[gnutls-dev] gnutls-0.3.2 bugs

[Marc Huber]

Trying to follow the instructions in src/README.srpcrypt I found that

- _gnutls_sbase64_encode() doesn't NUL-terminate strings smaller than
  4 byte, and probably does the wrong thing for longer strings (I
  haven't done any in-depth auditing on this, so I might be wrong.)

- _gnutls_get_random() tries to gnutls_free() a gcry_malloc()ed pointer

- crypt_int() tries to free() a gnutls_malloc()ed pointer

- read_conf_values(): _gnutls_sbase64_decode() doesn't allocate memory
  on failure, so gnutls_free() shouldn't be called.

Cheers,

Marc


diff -cr gnutls-0.3.2.original/lib/auth_srp_sb64.c gnutls-0.3.2/lib/auth_srp_sb64.c
*** gnutls-0.3.2.original/lib/auth_srp_sb64.c	Tue Jul 31 03:16:01 2001
--- gnutls-0.3.2/lib/auth_srp_sb64.c	Tue Jan 15 23:15:25 2002
***************
*** 144,150 ****
  
  	ret += (data_size * 4) / 3;
  
! 	(*result) = gnutls_malloc( ret + 1);
  	if ((*result) == NULL)
  		return -1;
  
--- 144,150 ----
  
  	ret += (data_size * 4) / 3;
  
! 	(*result) = gnutls_calloc(1, ret + 1);
  	if ((*result) == NULL)
  		return -1;
  
***************
*** 171,177 ****
  			return tmp;
  		}
  		memcpy(&(*result)[j], tmpres, tmp);
- 		(*result)[j+tmp] = 0;
  	}
  
  	return strlen(*result);
--- 171,176 ----
diff -cr gnutls-0.3.2.original/lib/gnutls_random.c gnutls-0.3.2/lib/gnutls_random.c
*** gnutls-0.3.2.original/lib/gnutls_random.c	Sun Dec 23 14:18:39 2001
--- gnutls-0.3.2/lib/gnutls_random.c	Tue Jan 15 23:03:33 2002
***************
*** 75,81 ****
      }
  
      memcpy( res, buf, bytes);
!     gnutls_free(buf);
      
      return 0;
  #endif
--- 75,81 ----
      }
  
      memcpy( res, buf, bytes);
!     gcry_free(buf);
      
      return 0;
  #endif
diff -cr gnutls-0.3.2.original/src/crypt.c gnutls-0.3.2/src/crypt.c
*** gnutls-0.3.2.original/src/crypt.c	Sun Dec 23 14:19:00 2001
--- gnutls-0.3.2/src/crypt.c	Wed Jan 16 00:17:17 2002
***************
*** 380,386 ****
  		if (put==0) {
  			fprintf(fd, "%s:%s:%u\n", username, cr, iindex);
  		}
! 		free(cr);
  		
  		fclose(fd);
  		fclose(fd2);
--- 380,386 ----
  		if (put==0) {
  			fprintf(fd, "%s:%s:%u\n", username, cr, iindex);
  		}
! 		gnutls_free(cr);
  		
  		fclose(fd);
  		fclose(fd2);
***************
*** 422,428 ****
  	tmp_size = _gnutls_sbase64_decode(p, len, &tmp);
  
  	if (tmp_size < 0) {
- 		gnutls_free(tmp);
  		return -1;
  	}
  	if (gcry_mpi_scan(g, GCRYMPI_FMT_USG, tmp, &tmp_size)) {
--- 422,427 ----