1. 05 5月, 2015 2 次提交
  2. 04 5月, 2015 5 次提交
  3. 03 5月, 2015 6 次提交
  4. 02 5月, 2015 12 次提交
  5. 01 5月, 2015 15 次提交
    • R
      free NULL cleanup 11 · efa7dd64
      Rich Salz 提交于
      Don't check for NULL before calling free functions. This gets:
              ERR_STATE_free
              ENGINE_free
              DSO_free
              CMAC_CTX_free
              COMP_CTX_free
              CONF_free
              NCONF_free NCONF_free_data _CONF_free_data
              A sk_free use within OBJ_sigid_free
              TS_TST_INFO_free (rest of TS_ API was okay)
              Doc update for UI_free (all uses were fine)
              X509V3_conf_free
              X509V3_section_free
              X509V3_string_free
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      efa7dd64
    • R
      free null cleanup finale · b548a1f1
      Rich Salz 提交于
      Don't check for NULL before calling OPENSSL_free
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      b548a1f1
    • R
      Fix some typo's, silence warnings. · 33fbca83
      Rich Salz 提交于
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      33fbca83
    • R
      Rewrite CA.pl.in · 5a3aa852
      Rich Salz 提交于
      Reformat CA.pl.in to follow coding style.
      Also add "use strict" and "use warnings"
      Also modify it to exit properly and report only when succeeded.
      And some perl tweaks via Richard.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      5a3aa852
    • R
      free NULL cleanup 7 · 23a1d5e9
      Rich Salz 提交于
      This gets BN_.*free:
          BN_BLINDING_free BN_CTX_free BN_FLG_FREE BN_GENCB_free
          BN_MONT_CTX_free BN_RECP_CTX_free BN_clear_free BN_free BUF_MEM_free
      
      Also fix a call to DSA_SIG_free to ccgost engine and remove some #ifdef'd
      dead code in engines/e_ubsec.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      23a1d5e9
    • M
      Fix buffer overrun in RSA signing · 34166d41
      Matt Caswell 提交于
      The problem occurs in EVP_PKEY_sign() when using RSA with X931 padding.
      It is only triggered if the RSA key size is smaller than the digest length.
      So with SHA512 you can trigger the overflow with anything less than an RSA
      512 bit key. I managed to trigger a 62 byte overflow when using a 16 bit RSA
      key. This wasn't sufficient to cause a crash, although your mileage may
      vary.
      
      In practice RSA keys of this length are never used and X931 padding is very
      rare. Even if someone did use an excessively short RSA key, the chances of
      them combining that with a longer digest and X931 padding is very
      small. For these reasons I do not believe there is a security implication to
      this. Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3
      Solutions) for reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      34166d41
    • M
      Add sanity check to print_bin function · 3deeeeb6
      Matt Caswell 提交于
      Add a sanity check to the print_bin function to ensure that the |off|
      argument is positive. Thanks to Kevin Wojtysiak (Int3 Solutions) and
      Paramjot Oberoi (Int3 Solutions) for reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      3deeeeb6
    • M
      Add sanity check to ssl_get_prev_session · cb0f400b
      Matt Caswell 提交于
      Sanity check the |len| parameter to ensure it is positive. Thanks to Kevin
      Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3 Solutions) for
      reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      cb0f400b
    • M
      Sanity check the return from final_finish_mac · c427570e
      Matt Caswell 提交于
      The return value is checked for 0. This is currently safe but we should
      really check for <= 0 since -1 is frequently used for error conditions.
      Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3
      Solutions) for reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      c427570e
    • M
      Add sanity check in ssl3_cbc_digest_record · 29b0a15a
      Matt Caswell 提交于
      For SSLv3 the code assumes that |header_length| > |md_block_size|. Whilst
      this is true for all SSLv3 ciphersuites, this fact is far from obvious by
      looking at the code. If this were not the case then an integer overflow
      would occur, leading to a subsequent buffer overflow. Therefore I have
      added an explicit sanity check to ensure header_length is always valid.
      Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3
      Solutions) for reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      29b0a15a
    • M
      Clarify logic in BIO_*printf functions · 9d9e3774
      Matt Caswell 提交于
      The static function dynamically allocates an output buffer if the output
      grows larger than the static buffer that is normally used. The original
      logic implied that |currlen| could be greater than |maxlen| which is
      incorrect (and if so would cause a buffer overrun). Also the original
      logic would call OPENSSL_malloc to create a dynamic buffer equal to the
      size of the static buffer, and then immediately call OPENSSL_realloc to
      make it bigger, rather than just creating a buffer than was big enough in
      the first place. Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot
      Oberoi (Int3 Solutions) for reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      9d9e3774
    • M
      Sanity check EVP_EncodeUpdate buffer len · b86d7dca
      Matt Caswell 提交于
      There was already a sanity check to ensure the passed buffer length is not
      zero. Extend this to ensure that it also not negative. Thanks to Kevin
      Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3 Solutions) for
      reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      b86d7dca
    • M
      Sanity check EVP_CTRL_AEAD_TLS_AAD · c8269881
      Matt Caswell 提交于
      The various implementations of EVP_CTRL_AEAD_TLS_AAD expect a buffer of at
      least 13 bytes long. Add sanity checks to ensure that the length is at
      least that. Also add a new constant (EVP_AEAD_TLS1_AAD_LEN) to evp.h to
      represent this length. Thanks to Kevin Wojtysiak (Int3 Solutions) and
      Paramjot Oberoi (Int3 Solutions) for reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      c8269881
    • M
      Sanity check DES_enc_write buffer length · 873fb39f
      Matt Caswell 提交于
      Add a sanity check to DES_enc_write to ensure the buffer length provided
      is not negative. Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot
      Oberoi (Int3 Solutions) for reporting this issue.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      873fb39f
    • R
      free cleanup 12 · 895cba19
      Rich Salz 提交于
      Don't check for NULL before calling free function.  This gets:
              NAME_CONSTRAINTS_free GENERAL_SUBTREE_free ECDSA_METHOD_free
              JPAKE_CTX_free OCSP_REQ_CTX_free SCT_free SRP_VBASE_free
              SRP_gN_free SRP_user_pwd_free TXT_DB_free
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      895cba19