commit ec2fede9467ae1a65f452d3a39f7fbc4891d9285
Author: Dr. Stephen Henson <steve@openssl.org>
Date:   Sat Dec 20 15:09:50 2014 +0000

    Fix various certificate fingerprint issues.
    
    By using non-DER or invalid encodings outside the signed portion of a
    certificate the fingerprint can be changed without breaking the signature.
    Although no details of the signed portion of the certificate can be changed
    this can cause problems with some applications: e.g. those using the
    certificate fingerprint for blacklists.
    
    1. Reject signatures with non zero unused bits.
    
    If the BIT STRING containing the signature has non zero unused bits reject
    the signature. All current signature algorithms require zero unused bits.
    
    2. Check certificate algorithm consistency.
    
    Check the AlgorithmIdentifier inside TBS matches the one in the
    certificate signature. NB: this will result in signature failure
    errors for some broken certificates.
    
    3. Check DSA/ECDSA signatures use DER.
    
    Reencode DSA/ECDSA signatures and compare with the original received
    signature. Return an error if there is a mismatch.
    
    This will reject various cases including garbage after signature
    (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
    program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
    (negative or with leading zeroes).
    
    CVE-2014-8275
    Reviewed-by: Emilia Käsper <emilia@openssl.org>
    
    (cherry picked from commit 208a6012be3077d83df4475f32dd1b1446f3a02e)
    
    Conflicts:
    	crypto/dsa/dsa_vrf.c

commit c22e2dd6e52899926d1f1ee3a2b5b9570d03130f
Author: Dr. Stephen Henson <steve@openssl.org>
Date:   Sun Dec 14 23:14:15 2014 +0000

    Add ASN1_TYPE_cmp and X509_ALGOR_cmp.
    
    (these are needed for certificate fingerprint fixes)
    Reviewed-by: Emilia Käsper <emilia@openssl.org>

Index: openssl-0.9.7g/crypto/asn1/a_verify.c
===================================================================
--- openssl-0.9.7g.orig/crypto/asn1/a_verify.c	2015-01-21 17:55:00.481167496 +0100
+++ openssl-0.9.7g/crypto/asn1/a_verify.c	2015-01-21 17:55:13.602296619 +0100
@@ -89,6 +89,12 @@ int ASN1_verify(int (*i2d)(), X509_ALGOR
 		ASN1err(ASN1_F_ASN1_VERIFY,ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
 		goto err;
 		}
+
+	if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)
+		{
+		ASN1err(ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
+		goto err;
+		}
 	
 	inl=i2d(data,NULL);
 	buf_in=OPENSSL_malloc((unsigned int)inl);
@@ -138,6 +144,12 @@ int ASN1_item_verify(const ASN1_ITEM *it
 		return -1;
 	}
 
+	if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)
+		{
+		ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
+		return -1;
+		}
+
 	EVP_MD_CTX_init(&ctx);
 	i=OBJ_obj2nid(a->algorithm);
 	type=EVP_get_digestbyname(OBJ_nid2sn(i));
Index: openssl-0.9.7g/crypto/x509/x_all.c
===================================================================
--- openssl-0.9.7g.orig/crypto/x509/x_all.c	2015-01-21 17:55:00.481167496 +0100
+++ openssl-0.9.7g/crypto/x509/x_all.c	2015-01-21 17:55:13.603296628 +0100
@@ -67,6 +67,8 @@
 
 int X509_verify(X509 *a, EVP_PKEY *r)
 	{
+	if (X509_ALGOR_cmp(a->sig_alg, a->cert_info->signature))
+		return 0;
 	return(ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF),a->sig_alg,
 		a->signature,a->cert_info,r));
 	}
Index: openssl-0.9.7g/crypto/asn1/a_bitstr.c
===================================================================
--- openssl-0.9.7g.orig/crypto/asn1/a_bitstr.c	2015-01-21 17:55:00.481167496 +0100
+++ openssl-0.9.7g/crypto/asn1/a_bitstr.c	2015-01-21 17:55:13.603296628 +0100
@@ -135,11 +135,16 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN
 
 	p= *pp;
 	i= *(p++);
+	if (i > 7)
+		{
+		i=ASN1_R_INVALID_BIT_STRING_BITS_LEFT;
+		goto err;
+		}
 	/* We do this to preserve the settings.  If we modify
 	 * the settings, via the _set_bit function, we will recalculate
 	 * on output */
 	ret->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); /* clear */
-	ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|(i&0x07)); /* set */
+	ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|i); /* set */
 
 	if (len-- > 1) /* using one because of the bits left byte */
 		{
Index: openssl-0.9.7g/crypto/asn1/asn1_err.c
===================================================================
--- openssl-0.9.7g.orig/crypto/asn1/asn1_err.c	2015-01-21 17:55:09.770258909 +0100
+++ openssl-0.9.7g/crypto/asn1/asn1_err.c	2015-01-21 18:04:28.519757715 +0100
@@ -92,6 +92,7 @@ static ERR_STRING_DATA ASN1_str_functs[]
 {ERR_PACK(0,ASN1_F_ASN1_INTEGER_TO_BN,0),	"ASN1_INTEGER_to_BN"},
 {ERR_PACK(0,ASN1_F_ASN1_ITEM_EX_D2I,0),	"ASN1_ITEM_EX_D2I"},
 {ERR_PACK(0,ASN1_F_ASN1_ITEM_NEW,0),	"ASN1_item_new"},
+{ERR_PACK(0,ASN1_F_ASN1_ITEM_VERIFY,0),	"ASN1_item_verify"},
 {ERR_PACK(0,ASN1_F_ASN1_MBSTRING_COPY,0),	"ASN1_mbstring_copy"},
 {ERR_PACK(0,ASN1_F_ASN1_OBJECT_NEW,0),	"ASN1_OBJECT_new"},
 {ERR_PACK(0,ASN1_F_ASN1_PACK_STRING,0),	"ASN1_pack_string"},
@@ -189,6 +190,7 @@ static ERR_STRING_DATA ASN1_str_reasons[
 {ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE ,"illegal options on item template"},
 {ASN1_R_ILLEGAL_TAGGED_ANY               ,"illegal tagged any"},
 {ASN1_R_INTEGER_TOO_LARGE_FOR_LONG       ,"integer too large for long"},
+{ASN1_R_INVALID_BIT_STRING_BITS_LEFT     ,"invalid bit string bits left"},
 {ASN1_R_INVALID_BMPSTRING_LENGTH         ,"invalid bmpstring length"},
 {ASN1_R_INVALID_DIGIT                    ,"invalid digit"},
 {ASN1_R_INVALID_OBJECT_ENCODING          ,"invalid object encoding"},
Index: openssl-0.9.7g/crypto/asn1/asn1.h
===================================================================
--- openssl-0.9.7g.orig/crypto/asn1/asn1.h	2015-01-21 17:55:09.770258909 +0100
+++ openssl-0.9.7g/crypto/asn1/asn1.h	2015-01-21 18:00:58.293688773 +0100
@@ -696,6 +696,7 @@ DECLARE_ASN1_FUNCTIONS_fname(ASN1_TYPE,
 
 int ASN1_TYPE_get(ASN1_TYPE *a);
 void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
+int            ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b);
 
 ASN1_OBJECT *	ASN1_OBJECT_new(void );
 void		ASN1_OBJECT_free(ASN1_OBJECT *a);
@@ -972,6 +973,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_F_ASN1_INTEGER_TO_BN			 119
 #define ASN1_F_ASN1_ITEM_EX_D2I				 120
 #define ASN1_F_ASN1_ITEM_NEW				 121
+#define ASN1_F_ASN1_ITEM_VERIFY				 197
 #define ASN1_F_ASN1_MBSTRING_COPY			 122
 #define ASN1_F_ASN1_OBJECT_NEW				 123
 #define ASN1_F_ASN1_PACK_STRING				 124
@@ -1066,6 +1068,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE		 170
 #define ASN1_R_ILLEGAL_TAGGED_ANY			 127
 #define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG		 128
+#define ASN1_R_INVALID_BIT_STRING_BITS_LEFT		 220
 #define ASN1_R_INVALID_BMPSTRING_LENGTH			 129
 #define ASN1_R_INVALID_DIGIT				 130
 #define ASN1_R_INVALID_OBJECT_ENCODING			 216
Index: openssl-0.9.7g/crypto/asn1/a_type.c
===================================================================
--- openssl-0.9.7g.orig/crypto/asn1/a_type.c	2015-01-21 17:55:00.481167496 +0100
+++ openssl-0.9.7g/crypto/asn1/a_type.c	2015-01-21 17:55:13.604296638 +0100
@@ -82,3 +82,49 @@ void ASN1_TYPE_set(ASN1_TYPE *a, int typ
 
 IMPLEMENT_STACK_OF(ASN1_TYPE)
 IMPLEMENT_ASN1_SET_OF(ASN1_TYPE)
+
+/* Returns 0 if they are equal, != 0 otherwise. */
+int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b)
+	{
+	int result = -1;
+
+	if (!a || !b || a->type != b->type) return -1;
+
+	switch (a->type)
+		{
+	case V_ASN1_OBJECT:
+		result = OBJ_cmp(a->value.object, b->value.object);
+		break;
+	case V_ASN1_NULL:
+		result = 0;	/* They do not have content. */
+		break;
+	case V_ASN1_INTEGER:
+	case V_ASN1_NEG_INTEGER:
+	case V_ASN1_ENUMERATED:
+	case V_ASN1_NEG_ENUMERATED:
+	case V_ASN1_BIT_STRING:
+	case V_ASN1_OCTET_STRING:
+	case V_ASN1_SEQUENCE:
+	case V_ASN1_SET:
+	case V_ASN1_NUMERICSTRING:
+	case V_ASN1_PRINTABLESTRING:
+	case V_ASN1_T61STRING:
+	case V_ASN1_VIDEOTEXSTRING:
+	case V_ASN1_IA5STRING:
+	case V_ASN1_UTCTIME:
+	case V_ASN1_GENERALIZEDTIME:
+	case V_ASN1_GRAPHICSTRING:
+	case V_ASN1_VISIBLESTRING:
+	case V_ASN1_GENERALSTRING:
+	case V_ASN1_UNIVERSALSTRING:
+	case V_ASN1_BMPSTRING:
+	case V_ASN1_UTF8STRING:
+	case V_ASN1_OTHER:
+	default:
+		result = ASN1_STRING_cmp((ASN1_STRING *) a->value.ptr,
+					 (ASN1_STRING *) b->value.ptr);
+		break;
+		}
+
+	return result;
+	}
Index: openssl-0.9.7g/crypto/asn1/x_algor.c
===================================================================
--- openssl-0.9.7g.orig/crypto/asn1/x_algor.c	2015-01-21 17:55:00.481167496 +0100
+++ openssl-0.9.7g/crypto/asn1/x_algor.c	2015-01-21 17:55:13.604296638 +0100
@@ -71,3 +71,14 @@ IMPLEMENT_ASN1_DUP_FUNCTION(X509_ALGOR)
 
 IMPLEMENT_STACK_OF(X509_ALGOR)
 IMPLEMENT_ASN1_SET_OF(X509_ALGOR)
+
+int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b)
+	{
+	int rv;
+	rv = OBJ_cmp(a->algorithm, b->algorithm);
+	if (rv)
+		return rv;
+	if (!a->parameter && !b->parameter)
+		return 0;
+	return ASN1_TYPE_cmp(a->parameter, b->parameter);
+	}
Index: openssl-0.9.7g/crypto/x509/x509.h
===================================================================
--- openssl-0.9.7g.orig/crypto/x509/x509.h	2015-01-21 17:55:00.481167496 +0100
+++ openssl-0.9.7g/crypto/x509/x509.h	2015-01-21 17:55:13.604296638 +0100
@@ -809,6 +809,7 @@ X509_EXTENSION *X509_EXTENSION_dup(X509_
 X509_CRL *X509_CRL_dup(X509_CRL *crl);
 X509_REQ *X509_REQ_dup(X509_REQ *req);
 X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn);
+int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b);
 X509_NAME *X509_NAME_dup(X509_NAME *xn);
 X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);
 
Index: openssl-0.9.7g/crypto/dsa/dsa_vrf.c
===================================================================
--- openssl-0.9.7g.orig/crypto/dsa/dsa_vrf.c	2015-01-21 17:55:00.481167496 +0100
+++ openssl-0.9.7g/crypto/dsa/dsa_vrf.c	2015-01-21 17:55:13.604296638 +0100
@@ -90,13 +90,25 @@ int DSA_verify(int type, const unsigned
 	     const unsigned char *sigbuf, int siglen, DSA *dsa)
 	{
 	DSA_SIG *s;
+	const unsigned char *p = sigbuf;
+	unsigned char *der = NULL;
+	int derlen = -1;
 	int ret=-1;
 
 	s = DSA_SIG_new();
 	if (s == NULL) return(ret);
-	if (d2i_DSA_SIG(&s,&sigbuf,siglen) == NULL) goto err;
+	if (d2i_DSA_SIG(&s,&p,siglen) == NULL) goto err;
+	/* Ensure signature uses DER and doesn't have trailing garbage */
+	derlen = i2d_DSA_SIG(s, &der);
+	if (derlen != siglen || memcmp(sigbuf, der, derlen))
+		goto err;
 	ret=DSA_do_verify(dgst,dgst_len,s,dsa);
 err:
+	if (derlen > 0)
+		{
+		OPENSSL_cleanse(der, derlen);
+		OPENSSL_free(der);
+		}
 	DSA_SIG_free(s);
 	return(ret);
 	}
