GH715: Missed some null-check-removals. follow commits 412bafdcf5, and 7c96dbcdab

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index d60d6555a9ac4a9b2e561cfdf4ee1fcd53e1ffdd..e0ac7997beb9a2106a342d30286787d3aff62959 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,14 +4,33 @@
 
  Changes between 1.0.2f and 1.1.0  [xx XXX xxxx]
 
 
  Changes between 1.0.2f and 1.1.0  [xx XXX xxxx]
 

+  *) Deprecate SRP_VBASE_get_by_user.
+     SRP_VBASE_get_by_user had inconsistent memory management behaviour.
+     In order to fix an unavoidable memory leak (CVE-2016-0798),
+     SRP_VBASE_get_by_user was changed to ignore the "fake user" SRP
+     seed, even if the seed is configured.
+
+     Users should use SRP_VBASE_get1_by_user instead. Note that in
+     SRP_VBASE_get1_by_user, caller must free the returned value. Note
+     also that even though configuring the SRP seed attempts to hide
+     invalid usernames by continuing the handshake with fake
+     credentials, this behaviour is not constant time and no strong
+     guarantees are made that the handshake is indistinguishable from
+     that of a valid user.
+     [Emilia Käsper]
+

   *) Configuration change; it's now possible to build dynamic engines
   *) Configuration change; it's now possible to build dynamic engines

-     without having to build shared libraries and vice versa.  The
-     only requirement for building dynamic engines is the presence of
-     the DSO module, so configuring "disable-dso" will automatically
-     disable dynamic engines.  Dynamic engines are enabled by default,
-     and can be disabled with "enable-static-engine".
-     This only applies to the engines in engines/, those in
-     crypto/engine/ will always be built into libcrypto (i.e. "static").
+     without having to build shared libraries and vice versa.  This
+     only applies to the engines in engines/, those in crypto/engine/
+     will always be built into libcrypto (i.e. "static").
+
+     Building dynamic engines is enabled by default; to disable, use
+     the configuration option "disable-dynamic-engine".
+
+     The only requirements for building dynamic engines are the
+     presence of the DSO module and building with position independent
+     code, so they will also automatically be disabled if configuring
+     with "disable-dso" or "disable-pic".

 
      The macros OPENSSL_NO_STATIC_ENGINE and OPENSSL_NO_DYNAMIC_ENGINE
      are also taken away from openssl/opensslconf.h, as they are
 
      The macros OPENSSL_NO_STATIC_ENGINE and OPENSSL_NO_DYNAMIC_ENGINE
      are also taken away from openssl/opensslconf.h, as they are


@@ -24,6 +43,10 @@
      object files.  This means other libraries that use routines from
      libcrypto / libssl can be made into shared libraries regardless
      of how OpenSSL was configured.
      object files.  This means other libraries that use routines from
      libcrypto / libssl can be made into shared libraries regardless
      of how OpenSSL was configured.

+
+     If this isn't desirable, the configuration options "disable-pic"
+     or "no-pic" can be used to disable the use of PIC.  This will
+     also disable building shared libraries and dynamic engines.

      [Richard Levitte]
 
   *) Removed JPAKE code.  It was experimental and has no wide use.
      [Richard Levitte]
 
   *) Removed JPAKE code.  It was experimental and has no wide use.


@@ -48,7 +71,7 @@
      The "unified" build system is aimed to be a common system for all
      platforms we support.  With it comes new support for VMS.
 
      The "unified" build system is aimed to be a common system for all
      platforms we support.  With it comes new support for VMS.
 

-     This system builds supports building in a differnt directory tree
+     This system builds supports building in a different directory tree

      than the source tree.  It produces one Makefile (for unix family
      or lookalikes), or one descrip.mms (for VMS).
 
      than the source tree.  It produces one Makefile (for unix family
      or lookalikes), or one descrip.mms (for VMS).
 


@@ -300,7 +323,7 @@
      [Rich Salz]
 
   *) Removed obsolete engines: 4758cca, aep, atalla, cswift, nuron, gmp,
      [Rich Salz]
 
   *) Removed obsolete engines: 4758cca, aep, atalla, cswift, nuron, gmp,

-     and sureware.
+     sureware and ubsec.

      [Matt Caswell, Rich Salz]
 
   *) New ASN.1 embed macro.
      [Matt Caswell, Rich Salz]
 
   *) New ASN.1 embed macro.