- 11 6月, 2015 1 次提交
-
-
由 Emilia Kasper 提交于
Also tighten X509_cmp_time to reject more than three fractional seconds in the time; and to reject trailing garbage after the offset. CVE-2015-1789 Reviewed-by: NViktor Dukhovni <viktor@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 14 5月, 2015 1 次提交
-
-
由 Richard Levitte 提交于
There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 06 5月, 2015 2 次提交
-
-
由 Gunnar Kudrjavets 提交于
Compiling OpenSSL code with MSVC and /W4 results in a number of warnings. One category of warnings is particularly interesting - C4701 (potentially uninitialized local variable 'name' used). This warning pretty much means that there's a code path which results in uninitialized variables being used or returned. Depending on compiler, its options, OS, values in registers and/or stack, the results can be nondeterministic. Cases like this are very hard to debug so it's rational to fix these issues. This patch contains a set of trivial fixes for all the C4701 warnings (just initializing variables to 0 or NULL or appropriate error code) to make sure that deterministic values will be returned from all the execution paths. RT#3835 Signed-off-by: NMatt Caswell <matt@openssl.org> Matt's note: All of these appear to be bogus warnings, i.e. there isn't actually a code path where an unitialised variable could be used - its just that the compiler hasn't been able to figure that out from the logic. So this commit is just about silencing spurious warnings. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rich Salz 提交于
Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 05 5月, 2015 1 次提交
-
-
由 Rich Salz 提交于
For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 02 5月, 2015 2 次提交
-
-
由 Rich Salz 提交于
After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Rich Salz 提交于
There were a dozen-plus instances of this construct: if (0) { label: ..... } Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 01 5月, 2015 1 次提交
-
-
由 Rich Salz 提交于
Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 29 4月, 2015 1 次提交
-
-
由 Rich Salz 提交于
Following ANSI C rules, remove the casts from calls to OPENSSL_malloc and OPENSSL_realloc. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 28 3月, 2015 1 次提交
-
-
由 Rich Salz 提交于
EVP_.*free; this gets: EVP_CIPHER_CTX_free EVP_PKEY_CTX_free EVP_PKEY_asn1_free EVP_PKEY_asn1_set_free EVP_PKEY_free EVP_PKEY_free_it EVP_PKEY_meth_free; and also EVP_CIPHER_CTX_cleanup Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
- 25 3月, 2015 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Disable loop checking when we retry verification with an alternative path. This fixes the case where an intermediate CA is explicitly trusted and part of the untrusted certificate list. By disabling loop checking for this case the untrusted CA can be replaced by the explicitly trusted case and verification will succeed. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
- 25 2月, 2015 2 次提交
-
-
由 Matt Caswell 提交于
behaviour will force behaviour as per previous versions of OpenSSL Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
由 Matt Caswell 提交于
valid. However the issuer of the leaf, or some intermediate cert is in fact in the trust store. When building a trust chain if the first attempt fails, then try to see if alternate chains could be constructed that are trusted. RT3637 RT3621 Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
- 09 2月, 2015 2 次提交
-
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NAndy Polyakov <appro@openssl.org>
-
由 Rich Salz 提交于
This is a final pass looking for '#if 0'/'#if 1' controls and removing the appropriate pieces. Reviewed-by: NAndy Polyakov <appro@openssl.org>
-
- 06 2月, 2015 1 次提交
-
-
由 Rich Salz 提交于
The mkstack.pl script now generates the entire safestack.h file. It generates output that follows the coding style. Also, removed all instances of the obsolete IMPLEMENT_STACK_OF macro. Reviewed-by: NAndy Polyakov <appro@openssl.org>
-
- 27 1月, 2015 2 次提交
-
-
由 Rich Salz 提交于
Remove OPENSSL_NO_RFCF3779. Also, makevms.com was ignored by some of the other cleanups, so I caught it up. Sorry I ignored you, poor little VMS... Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Rich Salz 提交于
The following compile options (#ifdef's) are removed: OPENSSL_NO_BIO OPENSSL_NO_BUFFER OPENSSL_NO_CHAIN_VERIFY OPENSSL_NO_EVP OPENSSL_NO_FIPS_ERR OPENSSL_NO_HASH_COMP OPENSSL_NO_LHASH OPENSSL_NO_OBJECT OPENSSL_NO_SPEED OPENSSL_NO_STACK OPENSSL_NO_X509 OPENSSL_NO_X509_VERIFY This diff is big because of updating the indents on preprocessor lines. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 22 1月, 2015 3 次提交
-
-
由 Matt Caswell 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 06 1月, 2015 1 次提交
-
-
由 Matt Caswell 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 09 9月, 2014 1 次提交
-
-
由 Paul Suhler 提交于
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
- 16 8月, 2014 1 次提交
-
-
由 Rich Salz 提交于
Add a declaration for get_issuer_sk() so that other functions in x509_vf.c could use it. (Planned work around cross-certification chains.) Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
- 07 7月, 2014 1 次提交
-
-
由 Viktor Dukhovni 提交于
Reduces number of silly casts in OpenSSL code and likely most applications. Consistent with (char *) for "peername" value from X509_check_host() and X509_VERIFY_PARAM_get0_peername().
-
- 05 7月, 2014 1 次提交
-
-
由 Viktor Dukhovni 提交于
Pass address of X509_VERIFY_PARAM_ID peername to X509_check_host(). Document modified interface.
-
- 23 6月, 2014 5 次提交
-
-
由 Viktor Dukhovni 提交于
-
由 Viktor Dukhovni 提交于
-
由 Viktor Dukhovni 提交于
Implemented as STACK_OF(OPENSSL_STRING).
-
由 Viktor Dukhovni 提交于
-
由 Viktor Dukhovni 提交于
Just store NUL-terminated strings. This works better when we add support for multiple hostnames.
-
- 25 5月, 2014 2 次提交
-
-
由 Dr. Stephen Henson 提交于
When looking for the issuer of a certificate, if current candidate is expired, continue looking. Only return an expired certificate if no valid certificates are found. PR#3359
-
由 Dr. Stephen Henson 提交于
-
- 21 5月, 2014 1 次提交
-
-
由 Viktor Dukhovni 提交于
Fixes to host checking wild card support and add support for setting host checking flags when verifying a certificate chain.
-
- 04 3月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
(cherry picked from commit bdfc0e284c89dd5781259cc19aa264aded538492)
-
- 14 2月, 2014 2 次提交
-
-
由 Dr. Stephen Henson 提交于
When a chain is complete and ends in a trusted root checks are also performed on the TA and the callback notified with ok==1. For consistency do the same for chains where the TA is not self signed.
-
由 Dr. Stephen Henson 提交于
-
- 10 1月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 13 12月, 2013 2 次提交
-
-
由 Dr. Stephen Henson 提交于
Move the IP, email and host checking fields from the public X509_VERIFY_PARAM structure into an opaque X509_VERIFY_PARAM_ID structure. By doing this the structure can be modified in future without risk of breaking any applications. (cherry picked from commit adc6bd73e3bd10ce6e76867482e8d137071298d7) Conflicts: crypto/x509/x509_vpm.c
-
由 Dr. Stephen Henson 提交于
For consistency with other cases if we are performing partial chain verification with just one certificate notify the callback with ok==1. (cherry picked from commit 852553d9005e13aed7feb986a5d71cb885b994c7)
-