Skip to content
  1. Feb 07, 2017
  2. Feb 06, 2017
    • Bernd Edlinger's avatar
      Combined patch for the more or less obvious issues · 748cb9a1
      Bernd Edlinger authored
      Fixed a memory leak in ASN1_digest and ASN1_item_digest.
      
      asn1_template_noexp_d2i call ASN1_item_ex_free(&skfield,...) on error.
      
      Reworked error handling in asn1_item_ex_combine_new:
      - call ASN1_item_ex_free and return the correct error code if ASN1_template_new failed.
      - dont call ASN1_item_ex_free if ASN1_OP_NEW_PRE failed.
      
      Reworked error handing in x509_name_ex_d2i and x509_name_encode.
      
      Fixed error handling in int_ctx_new and EVP_PKEY_CTX_dup.
      
      Fixed a memory leak in def_get_class if lh_EX_CLASS_ITEM_insert fails due to OOM:
      - to figure out if the insertion succeeded, use lh_EX_CLASS_ITEM_retrieve again.
      - on error, p will be NULL, and gen needs to be cleaned up again.
      
      int_free_ex_data needs to have a fallback solution if unable to allocate "storage":
      - if free_func is non-zero this must be called to clean up all memory.
      
      Fixed error handling in pkey_hmac_copy.
      
      Fixed error handling in ssleay_rand_add and ssleay_rand_bytes.
      
      Fixed error handling in ...
      748cb9a1
  3. Feb 05, 2017
  4. Jan 31, 2017
  5. Jan 27, 2017
  6. Jan 26, 2017
  7. Jan 24, 2017
  8. Jan 23, 2017
    • Matt Caswell's avatar
      Fix SSL_VERIFY_CLIENT_ONCE · e203f493
      Matt Caswell authored
      
      
      The flag SSL_VERIFY_CLIENT_ONCE is documented as follows:
      
        B<Server mode:> only request a client certificate on the initial TLS/SSL
        handshake. Do not ask for a client certificate again in case of a
        renegotiation. This flag must be used together with SSL_VERIFY_PEER.
      
        B<Client mode:> ignored
      
      But the implementation actually did nothing. After the server sends its
      ServerKeyExchange message, the code was checking s->session->peer to see if
      it is NULL. If it was set then it did not ask for another client
      certificate. However s->session->peer will only be set in the event of a
      resumption, but a ServerKeyExchange message is only sent in the event of a
      full handshake (i.e. no resumption).
      
      The documentation suggests that the original intention was for this to
      have an effect on renegotiation, and resumption doesn't come into it.
      
      The fix is to properly check for renegotiation, not whether there is already
      a client certificate in the session.
      
      As far as I can tell this has been broken for a *long* time.
      
      Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/1984)
      e203f493
  9. Jan 20, 2017
  10. Jan 18, 2017
  11. Jan 11, 2017
  12. Jan 10, 2017
  13. Jan 09, 2017
  14. Dec 29, 2016
  15. Dec 20, 2016
  16. Dec 18, 2016
  17. Dec 14, 2016
  18. Dec 13, 2016
  19. Dec 12, 2016
    • Andy Polyakov's avatar
      perlasm/x86_64-xlate.pl: refine sign extension in ea package. · 7624a318
      Andy Polyakov authored
      
      
      $1<<32>>32 worked fine with either 32- or 64-bit perl for a good while,
      relying on quirk that [pure] 32-bit perl performed it as $1<<0>>0. But
      this apparently changed in some version past minimally required 5.10,
      and operation result became 0. Yet, it went unnoticed for another while,
      because most perl package providers configure their packages with
      -Duse64bitint option.
      
      Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
      (cherry picked from commit 82e08930)
      7624a318
  20. Dec 10, 2016
  21. Dec 08, 2016
  22. Nov 29, 2016
  23. Nov 27, 2016
  24. Nov 26, 2016
  25. Nov 25, 2016