Skip to content

Commit b98dab1

Browse files
InfoHunterInfoHunter
authored
Merge pull request #692 from dongbeiouba/fix84/CVE-2022-4304
Alternative fix for CVE-2022-4304
2 parents 0f7b8a4 + 6628d2c commit b98dab1

File tree

13 files changed

+131
-813
lines changed

13 files changed

+131
-813
lines changed

‎.github/workflows/cross-compiles.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ jobs:
5555
}, {
5656
arch: m68k-linux-gnu,
5757
libs: libc6-dev-m68k-cross,
58-
target: -static -m68040 linux-latomic,
58+
target: -static -m68040 linux-latomic -Wno-stringop-overflow,
5959
fips: no,
6060
tests: -test_includes -test_store -test_x509_store
6161
}, {
@@ -85,7 +85,7 @@ jobs:
8585
}, {
8686
arch: s390x-linux-gnu,
8787
libs: libc6-dev-s390x-cross,
88-
target: linux64-s390x
88+
target: linux64-s390x -Wno-stringop-overflow
8989
}, {
9090
arch: sh4-linux-gnu,
9191
libs: libc6-dev-sh4-cross,
@@ -104,7 +104,7 @@ jobs:
104104
}, {
105105
arch: m68k-linux-gnu,
106106
libs: libc6-dev-m68k-cross,
107-
target: -mcfv4e linux-latomic,
107+
target: -mcfv4e linux-latomic -Wno-stringop-overflow,
108108
tests: none
109109
}, {
110110
arch: mips-linux-gnu,

‎CHANGES

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66

77
*) 修复CVE-2024-6119
88

9+
*) 重新修复CVE-2022-4304
10+
911
*) 修复CVE-2024-5535
1012

1113
*) 修复CVE-2024-4741

‎Configure

+3-2
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ my @gcc_devteam_warn = qw(
155155
-Wsign-compare
156156
-Wshadow
157157
-Wformat
158-
-Wtype-limits
158+
-Wno-type-limits
159159
-Wundef
160160
-Werror
161161
-Wmissing-prototypes
@@ -172,10 +172,11 @@ my @gcc_devteam_warn = qw(
172172
# -Wextended-offsetof -- no, needed in CMS ASN1 code
173173
my @clang_devteam_warn = qw(
174174
-Wno-unknown-warning-option
175-
-Wswitch-default
176175
-Wno-parentheses-equality
177176
-Wno-language-extension-token
178177
-Wno-extended-offsetof
178+
-Wno-missing-braces
179+
-Wno-tautological-constant-out-of-range-compare
179180
-Wconditional-uninitialized
180181
-Wincompatible-pointer-types-discards-qualifiers
181182
-Wmissing-variable-declarations

‎crypto/bn/bn_asm.c

+58-48
Original file line numberDiff line numberDiff line change
@@ -381,25 +381,33 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
381381
#ifndef OPENSSL_SMALL_FOOTPRINT
382382
while (n & ~3) {
383383
t1 = a[0];
384-
t2 = b[0];
385-
r[0] = (t1 - t2 - c) & BN_MASK2;
386-
if (t1 != t2)
387-
c = (t1 < t2);
384+
t2 = (t1 - c) & BN_MASK2;
385+
c = (t2 > t1);
386+
t1 = b[0];
387+
t1 = (t2 - t1) & BN_MASK2;
388+
r[0] = t1;
389+
c += (t1 > t2);
388390
t1 = a[1];
389-
t2 = b[1];
390-
r[1] = (t1 - t2 - c) & BN_MASK2;
391-
if (t1 != t2)
392-
c = (t1 < t2);
391+
t2 = (t1 - c) & BN_MASK2;
392+
c = (t2 > t1);
393+
t1 = b[1];
394+
t1 = (t2 - t1) & BN_MASK2;
395+
r[1] = t1;
396+
c += (t1 > t2);
393397
t1 = a[2];
394-
t2 = b[2];
395-
r[2] = (t1 - t2 - c) & BN_MASK2;
396-
if (t1 != t2)
397-
c = (t1 < t2);
398+
t2 = (t1 - c) & BN_MASK2;
399+
c = (t2 > t1);
400+
t1 = b[2];
401+
t1 = (t2 - t1) & BN_MASK2;
402+
r[2] = t1;
403+
c += (t1 > t2);
398404
t1 = a[3];
399-
t2 = b[3];
400-
r[3] = (t1 - t2 - c) & BN_MASK2;
401-
if (t1 != t2)
402-
c = (t1 < t2);
405+
t2 = (t1 - c) & BN_MASK2;
406+
c = (t2 > t1);
407+
t1 = b[3];
408+
t1 = (t2 - t1) & BN_MASK2;
409+
r[3] = t1;
410+
c += (t1 > t2);
403411
a += 4;
404412
b += 4;
405413
r += 4;
@@ -408,10 +416,12 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
408416
#endif
409417
while (n) {
410418
t1 = a[0];
411-
t2 = b[0];
412-
r[0] = (t1 - t2 - c) & BN_MASK2;
413-
if (t1 != t2)
414-
c = (t1 < t2);
419+
t2 = (t1 - c) & BN_MASK2;
420+
c = (t2 > t1);
421+
t1 = b[0];
422+
t1 = (t2 - t1) & BN_MASK2;
423+
r[0] = t1;
424+
c += (t1 > t2);
415425
a++;
416426
b++;
417427
r++;
@@ -449,7 +459,7 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
449459
t += c0; /* no carry */ \
450460
c0 = (BN_ULONG)Lw(t); \
451461
hi = (BN_ULONG)Hw(t); \
452-
c1 = (c1+hi)&BN_MASK2; if (c1<hi) c2++; \
462+
c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi); \
453463
} while(0)
454464

455465
# define mul_add_c2(a,b,c0,c1,c2) do { \
@@ -458,11 +468,11 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
458468
BN_ULLONG tt = t+c0; /* no carry */ \
459469
c0 = (BN_ULONG)Lw(tt); \
460470
hi = (BN_ULONG)Hw(tt); \
461-
c1 = (c1+hi)&BN_MASK2; if (c1<hi) c2++; \
471+
c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi); \
462472
t += c0; /* no carry */ \
463473
c0 = (BN_ULONG)Lw(t); \
464474
hi = (BN_ULONG)Hw(t); \
465-
c1 = (c1+hi)&BN_MASK2; if (c1<hi) c2++; \
475+
c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi); \
466476
} while(0)
467477

468478
# define sqr_add_c(a,i,c0,c1,c2) do { \
@@ -471,7 +481,7 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
471481
t += c0; /* no carry */ \
472482
c0 = (BN_ULONG)Lw(t); \
473483
hi = (BN_ULONG)Hw(t); \
474-
c1 = (c1+hi)&BN_MASK2; if (c1<hi) c2++; \
484+
c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi); \
475485
} while(0)
476486

477487
# define sqr_add_c2(a,i,j,c0,c1,c2) \
@@ -486,26 +496,26 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
486496
BN_ULONG ta = (a), tb = (b); \
487497
BN_ULONG lo, hi; \
488498
BN_UMULT_LOHI(lo,hi,ta,tb); \
489-
c0 += lo; hi += (c0<lo)?1:0; \
490-
c1 += hi; c2 += (c1<hi)?1:0; \
499+
c0 += lo; hi += (c0<lo); \
500+
c1 += hi; c2 += (c1<hi); \
491501
} while(0)
492502

493503
# define mul_add_c2(a,b,c0,c1,c2) do { \
494504
BN_ULONG ta = (a), tb = (b); \
495505
BN_ULONG lo, hi, tt; \
496506
BN_UMULT_LOHI(lo,hi,ta,tb); \
497-
c0 += lo; tt = hi+((c0<lo)?1:0); \
498-
c1 += tt; c2 += (c1<tt)?1:0; \
499-
c0 += lo; hi += (c0<lo)?1:0; \
500-
c1 += hi; c2 += (c1<hi)?1:0; \
507+
c0 += lo; tt = hi + (c0<lo); \
508+
c1 += tt; c2 += (c1<tt); \
509+
c0 += lo; hi += (c0<lo); \
510+
c1 += hi; c2 += (c1<hi); \
501511
} while(0)
502512

503513
# define sqr_add_c(a,i,c0,c1,c2) do { \
504514
BN_ULONG ta = (a)[i]; \
505515
BN_ULONG lo, hi; \
506516
BN_UMULT_LOHI(lo,hi,ta,ta); \
507-
c0 += lo; hi += (c0<lo)?1:0; \
508-
c1 += hi; c2 += (c1<hi)?1:0; \
517+
c0 += lo; hi += (c0<lo); \
518+
c1 += hi; c2 += (c1<hi); \
509519
} while(0)
510520

511521
# define sqr_add_c2(a,i,j,c0,c1,c2) \
@@ -520,26 +530,26 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
520530
BN_ULONG ta = (a), tb = (b); \
521531
BN_ULONG lo = ta * tb; \
522532
BN_ULONG hi = BN_UMULT_HIGH(ta,tb); \
523-
c0 += lo; hi += (c0<lo)?1:0; \
524-
c1 += hi; c2 += (c1<hi)?1:0; \
533+
c0 += lo; hi += (c0<lo); \
534+
c1 += hi; c2 += (c1<hi); \
525535
} while(0)
526536

527537
# define mul_add_c2(a,b,c0,c1,c2) do { \
528538
BN_ULONG ta = (a), tb = (b), tt; \
529539
BN_ULONG lo = ta * tb; \
530540
BN_ULONG hi = BN_UMULT_HIGH(ta,tb); \
531-
c0 += lo; tt = hi + ((c0<lo)?1:0); \
532-
c1 += tt; c2 += (c1<tt)?1:0; \
533-
c0 += lo; hi += (c0<lo)?1:0; \
534-
c1 += hi; c2 += (c1<hi)?1:0; \
541+
c0 += lo; tt = hi + (c0<lo); \
542+
c1 += tt; c2 += (c1<tt); \
543+
c0 += lo; hi += (c0<lo); \
544+
c1 += hi; c2 += (c1<hi); \
535545
} while(0)
536546

537547
# define sqr_add_c(a,i,c0,c1,c2) do { \
538548
BN_ULONG ta = (a)[i]; \
539549
BN_ULONG lo = ta * ta; \
540550
BN_ULONG hi = BN_UMULT_HIGH(ta,ta); \
541-
c0 += lo; hi += (c0<lo)?1:0; \
542-
c1 += hi; c2 += (c1<hi)?1:0; \
551+
c0 += lo; hi += (c0<lo); \
552+
c1 += hi; c2 += (c1<hi); \
543553
} while(0)
544554

545555
# define sqr_add_c2(a,i,j,c0,c1,c2) \
@@ -554,8 +564,8 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
554564
BN_ULONG lo = LBITS(a), hi = HBITS(a); \
555565
BN_ULONG bl = LBITS(b), bh = HBITS(b); \
556566
mul64(lo,hi,bl,bh); \
557-
c0 = (c0+lo)&BN_MASK2; if (c0<lo) hi++; \
558-
c1 = (c1+hi)&BN_MASK2; if (c1<hi) c2++; \
567+
c0 = (c0+lo)&BN_MASK2; hi += (c0<lo); \
568+
c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi); \
559569
} while(0)
560570

561571
# define mul_add_c2(a,b,c0,c1,c2) do { \
@@ -564,17 +574,17 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
564574
BN_ULONG bl = LBITS(b), bh = HBITS(b); \
565575
mul64(lo,hi,bl,bh); \
566576
tt = hi; \
567-
c0 = (c0+lo)&BN_MASK2; if (c0<lo) tt++; \
568-
c1 = (c1+tt)&BN_MASK2; if (c1<tt) c2++; \
569-
c0 = (c0+lo)&BN_MASK2; if (c0<lo) hi++; \
570-
c1 = (c1+hi)&BN_MASK2; if (c1<hi) c2++; \
577+
c0 = (c0+lo)&BN_MASK2; tt += (c0<lo); \
578+
c1 = (c1+tt)&BN_MASK2; c2 += (c1<tt); \
579+
c0 = (c0+lo)&BN_MASK2; hi += (c0<lo); \
580+
c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi); \
571581
} while(0)
572582

573583
# define sqr_add_c(a,i,c0,c1,c2) do { \
574584
BN_ULONG lo, hi; \
575585
sqr64(lo,hi,(a)[i]); \
576-
c0 = (c0+lo)&BN_MASK2; if (c0<lo) hi++; \
577-
c1 = (c1+hi)&BN_MASK2; if (c1<hi) c2++; \
586+
c0 = (c0+lo)&BN_MASK2; hi += (c0<lo); \
587+
c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi); \
578588
} while(0)
579589

580590
# define sqr_add_c2(a,i,j,c0,c1,c2) \

‎crypto/bn/bn_blind.c

+16-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,20 @@
1313

1414
#define BN_BLINDING_COUNTER 32
1515

16+
struct bn_blinding_st {
17+
BIGNUM *A;
18+
BIGNUM *Ai;
19+
BIGNUM *e;
20+
BIGNUM *mod; /* just a reference */
21+
CRYPTO_THREAD_ID tid;
22+
int counter;
23+
unsigned long flags;
24+
BN_MONT_CTX *m_ctx;
25+
int (*bn_mod_exp) (BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
26+
const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
27+
CRYPTO_RWLOCK *lock;
28+
};
29+
1630
BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod)
1731
{
1832
BN_BLINDING *ret = NULL;
@@ -177,7 +191,8 @@ int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b,
177191
n->top = (int)(rtop & ~mask) | (ntop & mask);
178192
n->flags |= (BN_FLG_FIXED_TOP & ~mask);
179193
}
180-
ret = BN_mod_mul_montgomery(n, n, r, b->m_ctx, ctx);
194+
ret = bn_mul_mont_fixed_top(n, n, r, b->m_ctx, ctx);
195+
bn_correct_top_consttime(n);
181196
} else {
182197
ret = BN_mod_mul(n, n, r, b->mod, ctx);
183198
}

‎crypto/bn/bn_lib.c

+22
Original file line numberDiff line numberDiff line change
@@ -1021,6 +1021,28 @@ BIGNUM *bn_wexpand(BIGNUM *a, int words)
10211021
return (words <= a->dmax) ? a : bn_expand2(a, words);
10221022
}
10231023

1024+
void bn_correct_top_consttime(BIGNUM *a)
1025+
{
1026+
int j, atop;
1027+
BN_ULONG limb;
1028+
unsigned int mask;
1029+
1030+
for (j = 0, atop = 0; j < a->dmax; j++) {
1031+
limb = a->d[j];
1032+
limb |= 0 - limb;
1033+
limb >>= BN_BITS2 - 1;
1034+
limb = 0 - limb;
1035+
mask = (unsigned int)limb;
1036+
mask &= constant_time_msb(j - a->top);
1037+
atop = constant_time_select_int(mask, j + 1, atop);
1038+
}
1039+
1040+
mask = constant_time_eq_int(atop, 0);
1041+
a->top = atop;
1042+
a->neg = constant_time_select_int(mask, 0, a->neg);
1043+
a->flags &= ~BN_FLG_FIXED_TOP;
1044+
}
1045+
10241046
void bn_correct_top(BIGNUM *a)
10251047
{
10261048
BN_ULONG *ftl;

0 commit comments

Comments
 (0)