- Sep 19, 2015
-
-
Viktor Dukhovni authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 4fe1cbdf)
-
- Sep 18, 2015
-
-
Rich Salz authored
Was only approved for master, to avoid compatibility issues on previous releases. Reviewed-by: Emilia Käsper <emilia@openssl.org>
-
- Sep 17, 2015
-
-
Matt Caswell authored
In master we have the function OPENSSL_clear_free(x,y), which immediately returns if x == NULL. In <=1.0.2 this function does not exist so we have to do: OPENSSL_cleanse(x, y); OPENSSL_free(x); However, previously, OPENSSL_cleanse did not check that if x == NULL, so the real equivalent check would have to be: if (x != NULL) OPENSSL_cleanse(x, y); OPENSSL_free(x); It would be easy to get this wrong during cherry-picking to other branches and therefore, for safety, it is best to just ensure OPENSSL_cleanse also checks for NULL. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 020d8fc8)
-
Emilia Kasper authored
Previously, the conversion would silently coerce to ASCII. Now, we error out. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit b785504a)
-
Emilia Kasper authored
Rewrite EVP_DecodeUpdate. In particular: reject extra trailing padding, and padding in the middle of the content. Don't limit line length. Add tests. Previously, the behaviour was ill-defined, and depended on the position of the padding within the input. In addition, this appears to fix a possible two-byte oob read. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr Stephen Henson <steve@openssl.org> (cherry picked from commit 3cdd1e94)
-
- Sep 16, 2015
-
-
Kurt Roeckx authored
Reviewed-by: Rich Salz <rsalz@openssl.org> MR #1128 (cherry picked from commit fae11ec7)
-
Ivo Raisr authored
PR#4035 Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
-
- Sep 15, 2015
-
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 83fcd322)
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Sep 14, 2015
-
-
Kurt Roeckx authored
Reviewed-by: Dr. Stephen Henson <steve@openssl.org> MR #1005 (cherry picked from commit a46c9789)
-
- Sep 12, 2015
-
-
Dr. Stephen Henson authored
PR#3920. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit aabd4923)
-
Dr. Stephen Henson authored
PR#3958 Reviewed-by: Rich Salz <rsalz@openssl.org>
-
- Sep 11, 2015
-
-
John Foley authored
PR#4036 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
-
Dr. Stephen Henson authored
If the field separator isn't specified through -nameopt then use XN_FLAG_SEP_CPLUS_SPC instead of printing nothing and returing an error. PR#2397 Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 03706afa)
-
- Sep 10, 2015
-
-
Emilia Kasper authored
Fix both the caller to error out on malloc failure, as well as the eventual callee to handle a NULL gracefully. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
-
- Sep 08, 2015
-
-
Rich Salz authored
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
-
- Sep 04, 2015
-
-
Dr. Stephen Henson authored
PR#4009. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 13e228d6) Conflicts: ssl/ssl_ciph.c
-
- Sep 03, 2015
-
-
Alessandro Ghedini authored
Closes #63 Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Laurie <ben@openssl.org> (cherry picked from commit 66c103bd)
-
- Sep 02, 2015
-
-
Viktor Dukhovni authored
Avoid using cnid = 0, use NID_undef instead, and return early instead of trying to find an instance of that in the subject DN. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit fffc2fae)
-
Viktor Dukhovni authored
Initialize pointers in param id by the book (explicit NULL assignment, rather than just memset 0). In x509_verify_param_zero() set peername to NULL after freeing it. In x509_vfy.c's internal check_hosts(), avoid potential leak of possibly already non-NULL peername. This is only set when a check succeeds, so don't need to do this repeatedly in the loop. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit a0724ef1)
-
Rich Salz authored
No, we should just delete it. And updated the README Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 8db78781)
-
- Sep 01, 2015
-
-
Hiroyuki YAMAMORI authored
Backport of equivalent fix from master. The only compression method is stateful and hence incompatible with DTLS. The DTLS test was not working for DTLS1.2 Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
Hiroyuki YAMAMORI authored
Fix the setup of DTLS1.2 buffers to take account of the Header Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
Matt Caswell authored
Commit f0348c84 introduced a problem with session resumption. The version for the session is fixed when the session is created. By moving the creation of the session earlier in the process the version is fixed *before* version negotiation has completed when processing the ServerHello on the client side. This fix updates the session version after version neg has completed. Reviewed-by: Emilia Käsper <emilia@openssl.org>
-
Matt Caswell authored
Builds using no-tlsext in 1.0.0 and 0.9.8 are broken. This commit fixes the issue. The same commit is applied to 1.0.1 and 1.0.2 branches for code consistency. However this commit will not fix no-tlsext in those branches which have always been broken for other reasons. The commit is not applied to master at all, because no-tlsext has been completely removed from that branch. Based on a patch by Marc Branchaud <marcnarc@xiplink.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
-
Tim Zhang authored
The |z| value should be 0x04 not 0x02 RT#3838 Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 91d2728b)
-
Emilia Kasper authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Emilia Kasper authored
The NULL cipher case can't actually happen because we have no EVP_PBE_CTL combinations where cipher_nid is -1 and keygen is PKCS12_PBE_keyivgen. But make the code more obviously correct. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 394f7b6f)
-
Emilia Kasper authored
- Pass in the right ciphertext length to ensure we're indeed testing ciphertext corruption (and not truncation). - Only test one mutation per byte to not make the test too slow. - Add a separate test for truncated ciphertexts. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 25d6b340)
-
- Aug 31, 2015
-
-
Richard Levitte authored
Because we recently encourage people to have a .dir-locals.el, it's a good idea to ignore it on a git level. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit d7c02691)
-
mrpre authored
Slightly modified from the original PR. Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit a7e974c7)
-
Ben Kaduk authored
Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 36ac7bc8)
-
Emilia Kasper authored
Don't dereference |d| when |top| is zero. Also test that various BIGNUM methods behave correctly on zero/even inputs. Follow-up to b11980d7 Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Richard Levitte authored
Apparently, emacs sees changes to auto-fill-mode as insecure Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 6dc08048)
-
Richard Levitte authored
This file, when copied to .dir-locals.el in the OpenSSL source top, will make sure that the CC mode style "OpenSSL-II" will be used for all C files. Additionally, I makes sure that tabs are never used as indentation character, regardless of the emacs mode, and that the fill column is 78. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 0927f0d8)
-
Richard Levitte authored
This hopefully conforms closely enough to the current code style. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit d9b3554b)
-
Emilia Kasper authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 4d04226c)
-
- Aug 30, 2015
-
-
Rich Salz authored
Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 9db0c91c)
-
- Aug 28, 2015
-
-
Alessandro Ghedini authored
Fix more potential leaks in X509_verify_cert() Fix memory leak in ClientHello test Fix memory leak in gost2814789 test Fix potential memory leak in PKCS7_verify() Fix potential memory leaks in X509_add1_reject_object() Refactor to use "goto err" in cleanup. Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 55500ea7)
-
Ismo Puustinen authored
If the seed value for dsa key generation is too short (< qsize), return an error. Also update the documentation. Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit f00a10b8)
-