- 15 Oct, 2016 2 commits
-
-
Steven Fackler authored
These are implemented as macros delegating to `EVP_DigestUpdate`, which takes a `size_t` as its third argument, not an `unsigned int`. CLA: trivial Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit 8bdce8d1)
-
Matt Caswell authored
If len == 0 in a call to ERR_error_string_n() then we can read beyond the end of the buffer. Really applications should not be calling this function with len == 0, but we shouldn't be letting it through either! Thanks to Agostino Sarubbo for reporting this issue. Agostino's blog on this issue is available here: https://blogs.gentoo.org/ago/2016/10/14/openssl-libcrypto-stack-based-buffer-overflow-in-err_error_string_n-err-c/ Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit e5c13615)
-
- 14 Oct, 2016 2 commits
-
-
Tomas Mraz authored
Copy the whole ALG_OP_TYPE to CMSG_DATA. Reviewed-by:
-
Xiaoyin Liu authored
I think the second "VC-WIN32" should be "VC-WIN64". Reviewed-by:
-
- 13 Oct, 2016 9 commits
-
-
Vitezslav Cizek authored
The number is taken from the OPENSSL_VERSION_NUMBER which is already in the hex form. CLA: trivial Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1706) (cherry picked from commit 35a498e4)
-
Dr. Stephen Henson authored
Reviewed-by:
-
FdaSilvaYY authored
Reviewed-by:
-
Ben Laurie authored
Reviewed-by: -
Ben Laurie authored
Reviewed-by: -
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
Looking for something starting with '-Wl,-rpath,' isn't good enough, as someone might give something like '-Wl,--enable-new-dtags,-rpath,/PATH'. Looking for ',-rpath,' should be safe enough. We could remove the preloading stuff entirely, but just in case the user has chosen to given RPATH setting arguments at configuration, we'd better make sure testing will still work. Fair warning, there are some configuration options that do not work with preloaded OpenSSL libraries, such as the sanity checking ones. Reviewed-by:
-
Richard Levitte authored
Make Configure recognise -rpath and -R to support user added rpaths for OSF1 and Solaris. For convenience, add a variable LIBRPATH in the Unix Makefile, which the users can use as follows: ./config [options] -Wl,-rpath,\$(LIBRPATH) Reviewed-by: -
Richard Levitte authored
Before OpenSSL 1.1.0, binaries were installed in a non-standard location by default, and runpath directories were therefore added in those binaries, to make sure the executables would be able to find the shared libraries they were linked with. With OpenSSL 1.1.0 and on, binaries are installed in standard directories by default, and the addition of runpath directories is therefore not needed any more. Reviewed-by:
-
- 12 Oct, 2016 1 commit
-
-
Rich Salz authored
Reviewed-by:
-
- 11 Oct, 2016 1 commit
-
-
Dr. Stephen Henson authored
The original X509_NAME decode free code was buggy: this could result in double free or leaks if a malloc failure occurred. Simplify and fix the logic. Thanks to Guido Vranken for reporting this issue. Reviewed-by:
-
- 02 Oct, 2016 3 commits
-
-
Ben Laurie authored
Reviewed-by: -
Ben Laurie authored
Reviewed-by: -
Ben Laurie authored
Reviewed-by:
-
- 01 Oct, 2016 3 commits
-
-
Dr. Stephen Henson authored
Reviewed-by:
-
Dr. Stephen Henson authored
Tidy up srp_Calc_k and SRP_Calc_u by making them a special case of srp_Calc_xy which performs SHA1(PAD(x) | PAD(y)). This addresses an OCAP Audit issue. Reviewed-by:
-
Dr. Stephen Henson authored
Reviewed-by:
-
- 29 Sep, 2016 4 commits
-
-
Matt Caswell authored
Reviewed-by:
-
David Woodhouse authored
This used to work in 1.0.2 but disappeared when the argument parsing was revamped. Reviewed-by:
-
Matt Caswell authored
If we have a handshake fragment waiting then dtls1_read_bytes() was not correctly setting the value of recvd_type, leading to an uninit read. Reviewed-by:
-
Matt Caswell authored
The new large message test in sslapitest needs OPENSSL_NO_DTLS guards Reviewed-by:
-
- 28 Sep, 2016 5 commits
-
-
Richard Levitte authored
Before loading a key from an engine, it may need to be initialized. When done loading the key, we must de-initialize the engine. (if the engine is already initialized somehow, only the reference counter will be incremented then decremented) Reviewed-by:
Stephen Henson <steve@openssl.org> (cherry picked from commit 49e476a5)
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Add the ability to test both server initiated and client initiated reneg. Reviewed-by:
-
Matt Caswell authored
Add update for testing renegotiation. Also change info on CTLOG_FILE environment variable - which always seems to be required. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
- 27 Sep, 2016 1 commit
-
-
David Benjamin authored
This would have caught 099e2968. This is a port of the test added in https://boringssl.googlesource.com/boringssl/+/7c040756178e14a4d181b6d93abb3827c93189c4 Reviewed-by:
Emilia Käsper <emilia@openssl.org> Reviewed-by:
-
- 26 Sep, 2016 9 commits
-
-
David Benjamin authored
Reviewed-by:
-
David Benjamin authored
The TLSProxy::Record->new call hard-codes a version, like 70-test_sslrecords.t. Reviewed-by:
-
David Benjamin authored
Reviewed-by:
-
David Benjamin authored
Avoid making the CI blow up. Reviewed-by:
-
David Benjamin authored
This is a regression test for https://github.com/openssl/openssl/pull/1431 . It tests a maximally-padded record with each possible invalid offset. This required fixing a bug in Message.pm where the client sending a fatal alert followed by close_notify was still treated as success. Reviewed-by:
-
Matt Caswell authored
A mem leak could occur on an error path. Also the mempacket BIO_METHOD needs to be cleaned up, because of the newly added DTLS test. Also fixed a double semi-colon in ssltestlib.c Reviewed-by:
-
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by:
-
