Security-59306.61.1.tar.gz

[apple/security.git] / OSX / libsecurity_ssl / lib / sslContext.c

diff --git a/OSX/libsecurity_ssl/lib/sslContext.c b/OSX/libsecurity_ssl/lib/sslContext.c
index eed80f1b744e52470069ae6e0eeb1400eb71c5ee..fc1826feb498ef885f4980884d2c4e133d3f3cb4 100644 (file)
--- a/OSX/libsecurity_ssl/lib/sslContext.c
+++ b/OSX/libsecurity_ssl/lib/sslContext.c
@@ -1195,12 +1195,12 @@ SSLSetProtocolVersionMax  (SSLContextRef      ctx,
         if (version > MINIMUM_DATAGRAM_VERSION ||
             version < MAXIMUM_DATAGRAM_VERSION)
             return errSSLIllegalParam;
         if (version > MINIMUM_DATAGRAM_VERSION ||
             version < MAXIMUM_DATAGRAM_VERSION)
             return errSSLIllegalParam;

-        if (version > ctx->minProtocolVersion)
+        if (version > (SSLProtocolVersion)ctx->minProtocolVersion)

             ctx->minProtocolVersion = version;
     } else {
         if (version < MINIMUM_STREAM_VERSION || version > MAXIMUM_STREAM_VERSION)
             return errSSLIllegalParam;
             ctx->minProtocolVersion = version;
     } else {
         if (version < MINIMUM_STREAM_VERSION || version > MAXIMUM_STREAM_VERSION)
             return errSSLIllegalParam;

-        if (version < ctx->minProtocolVersion)
+        if (version < (SSLProtocolVersion)ctx->minProtocolVersion)

             ctx->minProtocolVersion = version;
     }
     ctx->maxProtocolVersion = version;
             ctx->minProtocolVersion = version;
     }
     ctx->maxProtocolVersion = version;


@@ -1246,6 +1246,9 @@ _SSLProtocolVersionToWireFormatValue   (SSLProtocol protocol)
         case kDTLSProtocol1: {
             return tls_protocol_version_DTLS_1_0;
         }
         case kDTLSProtocol1: {
             return tls_protocol_version_DTLS_1_0;
         }

+        case kDTLSProtocol12: {
+            return tls_protocol_version_DTLS_1_2;
+        }

         case kSSLProtocolUnknown: {
             return tls_protocol_version_Undertermined;
         }
         case kSSLProtocolUnknown: {
             return tls_protocol_version_Undertermined;
         }


@@ -1289,12 +1292,12 @@ SSLSetProtocolVersionEnabled(SSLContextRef     ctx,
                        if (version < MINIMUM_STREAM_VERSION || version > MAXIMUM_STREAM_VERSION) {
                                return errSecParam;
                        }
                        if (version < MINIMUM_STREAM_VERSION || version > MAXIMUM_STREAM_VERSION) {
                                return errSecParam;
                        }

-            if (version > ctx->maxProtocolVersion) {
+            if (version > (SSLProtocolVersion)ctx->maxProtocolVersion) {

                 ctx->maxProtocolVersion = version;
                 if (ctx->minProtocolVersion == SSL_Version_Undetermined)
                     ctx->minProtocolVersion = version;
             }
                 ctx->maxProtocolVersion = version;
                 if (ctx->minProtocolVersion == SSL_Version_Undetermined)
                     ctx->minProtocolVersion = version;
             }

-            if (version < ctx->minProtocolVersion) {
+            if (version < (SSLProtocolVersion)ctx->minProtocolVersion) {

                 ctx->minProtocolVersion = version;
             }
         } else {
                 ctx->minProtocolVersion = version;
             }
         } else {


@@ -1324,7 +1327,7 @@ SSLSetProtocolVersionEnabled(SSLContextRef     ctx,
                                        nextVersion = SSL_Version_Undetermined;
                                        break;
                        }
                                        nextVersion = SSL_Version_Undetermined;
                                        break;
                        }

-                       ctx->minProtocolVersion = max(ctx->minProtocolVersion, nextVersion);
+                       ctx->minProtocolVersion = (tls_protocol_version)max((SSLProtocolVersion)ctx->minProtocolVersion, nextVersion);

                        if (ctx->minProtocolVersion > ctx->maxProtocolVersion) {
                                ctx->minProtocolVersion = SSL_Version_Undetermined;
                                ctx->maxProtocolVersion = SSL_Version_Undetermined;
                        if (ctx->minProtocolVersion > ctx->maxProtocolVersion) {
                                ctx->minProtocolVersion = SSL_Version_Undetermined;
                                ctx->maxProtocolVersion = SSL_Version_Undetermined;


@@ -1358,8 +1361,8 @@ SSLGetProtocolVersionEnabled(SSLContextRef                ctx,
         case kTLSProtocol12:
         {
             SSLProtocolVersion version = SSLProtocolToProtocolVersion(protocol);
         case kTLSProtocol12:
         {
             SSLProtocolVersion version = SSLProtocolToProtocolVersion(protocol);

-                       *enable = (ctx->minProtocolVersion <= version
-                       && ctx->maxProtocolVersion >= version);
+                       *enable = ((SSLProtocolVersion)ctx->minProtocolVersion <= version
+                       && (SSLProtocolVersion)ctx->maxProtocolVersion >= version);

                        break;
         }
                case kSSLProtocolAll:
                        break;
         }
                case kSSLProtocolAll:


@@ -1632,7 +1635,7 @@ SSLCopyTrustedRoots                       (SSLContextRef          ctx,
                CFRetain(ctx->trustedCerts);
                return errSecSuccess;
        }
                CFRetain(ctx->trustedCerts);
                return errSecSuccess;
        }

-#if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE))
+#if TARGET_OS_OSX

        /* use default system roots */
     return sslDefaultSystemRoots(ctx, trustedRoots);
 #else
        /* use default system roots */
     return sslDefaultSystemRoots(ctx, trustedRoots);
 #else


@@ -2515,8 +2518,11 @@ OSStatus SSLGetECDSACurves(
        if(*numCurves < ctx->ecdhNumCurves) {
                return errSecParam;
        }
        if(*numCurves < ctx->ecdhNumCurves) {
                return errSecParam;
        }

-       memmove(namedCurves, ctx->ecdhCurves,
-               (ctx->ecdhNumCurves * sizeof(SSL_ECDSA_NamedCurve)));
+       static_assert(sizeof(*namedCurves) >= sizeof(*(ctx->ecdhCurves)),
+               "SSL_ECDSA_NamedCurve must be large enough for SSLContext ecdhCurves.");
+       for (unsigned i = 0; i < ctx->ecdhNumCurves; i++) {
+               namedCurves[i] = ctx->ecdhCurves[i];
+       }

        *numCurves = ctx->ecdhNumCurves;
        return errSecSuccess;
 }
        *numCurves = ctx->ecdhNumCurves;
        return errSecSuccess;
 }


@@ -2537,20 +2543,26 @@ OSStatus SSLSetECDSACurves(
                return errSecBadReq;
        }
 
                return errSecBadReq;
        }
 

-       size_t size = numCurves * sizeof(uint16_t);
-       ctx->ecdhCurves = (uint16_t *)sslMalloc(size);
+       if (SIZE_MAX / sizeof(*(ctx->ecdhCurves)) < (size_t)numCurves) {
+               return errSecParam;
+       }
+       ctx->ecdhCurves = sslMalloc((size_t)numCurves * sizeof(*(ctx->ecdhCurves)));

        if(ctx->ecdhCurves == NULL) {
                ctx->ecdhNumCurves = 0;
                return errSecAllocate;
        }
 
        if(ctx->ecdhCurves == NULL) {
                ctx->ecdhNumCurves = 0;
                return errSecAllocate;
        }
 

-    for (unsigned i=0; i<numCurves; i++) {
-        ctx->ecdhCurves[i] = namedCurves[i];
-    }
+       for (unsigned i=0; i<numCurves; i++) {
+               if (namedCurves[i] > UINT16_MAX - 1) {
+                       ctx->ecdhCurves[i] = SSL_Curve_None;
+                       continue;
+               }
+               ctx->ecdhCurves[i] = namedCurves[i];
+       }

 
        ctx->ecdhNumCurves = numCurves;
 
 
        ctx->ecdhNumCurves = numCurves;
 

-    tls_handshake_set_curves(ctx->hdsk, ctx->ecdhCurves, ctx->ecdhNumCurves);
+       tls_handshake_set_curves(ctx->hdsk, ctx->ecdhCurves, ctx->ecdhNumCurves);

        return errSecSuccess;
 }
 
        return errSecSuccess;
 }