_lrotl and _lrotr are defined in MSVC but nowhere else that we know

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index b16e1d7d8976a44b5bb48a0ebc1c77640b5099fc..6d684ce703a2da324bf5c5fe63de3d27e380db04 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,15 +4,45 @@
 
  Changes between 0.9.5 and 0.9.5a  [XX XXX 2000]
 
-  *) For easily testing in shell scripts whether some command exists,
-     'openssl no-XXX' returns with exit code 0 iff the command XXX is
-     available.  'no-XXX' is printed in this case, 'XXX' otherwise
-     (i.e. when a command of this name exists).  In both cases,
+  *) Use lock CRYPTO_LOCK_RAND correctly in ssleay_rand_status
+     (the default implementation of RAND_status).
+
+  *) Rename openssl x509 option '-crlext', which was added in 0.9.5,
+     to '-clrext' (= clear extensions), as intended and documented.
+     [Bodo Moeller; inconsistency pointed out by Michael Attili
+     <attili@amaxo.com>]
+
+  *) Fix for HMAC. It wasn't zeroing the rest of the block if the key length
+     was larger than the MD block size.      
+     [Steve Henson, pointed out by Yost William <YostW@tce.com>]
+
+  *) Modernise PKCS12_parse() so it uses STACK_OF(X509) for its ca argument
+     fix a leak when the ca argument was passed as NULL. Stop X509_PUBKEY_set()
+     using the passed key: if the passed key was a private key the result
+     of X509_print(), for example, would be to print out all the private key
+     components.
+     [Steve Henson]
+
+  *) des_quad_cksum() byte order bug fix.
+     [Ulf Möller, using the problem description in krb4-0.9.7, where
+      the solution is attributed to Derrick J Brashear <shadow@DEMENTIA.ORG>]
+
+  *) Fix so V_ASN1_APP_CHOOSE works again: however its use is strongly
+     discouraged.
+     [Steve Henson, pointed out by Brian Korver <briank@cs.stanford.edu>]
+
+  *) For easily testing in shell scripts whether some command
+     'openssl XXX' exists, the new pseudo-command 'openssl no-XXX'
+     returns with exit code 0 iff no command of the given name is available.
+     'no-XXX' is printed in this case, 'XXX' otherwise.  In both cases,
      the output goes to stdout and nothing is printed to stderr.
      Additional arguments are always ignored.
 
      Since for each cipher there is a command of the same name,
      the 'no-cipher' compilation switches can be tested this way.
+
+     ('openssl no-XXX' is not able to detect pseudo-commands such
+     as 'quit', 'list-XXX-commands', or 'no-XXX' itself.)
      [Bodo Moeller]
 
   *) Update test suite so that 'make test' succeeds in 'no-rsa' configuration.