NSS: reject DH groups smaller than 1024 bits.

net/third_party/nss/ssl/ssl3con.c

 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* TODO(ekr): Implement HelloVerifyRequest on server side. OK for now. */
 
@@ skipping 6928 matching lines @@
 
     case kt_dh: {
         SECItem          dh_p      = {siBuffer, NULL, 0};
         SECItem          dh_g      = {siBuffer, NULL, 0};
         SECItem          dh_Ys     = {siBuffer, NULL, 0};
 
         rv = ssl3_ConsumeHandshakeVariable(ss, &dh_p, 2, &b, &length);
         if (rv != SECSuccess) {
             goto loser;         /* malformed. */
         }
-        if (dh_p.len < 512/8) {
+        if (dh_p.len < 1024/8 ||
+            (dh_p.len == 1024/8 && (dh_p.data[0] & 0x80) == 0)) {
             errCode = SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY;
             goto alert_loser;
         }
         rv = ssl3_ConsumeHandshakeVariable(ss, &dh_g, 2, &b, &length);
         if (rv != SECSuccess) {
             goto loser;         /* malformed. */
         }
         if (dh_g.len > dh_p.len || !ssl3_BigIntGreaterThanOne(&dh_g))
             goto alert_loser;
         rv = ssl3_ConsumeHandshakeVariable(ss, &dh_Ys, 2, &b, &length);
@@ skipping 5928 matching lines @@
             PORT_Free(ss->ssl3.hs.recvdFragments.buf);
         }
     }
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */