- 24 Aug, 2016 21 commits
-
-
Rob Percival authored
Fixes complaint "ct missing from SYNOPSIS". Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
util/fix-doc-nits.pl complains that "CT_POLICY_EVAL_CTX (filename) missing from NAME section". Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
util/find-doc-nits.pl complains that the file "doesn't end with =cut". Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Matt Caswell authored
It is never valid to call ssl3_read_bytes with type == SSL3_RT_CHANGE_CIPHER_SPEC, and in fact we check for valid values for type near the beginning of the function. Therefore this check will never be true and can be removed. Reviewed-by:
Tim Hudson <tjh@openssl.org>
-
Matt Caswell authored
The variable assignment c1 is never read before it is overwritten. Reviewed-by:
Tim Hudson <tjh@openssl.org>
-
Matt Caswell authored
Reviewed-by:
Tim Hudson <tjh@openssl.org>
-
Andy Polyakov authored
RT#4625 Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Andy Polyakov authored
RT#4625 Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Andy Polyakov authored
Addition was not preserving inputs' property of being fully reduced. Thanks to Brian Smith for reporting this. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Andy Polyakov authored
Addition was not preserving inputs' property of being fully reduced. Thanks to Brian Smith for reporting this. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Andy Polyakov authored
Thanks to David Benjamin for reporting this. Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
The declaration of bio_type_lock is independent of no-sock so should not be inside OPENSSL_NO_SOCK guards. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 23 Aug, 2016 15 commits
-
-
Dr. Stephen Henson authored
If a ticket callback changes the HMAC digest to SHA512 the existing sanity checks are not sufficient and an attacker could perform a DoS attack with a malformed ticket. Add additional checks based on HMAC size. Thanks to Shi Lei for reporting this bug. CVE-2016-6302 Reviewed-by:
Viktor Dukhovni <viktor@openssl.org>
-
Andy Polyakov authored
Test doesn't work on Windows with non-Greek locale, because of Win32 perl[!] limitation, not OpenSSL. For example it passes on Cygwin and MSYS... Reviewed-by:
Matt Caswell <matt@openssl.org>
-
David Benjamin authored
The bound on log(2)/3 on the second line is incorrect and has an extra zero compared to the divisions in the third line. log(2)/3 = 0.10034... which is bounded by 0.101 and not 0.1001. The divisions actually correspond to 0.101 which is fine. The third line also dropped a factor of three. The actual code appears to be fine. Just the comments are wrong. Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
This makes it consistent with all of the other SCT setters. Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
They may return if an SCT_signature struct is added in the future that allows them to be refactored to conform to the i2d/d2i function signature conventions. Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
Previously, if ct_v1_log_id_from_pkey failed, public_key would be freed by CTLOG_free at the end of the function, and then again by the caller (who would assume ownership was not transferred when CTLOG_new returned NULL). Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Rob Percival authored
SCT_verify is impossible to call through the public API (SCT_CTX_new() is not part of the public API), so rename it to SCT_CTX_verify and move it out of the public API. SCT_verify_v1 is redundant, since SCT_validate does the same verification (by calling SCT_verify) and more. The API is less confusing with a single verification function (SCT_validate). Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Kurt Roeckx authored
This is a new minimal corpus with the following changes: - asn1: files: 1135 (+474), tuples: 27236 (+7496) - asn1parse: files: 305 (-3), tuples: 8758 (+11) - bignum: files: 370 (-1), tuples: 9547 (+10) - bndiv: files: 160 (+0), tuples: 2416 (+6) - cms: files: 155 (-1), tuples: 3408 (+0) - conf: files: 231 (-11), tuples: 4668 (+3) - crl: files: 905 (+188), tuples: 22876 (+4096) - ct: files: 117 (+35), tuples: 3557 (+908) - x509: files: 920, tuples: 28334 Note that tuple count depends on the binary and is random. Reviewed-by:
Emilia Käsper <emilia@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
FdaSilvaYY authored
Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
FdaSilvaYY authored
ASN1_buf_print, asn1_print_*, X509_NAME_oneline, X509_NAME_print Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
FdaSilvaYY authored
Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
FdaSilvaYY authored
remove useless cast to call ASN1_STRING_set Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
FdaSilvaYY authored
... add a static keyword. Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
There was a block of code at the start that used the Camellia cipher. The original idea behind this was to fill the buffer with non-zero data so that oversteps can be detected. However this block failed when using no-camellia. This has been replaced with a RAND_bytes() call. I also updated the the CTR test section, since it seems to be using a CBC cipher instead of a CTR cipher. Reviewed-by:
Andy Polyakov <appro@openssl.org>
-
- 22 Aug, 2016 4 commits
-
-
Matt Caswell authored
Reviewed-by:
Tim Hudson <tjh@openssl.org>
-
Matt Caswell authored
The assignment to ret is dead, because ret is assigned again later. Reviewed-by:
Tim Hudson <tjh@openssl.org>
-
Matt Caswell authored
If it's negative don't try and malloc it. Reviewed-by:
Tim Hudson <tjh@openssl.org>
-
Matt Caswell authored
Otherwise we try to malloc a -1 size. Reviewed-by:
Tim Hudson <tjh@openssl.org>
-