Fix initialization sequence to prevent freeing of unitialized objects.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 0de34cc486dccefb06aed08fcd43a6a001275a49..2fd057c41e5e0213b20f11d1cf35fd6764de0893 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,18 @@
 
  Changes between 0.9.7 and 0.9.8  [xx XXX xxxx]
 
 
  Changes between 0.9.7 and 0.9.8  [xx XXX xxxx]
 

+  *) ECDSA routines: under certain error conditions uninitialized BN objects
+     could be freed. Solution: make sure initialization is performed early
+     enough. (Reported and fix supplied by Nils Larsch <nla@trustcenter.de>
+     via PR#459)
+     [Lutz Jaenicke]
+
+  *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
+     and DH_METHOD (eg. by ENGINE implementations) to override the normal
+     software implementations. For DSA and DH, parameter generation can
+     also be overriden by providing the appropriate method callbacks.
+     [Geoff Thorpe]
+

   *) Change the "progress" mechanism used in key-generation and
      primality testing to functions that take a new BN_GENCB pointer in
      place of callback/argument pairs. The new API functions have "_ex"
   *) Change the "progress" mechanism used in key-generation and
      primality testing to functions that take a new BN_GENCB pointer in
      place of callback/argument pairs. The new API functions have "_ex"


@@ -14,6 +26,23 @@
      functions operate on a caller-supplied key-structure and return
      success/failure rather than returning a key or NULL - this is to
      help make "keygen" another member function of RSA_METHOD etc.
      functions operate on a caller-supplied key-structure and return
      success/failure rather than returning a key or NULL - this is to
      help make "keygen" another member function of RSA_METHOD etc.

+
+     Example for using the new callback interface:
+
+          int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
+          void *my_arg = ...;
+          BN_GENCB my_cb;
+
+          BN_GENCB_set(&my_cb, my_callback, my_arg);
+
+          return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
+          /* For the meaning of a, b in calls to my_callback(), see the
+           * documentation of the function that calls the callback.
+           * cb will point to my_cb; my_arg can be retrieved as cb->arg.
+           * my_callback should return 1 if it wants BN_is_prime_ex()
+           * to continue, or 0 to stop.
+           */
+

      [Geoff Thorpe]
 
   *) Change the ZLIB compression method to be stateful, and make it
      [Geoff Thorpe]
 
   *) Change the ZLIB compression method to be stateful, and make it


@@ -25,9 +54,9 @@
      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
 
      CertificatePair ::= SEQUENCE {
      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
 
      CertificatePair ::= SEQUENCE {

-       forward         [0]     Certificate OPTIONAL,
-       reverse         [1]     Certificate OPTIONAL,
-       -- at least one of the pair shall be present -- }
+        forward                [0]     Certificate OPTIONAL,
+        reverse                [1]     Certificate OPTIONAL,
+        -- at least one of the pair shall be present -- }

 
      Also implement the PEM functions to read and write certificate
      pairs, and defined the PEM tag as "CERTIFICATE PAIR".
 
      Also implement the PEM functions to read and write certificate
      pairs, and defined the PEM tag as "CERTIFICATE PAIR".


@@ -352,6 +381,25 @@ TODO: bug: pad  x  with leading zeros if necessary
  
  Changes between 0.9.7 and 0.9.7a  [XX xxx 2003]
 
  
  Changes between 0.9.7 and 0.9.7a  [XX xxx 2003]
 

+  *) DSA routines: under certain error conditions uninitialized BN objects
+     could be freed. Solution: make sure initialization is performed early
+     enough. (Reported and fix supplied by Ivan D Nestlerode <nestler@MIT.EDU>,
+     Nils Larsch <nla@trustcenter.de> via PR#459)
+     [Lutz Jaenicke]
+
+  *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
+     checked on reconnect on the client side, therefore session resumption
+     could still fail with a "ssl session id is different" error. This
+     behaviour is masked when SSL_OP_ALL is used due to
+     SSL_OP_MICROSOFT_SESS_ID_BUG being set.
+     Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
+     followup to PR #377.
+     [Lutz Jaenicke]
+
+  *) IA-32 assembler support enhancements: unified ELF targets, support
+     for SCO/Caldera platforms, fix for Cygwin shared build.
+     [Andy Polyakov]
+

   *) Add support for FreeBSD on sparc64.  As a consequence, support for
      FreeBSD on non-x86 processors is separate from x86 processors on
      the config script, much like the NetBSD support.
   *) Add support for FreeBSD on sparc64.  As a consequence, support for
      FreeBSD on non-x86 processors is separate from x86 processors on
      the config script, much like the NetBSD support.