According to X6.90 null, object identifier, boolean, integer and enumerated
types can only have primitive encodings: return an error if any of
these are received with a constructed encoding.
Reviewed-by: NEmilia Käsper <emilia@openssl.org>

I also replaced some exit/return wrappers in various
programs (from main) to standardize on return.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

i2d_re_X509_tbs re-encodes the TBS portion of the certificate.
Reviewed-by: NRich Salz <rsalz@openssl.org>
Reviewed-by: NDr Stephen Henson <steve@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

Make X509_REQ_print_ex do the same thing that
X509_REQ_print does.
Reviewed-by: NMatt Caswell <matt@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

Add a dozen more const declarations where appropriate.
These are from Justin; while adding his patch, I noticed
ASN1_BIT_STRING_check could be fixed, too.
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>

Signed-off-by: NKurt Roeckx <kurt@openssl.org>
Reviewed-by: NRich Salz <rsalz@openssl.org>

mime_hdr_addparam: free tmpname, tmpval and mparam on error path, and check whether sk_MIME_PARAM_push succeeds
Signed-off-by: NKurt Roeckx <kurt@openssl.org>
Reviewed-by: NRich Salz <rsalz@openssl.org>

Signed-off-by: NKurt Roeckx <kurt@openssl.org>
Reviewed-by: NRich Salz <rsalz@openssl.org>

Signed-off-by: NKurt Roeckx <kurt@openssl.org>
Reviewed-by: NRich Salz <rsalz@openssl.org>

Signed-off-by: NKurt Roeckx <kurt@openssl.org>
Reviewed-by: NRich Salz <rsalz@openssl.org>

Remove local variable and avoid extra assignment.
Reviewed-by: NEmilia Kasper <emilia@silkandcyanide.net>

Remove some redundant logical expressions
Reviewed-by: NEmilia Kasper <emilia@silkandcyanide.net>

Fully remove old error, per drH
Reviewed-by: rsalz

Reviewed-by: Emilia Kasper

Many of these were already fixed, this catches the last
few that were missed.

Many of these were already fixed, this catches the last
few that were missed.

- Upon parsing, reject OIDs with invalid base-128 encoding.
- Always NUL-terminate the destination buffer in OBJ_obj2txt printing function.

CVE-2014-3508
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
Reviewed-by: NKurt Roeckx <kurt@openssl.org>
Reviewed-by: NTim Hudson <tjh@openssl.org>

Primitive encodings shouldn't use indefinite length constructed
form.

PR#2438 (partial).

Tolerate BER length encoding which may include leading zeroes.

PR#2746

PR#3014

PR#3403

Add additional check to catch this in ASN1_item_verify too.
(cherry picked from commit 66e8211c0b1347970096e04b18aa52567c325200)

Add functions to return the "bits of security" for various public key
algorithms. Based on SP800-57.

If the oid parameter is set to NULL in X509_add1_trust_object
create an empty list of trusted purposes corresponding to
"no purpose" if trust is checked.

Add X9.42 DH KDF. Move sharedinfo generation code to CMS library as the
same structure is used by DH and ECDH.

Move ASN1_OBJECT typedef to ossl_typ.h so it can be picked up by dh headers
without the need to use ASN1.

If an ASN1_INTEGER structure is allocated but not explicitly set encode
it as zero: don't generate an invalid zero length INTEGER.
(cherry picked from commit 1643edc63c3e15b6db5a15a728bc288f2cc2bbc7)