By using non-DER or invalid encodings outside the signed portion of a
certificate the fingerprint can be changed without breaking the signature.
Although no details of the signed portion of the certificate can be changed
this can cause problems with some applications: e.g. those using the
certificate fingerprint for blacklists.

1. Reject signatures with non zero unused bits.

If the BIT STRING containing the signature has non zero unused bits reject
the signature. All current signature algorithms require zero unused bits.

2. Check certificate algorithm consistency.

Check the AlgorithmIdentifier inside TBS matches the one in the
certificate signature. NB: this will result in signature failure
errors for some broken certificates.

3. Check DSA/ECDSA signatures use DER.

Reencode DSA/ECDSA signatures and compare with the original received
signature. Return an error if there is a mismatch.

This will reject various cases including garbage after signature
(thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
(negative or with leading zeroes).

CVE-2014-8275
Reviewed-by: Emilia Käsper <emilia@openssl.org>

(cherry picked from commit 684400ce)

Check for NULL return from X509_NAME_ENTRY_new()

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 2c60925d)

When parsing ClientHello clear any existing extension state from
SRP login and SRTP profile.

Thanks to Karthikeyan Bhargavan for reporting this issue.
Reviewed-by: Matt Caswell <matt@openssl.org>

(cherry picked from commit 47606dda)

Conflicts:
	ssl/t1_lib.c

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>

RT#3629

Reviewed-by: Richard Levitte <levitte@openssl.org>

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

We need this for the freebsd kernel with glibc as used in the Debian kfreebsd
ports.  There shouldn't be a problem defining this on systems not using glibc.

Reviewed-by: Richard Levitte <levitte@openssl.org>

The BIO_free() allocated ex_data again that we already freed.

Reviewed-by: Richard Levitte <levitte@openssl.org>

* adds links to various related documents.
* fixes a few typos.
* rewords a few sentences.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 67472bd8)

Reviewed-by: Stephen Henson <steve@openssl.org>
(cherry picked from commit 7cfab40f)

Return an error code for I/O errors instead of an assertion failure.

PR#3470
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

(cherry picked from commit 2521fcd8)

is run with --strict-warnings.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 488f16e3)

Reviewed-by: Matt Caswell <matt@openssl.org>

According to X6.90 null, object identifier, boolean, integer and enumerated
types can only have primitive encodings: return an error if any of
these are received with a constructed encoding.
Reviewed-by: Emilia Käsper <emilia@openssl.org>

(cherry picked from commit f5e4b6b5)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 03af8430)

Causes more problems than it fixes: even though error codes
are not part of the stable API, several users rely on the
specific error code, and the change breaks them. Conversely,
we don't have any concrete use-cases for constant-time behaviour here.

This reverts commit f2df488a

.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Various build fixes, mostly uncovered by clang's unused-const-variable
and unused-function errors.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 0e1c318e)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 8bc8450a)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit bf68456f)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 53332a75)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit cd387d21)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 0c403e80)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 553affbe)

From BoringSSL
- Send an alert when the client key exchange isn't correctly formatted.
- Reject overly short RSA ciphertexts to avoid a (benign) out-of-bounds memory access.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 4aecfd4d)

master branch has a specific regression test for a bug in x86_64-mont5 code,
see commit cdfe0fdd

.

This code is now in 1.0.2/1.0.1, so also backport the test.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit bb565cd2)

Invalid zero-padding in the divisor could cause a division by 0.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit a43bcd9e)

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 55e53026)

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 1904d211)

Reviewed-by: Tim Hudson <tjh@openssl.org>

Based on commit 66f96fe2

 by Steve Henson

Reviewed-by: Tim Hudson <tjh@openssl.org>

The temporary variable causes unused variable warnings in opt mode with clang,
because the subsequent assert is compiled out.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 6af16ec5)

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit d04a1e0b)

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit bb1ddd3d)

malloc failure.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 41bf2501)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 76e65090)

The Supported Elliptic Curves extension contains a vector of NamedCurves
of 2 bytes each, so the total length must be even. Accepting odd-length
lists was observed to lead to a non-exploitable one-byte out-of-bounds
read in the latest development branches (1.0.2 and master). Released
versions of OpenSSL are not affected.

Thanks to Felix Groebert of the Google Security Team for reporting this issue.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 33d5ba86)

Reviewed-by: Tim Hudson <tjh@openssl.org>

Conflicts:
	ssl/d1_lib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 4bb8eb9c)