From: "Chris D. Peterson" <cpeterson@aventail.com>
  Subject: Implementation Issues with OpenSSL
  To: openssl-users@openssl.org
  Date: Wed, 22 Aug 2001 16:13:17 -0700
The patch included in the original post may improve the internal session
list handling (and is therefore worth a seperate investigation).
No change to the list handling will however solve the problems of incorrect
SSL_SESSION_free() calls. The session list is only one possible point of
failure, dangling pointers would also occur for SSL object currently
using the session. The correct solution is to only use SSL_SESSION_free()
when applicable!

such cases, a flush should *not* attempt to finalise the encoding, as
the EVP_ENCODE_CTX structure will only be filled with garbage.  For
the same reason, do the same check when a wpending is performed.

-pedantic, or some parts of the source will raise complaints from the
compiler.

Noticed by Thomas Klausner <wiz@danbala.ifoer.tuwien.ac.at>.

just sent a HelloRequest.

reveal whether illegal block cipher padding was found or a MAC
verification error occured.

In ssl/s2_pkt.c, verify that the purported number of padding bytes is in
the legal range.

branch (revision 1.50, 2000-11-17)

'OpenSSL_0_9_6-stable'.

Bodo Moeller).

in "types.h" so that very few headers will need to include engine.h,
generally only C files using API functions will need it (reducing
the header dependencies quite a lot).

Fix X509V3 macro so they compile.

settable (proposed by "Douglas E. Engert" <deengert@anl.gov>).

macros in apps.h.