
-	echo "CHANGES needs updating"
+	echo "debian/changelog needs updating"
 	exit 1
 fi
 
@@ -36,5 +36,5 @@
 (cd $RELDIR/.. && tar cjf $ARCHIVE `basename "$RELDIR"`) || exit 2
 
 ls -l $ARCHIVE
-openssl sha1 $ARCHIVE
+openssl sha -sha256 $ARCHIVE
 echo "Done to $ARCHIVE"
--- a/sysoptions.h	Wed Jan 28 22:49:55 2015 +0800
+++ b/sysoptions.h	Tue Feb 10 21:47:43 2015 +0800
@@ -4,7 +4,7 @@
  *******************************************************************/
 
 #ifndef DROPBEAR_VERSION
-#define DROPBEAR_VERSION "2014.66"
+#define DROPBEAR_VERSION "2015.67"
 #endif
 
 #define LOCAL_IDENT "SSH-2.0-dropbear_" DROPBEAR_VERSION