Skip to content
  1. Jul 24, 2017
    • Richard Levitte's avatar
      Simplify Makefile.shared · 8e5cd8b0
      Richard Levitte authored
      
      
      Makefile.shared was designed to figure out static library names,
      shared library names, library version compatibility, import library
      names and the like on its own.  This was a design for pre-1.1.0
      OpenSSL because the main Makefile didn't have all that knowledge.
      
      With 1.1.0, the situation isn't the same, a lot more knowledge is
      included in the main Makefile, and while Makefile.shared did things
      right most of the time (there are some corner cases, such as the
      choice of .sl or .so as DSO extension on some HPUX versions), there's
      still an inherent fragility when one has to keep an eye on
      Makefile.shared to make sure it produces what the main Makefile
      produces.
      
      This change simplifies Makefile.shared by removing all its
      "intelligence" and have it depend entirely on the input from the main
      Makefile instead.  That way, all the naming is driven from
      configuration data.
      
      Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/3983)
      
      (cherry picked f...
      8e5cd8b0
  2. Jul 23, 2017
  3. Jul 19, 2017
    • Matt Caswell's avatar
      Remove some dead code · 42aebbd5
      Matt Caswell authored
      
      
      The intention of the removed code was to check if the previous operation
      carried. However this does not work. The "mask" value always ends up being
      a constant and is all ones - thus it has no effect. This check is no longer
      required because of the previous commit.
      
      Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/3832)
      
      (cherry picked from commit d5475e31)
      42aebbd5
    • Matt Caswell's avatar
      Fix undefined behaviour in e_aes_cbc_hmac_sha256.c and e_aes_cbc_hmac_sha1.c · 6db7d015
      Matt Caswell authored
      
      
      In TLS mode of operation the padding value "pad" is obtained along with the
      maximum possible padding value "maxpad". If pad > maxpad then the data is
      invalid. However we must continue anyway because this is constant time code.
      
      We calculate the payload length like this:
      
          inp_len = len - (SHA_DIGEST_LENGTH + pad + 1);
      
      However if pad is invalid then inp_len ends up -ve (actually large +ve
      because it is a size_t).
      
      Later we do this:
      
          /* verify HMAC */
          out += inp_len;
          len -= inp_len;
      
      This ends up with "out" pointing before the buffer which is undefined
      behaviour. Next we calculate "p" like this:
      
          unsigned char *p =
              out + len - 1 - maxpad - SHA256_DIGEST_LENGTH;
      
      Because of the "out + len" term the -ve inp_len value is cancelled out
      so "p" points to valid memory (although technically the pointer arithmetic
      is undefined behaviour again).
      
      We only ever then dereference "p" and never "out" directly so there is
      never an invalid read based on the bad pointer - so there is no security
      issue.
      
      This commit fixes the undefined behaviour by ensuring we use maxpad in
      place of pad, if the supplied pad is invalid.
      
      With thanks to Brian Carpenter for reporting this issue.
      
      Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/3832)
      
      (cherry picked from commit 335d0a46)
      6db7d015
  4. Jul 18, 2017
  5. Jul 17, 2017
  6. Jul 14, 2017
  7. Jul 10, 2017
  8. Jul 09, 2017
  9. Jul 07, 2017
  10. Jul 05, 2017
  11. Jul 03, 2017
  12. Jul 01, 2017
  13. Jun 29, 2017
  14. Jun 25, 2017
  15. Jun 22, 2017
  16. Jun 21, 2017
  17. Jun 20, 2017
  18. Jun 19, 2017
  19. Jun 17, 2017
  20. Jun 15, 2017
  21. Jun 14, 2017