Fix CVE-2019-17596

Cherry-picked from upstream:
https://github.com/golang/go/commit/2017d88dbc096381d4f348d2fb08bfb3c2b7ed73

Gbp-Pq: Name 0008-Fix-CVE-2019-17596.patch

diff --git a/src/crypto/dsa/dsa.go b/src/crypto/dsa/dsa.go
index 575314b1b468908c3bb197ac656e368cb1f5e701..2fc4f1f05bfb09483e60882ff79bb5fd738f7c21 100644 (file)
--- a/src/crypto/dsa/dsa.go
+++ b/src/crypto/dsa/dsa.go
@@ -279,6 +279,9 @@ func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool {
        }
 
        w := new(big.Int).ModInverse(s, pub.Q)
+       if w == nil {
+               return false
+       }
 
        n := pub.Q.BitLen()
        if n&7 != 0 {