OpenSSL: OpenSSL_0_9_8-stable: openssl/ssl/ ssl_lib.c

  OpenSSL CVS Repository
  http://cvs.openssl.org/
 
____________________________________________________________
________________

  Server: cvs.openssl.org                  Name:   Ben
Laurie
  Root:   /v/openssl/cvs                   Email:  benopenssl.org
  Module: openssl                          Date:  
19-Sep-2007 14:16:22
  Branch: OpenSSL_0_9_8-stable             Handle:
2007091913162100

  Modified files:           (Branch: OpenSSL_0_9_8-stable)
    openssl/ssl             ssl_lib.c

  Log:
    Lingering "security" fix.

  Summary:
    Revision    Changes     Path
    1.133.2.10  +11 -11     openssl/ssl/ssl_lib.c
 
____________________________________________________________
________________

  patch -p0 <<' .'
  Index: openssl/ssl/ssl_lib.c
 
============================================================
================
  $ cvs diff -u -r1.133.2.9 -r1.133.2.10 ssl_lib.c
  --- openssl/ssl/ssl_lib.c	12 Aug 2007 18:59:02
-0000	1.133.2.9
  +++ openssl/ssl/ssl_lib.c	19 Sep 2007 12:16:21
-0000	1.133.2.10
   -1210,7 +1210,6 
   char *SSL_get_shared_ciphers(const SSL *s,char *buf,int
len)
   	{
   	char *p;
  -	const char *cp;
   	STACK_OF(SSL_CIPHER) *sk;
   	SSL_CIPHER *c;
   	int i;
   -1223,20 +1222,21 
   	sk=s->session->ciphers;
   	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
   		{
  -		/* Decrement for either the ':' or a '' */
  -		len--;
  +		int n;
  +
   		c=sk_SSL_CIPHER_value(sk,i);
  -		for (cp=c->name; *cp; )
  +		n=strlen(c->name);
  +		if (n+1 > len)
   			{
  -			if (len-- <= 0)
  -				{
  -				*p='';
  -				return(buf);
  -				}
  -			else
  -				*(p++)= *(cp++);
  +			if (p != buf)
  +				--p;
  +			*p='';
  +			return buf;
   			}
  +		strcpy(p,c->name);
  +		p+=n;
   		*(p++)=':';
  +		len-=n+1;
   		}
   	p[-1]='';
   	return(buf);
   .
____________________________________________________________
__________
OpenSSL Project                                 http://www.openssl.org
CVS Repository Commit List                    
openssl-cvsopenssl.org
Automated List Manager                          
majordomoopenssl.org