diff options
| author | Bernd Edlinger <bernd.edlinger@hotmail.de> | 2019-07-22 22:50:19 +0200 |
|---|---|---|
| committer | Bernd Edlinger <bernd.edlinger@hotmail.de> | 2019-07-24 14:44:08 +0200 |
| commit | 6de1fe90860ddfe768864838637f681537f3f108 (patch) | |
| tree | eb7dc66acc7eef6124922ad47edfdd168bd1eb19 /crypto/dh/dh_gen.c | |
| parent | 8b84b075ff065554c0cdd1086950f1a8614d93a4 (diff) | |
| download | openssl-new-6de1fe90860ddfe768864838637f681537f3f108.tar.gz | |
Enforce a minimum DH modulus size of 512 bits
[extended tests]
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9437)
Diffstat (limited to 'crypto/dh/dh_gen.c')
| -rw-r--r-- | crypto/dh/dh_gen.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/crypto/dh/dh_gen.c b/crypto/dh/dh_gen.c index 6e98b59d85..76d6ad018e 100644 --- a/crypto/dh/dh_gen.c +++ b/crypto/dh/dh_gen.c @@ -61,6 +61,16 @@ static int dh_builtin_genparams(DH *ret, int prime_len, int generator, int g, ok = -1; BN_CTX *ctx = NULL; + if (prime_len > OPENSSL_DH_MAX_MODULUS_BITS) { + DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_MODULUS_TOO_LARGE); + return 0; + } + + if (prime_len < DH_MIN_MODULUS_BITS) { + DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_MODULUS_TOO_SMALL); + return 0; + } + ctx = BN_CTX_new(); if (ctx == NULL) goto err; |