This macro was defined by no-longer-supported __MWERKS__ compiler.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Usage of $ymm variable is a bit misleading here, it doesn't refer
to %ymm register bank, but rather to VEX instruction encoding,
which AMD XOP code path depends on.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Reviewed-by: Rich Salz <rsalz@openssl.org>

Reviewed-by: Rich Salz <rsalz@openssl.org>

Some X509_STORE macros do not work since the type was made opaque.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>

Sanity check field lengths and sums to avoid potential overflows and reject
excessively large X509_NAME structures.

Issue reported by Guido Vranken.

Reviewed-by: Matt Caswell <matt@openssl.org>

Reject zero length buffers passed to X509_NAME_onelne().

Issue reported by Guido Vranken.

Reviewed-by: Matt Caswell <matt@openssl.org>

This adds an explicit limit to the size of an X509_NAME structure. Some
part of OpenSSL (e.g. TLS) already effectively limit the size due to
restrictions on certificate size.

Reviewed-by: Matt Caswell <matt@openssl.org>

EC_GROUP_check() was obtaining a temporary BIGNUM from the BN_CTX, but
then not using it.

Reviewed-by: Rich Salz <rsalz@openssl.org>

We should only copy parameters and keys if the group is set. Otherwise
they don't really make any sense. Previously we copied the private key
regardless of whether the group was set...but if it wasn't a NULL ptr
deref could occur. It's unclear whether we could ever get into that
situation, but since we were already checking it for the public key we
should be consistent.

Reviewed-by: Rich Salz <rsalz@openssl.org>

BIO_ADDR_new() calls OPENSSL_zalloc() which can fail - but the return
value is not checked.

Reviewed-by: Rich Salz <rsalz@openssl.org>

i2d_name_canon can return a negative number on error. We should check it
before continuing.

Reviewed-by: Rich Salz <rsalz@openssl.org>

The length is a long, so returning the difference does not quite work.

Thanks to Torbjörn Granlund for noticing.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

The non-ascii version of this set of macros ensures that the "a" variable
is inside the expected range. This logic wasn't quite right for the
EBCDIC version.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Reviewed-by: Andy Polyakov <appro@openssl.org>

This adds the define CHARSET_EBCDIC_TEST which enables testing of EBCDIC
code on an ASCII system.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Building with -DCHARSET_EBCDIC and using --strict-warnings resulted in
lots of miscellaneous errors. This fixes it.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Currently we can get all block ciphers with
	EVP_get_cipherbyname("<alg_name>-<block-mode-name>")
for example, by names "aes-128-ecb" or "des-ede-cbc".
I found a problem with des-ede-ecb and des-ede3-ecb ciphers as
they can be accessed only with names:
	EVP_get_cipherbyname("des-ede")
	EVP_get_cipherbyname("des-ede3")
It breaks the general concept.

In this patch I add aliases which allow to use names:
	EVP_get_cipherbyname("des-ede-ecb")
	EVP_get_cipherbyname("des-ede3-ecb")
in addition to the currently used names.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT#4508

Reviewed-by: Richard Levitte <levitte@openssl.org>

Commit e1d9f1ab

 left some dead code behind. This removes it.

Reviewed-by: Stephen Henson <steve@openssl.org>

Reviewed-by: Richard Levitte <levitte@openssl.org>

Commit 91fb42dd

 fixed a leak but introduced a problem where a parameter
is erroneously freed instead.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Commit 8e588e28

 fixed a leak but introduced a new one.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1007)

with some adaptation to new multi-threading API.

Once reference, lock, meth and flag fields are setup,
DSA_free/DH_free can be called directly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/996)

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/996)

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/952)

OpenSSL 1.1.0-pre5 has made some additional structs opaque. Python's ssl
module requires access to some of the struct members. Three new getters
are added:

int X509_OBJECT_get_type(X509_OBJECT *a);
STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *v);
X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx);

Signed-off-by: Christian Heimes <cheimes@redhat.com>

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Reviewed-by: Rich Salz <rsalz@openssl.org>

The code that implements this control would work when enabling nbio,
but the disabling code needed fixing.

Reviewed-by: Matt Caswell <matt@openssl.org>

The r2i_certpol() function allocates an ASN1_OBJECT but can fail to free
it in an error path.

Reviewed-by: Richard Levitte <levitte@openssl.org>

The rsa_cms_encrypt() function allocates an ASN1_OCTET_STRING but can
then fail to free it in an error condition.

Reviewed-by: Richard Levitte <levitte@openssl.org>

The PKCS7_dataFinal() function allocates a memory buffer but then fails
to free it on an error condition.

Reviewed-by: Richard Levitte <levitte@openssl.org>

The PKCS12_key_gen_uni() had one error path which did not free memory
correctly.

Reviewed-by: Richard Levitte <levitte@openssl.org>

The i2b_PVK function leaked a number of different memory allocations on
error paths (and even some non-error paths).

Reviewed-by: Richard Levitte <levitte@openssl.org>

The b2i_rsa() function uses a number of temporary local variables which
get leaked on an error path.

Reviewed-by: Richard Levitte <levitte@openssl.org>

On error we could leak a ACCESS_DESCRIPTION and an ASN1_IA5STRING. Both
should be freed in the error path.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Calls to BN_CTX_get() can fail so we should check that they were
successful.

Reviewed-by: Richard Levitte <levitte@openssl.org>