- Oct 08, 2015
-
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 5850cc75)
-
- Oct 07, 2015
-
-
Pascal Cuoq authored
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> MR #1231 (cherry picked from commit 99c20333)
-
Pascal Cuoq authored
BN_with_flags() will read the dest->flags to keep the BN_FLG_MALLOCED but overwrites everything else. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> MR #1231 (cherry picked from commit f92768e6)
-
- Oct 06, 2015
-
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit e58c4d3c)
-
- Oct 05, 2015
-
-
Matt Caswell authored
Some extension handling functions were passing in a pointer to the start of the data, plus the length in order to calculate the end, rather than just passing in the end to start with. This change makes things a little more readable. Reviewed-by: Emilia Käsper <emilia@openssl.org> Conflicts: ssl/s3_srvr.c ssl/ssl_locl.h ssl/t1_lib.c
-
Alessandro Ghedini authored
RT#4069 Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Oct 03, 2015
-
-
Kurt Roeckx authored
Thanks to David Benjamin <davidben@google.com> for pointing them out. Reviewed-by: Steve Henson <steve@openssl.org> MR #1198 (cherry picked from commit 605236f6)
-
- Sep 29, 2015
-
-
Dr. Stephen Henson authored
PR#4042 Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit d62c64b9)
-
Ismo Puustinen authored
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 6f997dc3)
-
Hubert Kario authored
the alias supported by OpenSSL 1.0.1 is "EECDH" not "EECDHE" (GH PR 405) Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Andy Polyakov <appro@openssl.org>
-
- Sep 28, 2015
-
-
Emilia Kasper authored
RFC 5077 section 3.3 says: If the server determines that it does not want to include a ticket after it has included the SessionTicket extension in the ServerHello, then it sends a zero-length ticket in the NewSessionTicket handshake message. Previously the client would fail upon attempting to allocate a zero-length buffer. Now, we have the client ignore the empty ticket and keep the existing session. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 21b538d6)
-
Dr. Stephen Henson authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 92ea6fe5)
-
- Sep 25, 2015
-
-
Rich Salz authored
Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Rich Salz authored
Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 1d4ddb4e)
-
- Sep 22, 2015
-
-
Emilia Kasper authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 58e3457a) (cherry picked from commit be250ee2)
-
Emilia Kasper authored
Fix comment, add another overflow check, tidy style Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit de8883e1) (cherry picked from commit f5afe9ce)
-
Alessandro Ghedini authored
BUF_strndup was calling strlen through BUF_strlcpy, and ended up reading past the input if the input was not a C string. Make it explicitly part of BUF_strndup's contract to never read more than |siz| input bytes. This augments the standard strndup contract to be safer. The commit also adds a check for siz overflow and some brief documentation for BUF_strndup(). Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 110f7b37) (cherry picked from commit f61216ba)
-
Rich Salz authored
For all release branches. It adds travis build support. If you don't have a config file it uses the default (because we enabled travis for the project), which uses ruby/rake/rakefiles, and you get confusing "build still failing" messages. Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit db9defdf)
-
- Sep 21, 2015
-
-
David Woodhouse authored
If we use BIO_new_file(), on Windows it'll jump through hoops to work around their unusual charset/Unicode handling. it'll convert a UTF-8 filename to UCS-16LE and attempt to use _wfopen(). If you use BIO_read_filename(), it doesn't do this. Shouldn't it be consistent? It would certainly be nice if SSL_use_certificate_chain_file() worked. Also made BIO_C_SET_FILENAME work (rsalz) Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit ff03599a)
-
Gunnar Kudrjavets authored
There are a couple of minor fixes here: 1) Handle the case when RegisterEventSource() fails (which it may for various reasons) and do the work of logging the event only if it succeeds. 2) Handle the case when ReportEvent() fails and do our best in debug builds to at least attempt somehow indicate that something has gone wrong. The typical situation would be someone running tools like DbMon, DBWin32, DebugView or just having the debugger attached. The intent is to make sure that at least some data will be captured so that we can save hours and days of debugging time. 3) Minor fix to change the MessageBox() flag to MB_ICONERROR. Though the value of MB_ICONERROR is the same value as MB_ICONSTOP, the intent is better conveyed by using MB_ICONERROR. Testing performed: 1) Clean compilation for debug-VC-WIN32 and VC-WIN32. 2) Good test results (nmake -f ms\ntdll.mak test) for debug-VC-WIN32 and VC-WIN32. 3) Stepped through relevant changes using WinDBG and e...
-
Matt Caswell authored
There were some memory leaks in the creation of an SRP verifier (both on successful completion and also on some error paths). Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit bf95cde2)
-
- Sep 20, 2015
-
-
Dr. Stephen Henson authored
PR#3817 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 4e7e6230) Conflicts: apps/s_server.c
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit f1c412c9)
-
- Sep 19, 2015
-
-
Viktor Dukhovni authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 4fe1cbdf)
-
- Sep 18, 2015
-
-
Rich Salz authored
Was only approved for master, to avoid compatibility issues on previous releases. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 6be18a22)
-
- Sep 17, 2015
-
-
Matt Caswell authored
In master we have the function OPENSSL_clear_free(x,y), which immediately returns if x == NULL. In <=1.0.2 this function does not exist so we have to do: OPENSSL_cleanse(x, y); OPENSSL_free(x); However, previously, OPENSSL_cleanse did not check that if x == NULL, so the real equivalent check would have to be: if (x != NULL) OPENSSL_cleanse(x, y); OPENSSL_free(x); It would be easy to get this wrong during cherry-picking to other branches and therefore, for safety, it is best to just ensure OPENSSL_cleanse also checks for NULL. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 020d8fc8)
-
Emilia Kasper authored
Previously, the conversion would silently coerce to ASCII. Now, we error out. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit b785504a) (cherry picked from commit cb71f17d)
-
Emilia Kasper authored
Rewrite EVP_DecodeUpdate. In particular: reject extra trailing padding, and padding in the middle of the content. Don't limit line length. Add tests. Previously, the behaviour was ill-defined, and depended on the position of the padding within the input. In addition, this appears to fix a possible two-byte oob read. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr Stephen Henson <steve@openssl.org> (cherry picked from commit 3cdd1e94) (cherry picked from commit 37faf117)
-
- Sep 16, 2015
-
-
Ivo Raisr authored
PR#4035 Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org> (cherry picked from commit 929f6d6f)
-
- Sep 15, 2015
-
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 3be39dc1)
-
- Sep 14, 2015
-
-
Kurt Roeckx authored
Reviewed-by: Dr. Stephen Henson <steve@openssl.org> MR #1005 (cherry picked from commit a46c9789)
-
- Sep 12, 2015
-
-
Dr. Stephen Henson authored
PR#3958 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 2aa5a2c7)
-
- Sep 11, 2015
-
-
Dr. Stephen Henson authored
If the field separator isn't specified through -nameopt then use XN_FLAG_SEP_CPLUS_SPC instead of printing nothing and returing an error. PR#2397 Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 03706afa)
-
- Sep 10, 2015
-
-
Emilia Kasper authored
Fix both the caller to error out on malloc failure, as well as the eventual callee to handle a NULL gracefully. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
-
- Sep 01, 2015
-
-
Matt Caswell authored
Commit f0348c84 introduced a problem with session resumption. The version for the session is fixed when the session is created. By moving the creation of the session earlier in the process the version is fixed *before* version negotiation has completed when processing the ServerHello on the client side. This fix updates the session version after version neg has completed. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit dc0c8888)
-
Matt Caswell authored
Builds using no-tlsext in 1.0.0 and 0.9.8 are broken. This commit fixes the issue. The same commit is applied to 1.0.1 and 1.0.2 branches for code consistency. However this commit will not fix no-tlsext in those branches which have always been broken for other reasons. The commit is not applied to master at all, because no-tlsext has been completely removed from that branch. Based on a patch by Marc Branchaud <marcnarc@xiplink.com> Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 9a931208)
-
Tim Zhang authored
The |z| value should be 0x04 not 0x02 RT#3838 Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 91d2728b)
-
Emilia Kasper authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Emilia Kasper authored
The NULL cipher case can't actually happen because we have no EVP_PBE_CTL combinations where cipher_nid is -1 and keygen is PKCS12_PBE_keyivgen. But make the code more obviously correct. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 394f7b6f)
-