Merge lp:~randomaction/ubuntu/lucid/strongswan/merge-4.3.2-1.1 into lp:ubuntu/lucid/strongswan

[Ilya Barygin]

=== modified file 'debian/changelog'
--- debian/changelog	2009-10-23 15:02:23 +0000
+++ debian/changelog	2009-12-04 18:10:26 +0000
@@ -1,3 +1,21 @@
+strongswan (4.3.2-1.1ubuntu1) lucid; urgency=low
+
+  * Merge from Debian testing (LP: #492396), remaining changes:
+    - Build depend on libnm-glib-dev instead of libnm-glib-vpn-dev to 
+      match the network manager package naming in Ubuntu
+
+ -- Ilya Barygin <[e-mail]>  Fri, 04 Dec 2009 20:59:13 +0300
+
+strongswan (4.3.2-1.1) unstable; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Fix incomplete fix for CVE-2009-2185 leading to a denial of service
+    via malformed ASN.1 data (CVE-2009-2661; Closes: #540144).
+  * Use dh_prep instead of dh_clean in install target
+    + Fixes bug where the arch: all package is not included in .changes
+
+ -- Raphael Geissert <[e-mail]>  Tue, 08 Sep 2009 18:37:35 -0500
+
 strongswan (4.3.2-1ubuntu3) karmic; urgency=low
 
   * No change rebuild against libnm-glib

=== modified file 'debian/rules'
--- debian/rules	2009-06-21 17:50:02 +0000
+++ debian/rules	2009-12-04 18:10:26 +0000
@@ -85,7 +85,7 @@
 install: build-stamp
 	dh_testdir
 	dh_testroot
-	dh_clean
+	dh_prep
 	dh_installdirs
 	$(MAKE) install DESTDIR=$(CURDIR)/debian/tmp
 

=== modified file 'src/libstrongswan/asn1/asn1.c'
--- src/libstrongswan/asn1/asn1.c	2009-04-18 20:28:51 +0000
+++ src/libstrongswan/asn1/asn1.c	2009-12-04 18:10:26 +0000
@@ -260,25 +260,32 @@
 	u_char n;
 	size_t len;
 	
-	/* advance from tag field on to length field */
-	blob->ptr++;
-	blob->len--;
+	if (blob->len < 2)
+	{
+		DBG2("insufficient number of octets to parse ASN.1 length");
+		return ASN1_INVALID_LENGTH;
+	}
 	
-	/* read first octet of length field */
-	n = *blob->ptr++;
-	blob->len--;
+	/* read length field, skip tag and length */
+	n = blob->ptr[1];
+	*blob = chunk_skip(*blob, 2);
 	
 	if ((n & 0x80) == 0) 
-	{/* single length octet */
+	{	/* single length octet */
+		if (n > blob->len)
+		{
+			DBG2("length is larger than remaining blob size");
+			return ASN1_INVALID_LENGTH;
+		}
 		return n;
 	}
 	
 	/* composite length, determine number of length octets */
 	n &= 0x7f;
 	
-	if (n > blob->len)
+	if (n == 0 || n > blob->len)
 	{
-		DBG2("number of length octets is larger than ASN.1 object");
+		DBG2("number of length octets invalid");
 		return ASN1_INVALID_LENGTH;
 	}