Commit 82b6b541 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Fix CVE-2010-0742

parent 60a989a7

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -4,6 +4,10 @@ 


 Changes between 0.9.8n and 0.9.8o [xx XXX xxxx]



  *) Correct a typo in the CMS ASN1 module which can result in invalid memory

     access or freeing data twice (CVE-2010-0742)

     [Steve Henson, Ronald Moesbergen <intercommit@gmail.com>]



  *) Add SHA2 algorithms to SSL_library_init(). SHA2 is becoming far more

     common in certificates and some applications which only call

     SSL_library_init and not OpenSSL_add_all_algorithms() will fail.

crypto/cms/cms_asn1.c

+2 −2
Original line number Diff line number Diff line
@@ -130,8 +130,8 @@ ASN1_NDEF_SEQUENCE(CMS_SignedData) = { 
} ASN1_NDEF_SEQUENCE_END(CMS_SignedData)



ASN1_SEQUENCE(CMS_OriginatorInfo) = {

	ASN1_IMP_SET_OF_OPT(CMS_SignedData, certificates, CMS_CertificateChoices, 0),

	ASN1_IMP_SET_OF_OPT(CMS_SignedData, crls, CMS_RevocationInfoChoice, 1)

	ASN1_IMP_SET_OF_OPT(CMS_OriginatorInfo, certificates, CMS_CertificateChoices, 0),

	ASN1_IMP_SET_OF_OPT(CMS_OriginatorInfo, crls, CMS_RevocationInfoChoice, 1)

} ASN1_SEQUENCE_END(CMS_OriginatorInfo)



ASN1_NDEF_SEQUENCE(CMS_EncryptedContentInfo) = {