Upgrade chrome's OpenSSL to same version Android ships with.

openssl/crypto/jpake/jpake.c

 #include "jpake.h"
 
 #include <openssl/crypto.h>
 #include <openssl/sha.h>
 #include <openssl/err.h>
 #include <memory.h>
-#include <assert.h>
 
 /*
  * In the definition, (xa, xb, xc, xd) are Alice's (x1, x2, x3, x4) or
  * Bob's (x3, x4, x1, x2). If you see what I mean.
  */
 
 typedef struct
     {
     char *name;  /* Must be unique */
     char *peer_name;
@@ skipping 109 matching lines @@
 void JPAKE_CTX_free(JPAKE_CTX *ctx)
     {
     JPAKE_CTX_release(ctx);
     OPENSSL_free(ctx);
     }
 
 static void hashlength(SHA_CTX *sha, size_t l)
     {
     unsigned char b[2];
 
-    assert(l <= 0xffff);
+    OPENSSL_assert(l <= 0xffff);
     b[0] = l >> 8;
     b[1] = l&0xff;
     SHA1_Update(sha, b, 2);
     }
 
 static void hashstring(SHA_CTX *sha, const char *string)
     {
     size_t l = strlen(string);
 
     hashlength(sha, l);
@@ skipping 17 matching lines @@
     {
     unsigned char md[SHA_DIGEST_LENGTH];
     SHA_CTX sha;
 
    /*
     * XXX: hash should not allow moving of the boundaries - Java code
     * is flawed in this respect. Length encoding seems simplest.
     */
     SHA1_Init(&sha);
     hashbn(&sha, zkpg);
-    assert(!BN_is_zero(p->zkpx.gr));
+    OPENSSL_assert(!BN_is_zero(p->zkpx.gr));
     hashbn(&sha, p->zkpx.gr);
     hashbn(&sha, p->gx);
     hashstring(&sha, proof_name);
     SHA1_Final(md, &sha);
     BN_bin2bn(md, SHA_DIGEST_LENGTH, h);
     }
 
 /*
  * Prove knowledge of x
  * Note that p->gx has already been calculated
@@ skipping 90 matching lines @@
 
 int JPAKE_STEP1_generate(JPAKE_STEP1 *send, JPAKE_CTX *ctx)
     {
     genrand(ctx);
     generate_step_part(&send->p1, ctx->xa, ctx->p.g, ctx);
     generate_step_part(&send->p2, ctx->xb, ctx->p.g, ctx);
 
     return 1;
     }
 
+/* g^x is a legal value */
+static int is_legal(const BIGNUM *gx, const JPAKE_CTX *ctx)
+    {
+    BIGNUM *t;
+    int res;
+    
+    if(BN_is_negative(gx) || BN_is_zero(gx) || BN_cmp(gx, ctx->p.p) >= 0)
+        return 0;
+
+    t = BN_new();
+    BN_mod_exp(t, gx, ctx->p.q, ctx->p.p, ctx->ctx);
+    res = BN_is_one(t);
+    BN_free(t);
+
+    return res;
+    }
+
 int JPAKE_STEP1_process(JPAKE_CTX *ctx, const JPAKE_STEP1 *received)
     {
+    if(!is_legal(received->p1.gx, ctx))
+        {
+        JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, JPAKE_R_G_TO_THE_X3_IS_NOT_LEGAL);
+        return 0;
+        }
+
+    if(!is_legal(received->p2.gx, ctx))
+        {
+        JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, JPAKE_R_G_TO_THE_X4_IS_NOT_LEGAL);
+        return 0;
+        }
+
    /* verify their ZKP(xc) */
     if(!verify_zkp(&received->p1, ctx->p.g, ctx))
         {
         JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, JPAKE_R_VERIFY_X3_FAILED);
         return 0;
         }
 
    /* verify their ZKP(xd) */
     if(!verify_zkp(&received->p2, ctx->p.g, ctx))
         {
@@ skipping 176 matching lines @@
     }
 
 void JPAKE_STEP3B_release(JPAKE_STEP3B *s3b)
     {}
 
 const BIGNUM *JPAKE_get_shared_key(JPAKE_CTX *ctx)
     {
     return ctx->key;
     }