NSS: reject DH groups smaller than 1024 bits.

net/third_party/nss/patches/dh1024.patch

Index: net/third_party/nss/patches/dh1024.patch
diff --git a/net/third_party/nss/patches/dh1024.patch b/net/third_party/nss/patches/dh1024.patch
new file mode 100644
index 0000000000000000000000000000000000000000..99fbcc794fc06d8da31d2d3254a688574575687f
--- /dev/null
+++ b/net/third_party/nss/patches/dh1024.patch
@@ -0,0 +1,14 @@
+diff --git a/ssl/ssl3con.c b/ssl/ssl3con.c
+index 89c98ea..861d434 100644
+--- a/ssl/ssl3con.c
++++ b/ssl/ssl3con.c
+@@ -6946,7 +6946,8 @@ ssl3_HandleServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+     	if (rv != SECSuccess) {
+ 	    goto loser;		/* malformed. */
+ 	}
+-	if (dh_p.len < 512/8) {
++	if (dh_p.len < 1024/8 ||
++	    (dh_p.len == 1024/8 && (dh_p.data[0] & 0x80) == 0)) {
+ 	    errCode = SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY;
+ 	    goto alert_loser;
+ 	}