Fix DTLS handshake message size checks.

[openssl.git] / apps / apps.c

diff --git a/apps/apps.c b/apps/apps.c
index 7f057fb4b2303b491e2f806ce440294bb02b556b..4eb322afbbf36ddfdf3dceb9a149c5754b98ebdb 100644 (file)
--- a/apps/apps.c
+++ b/apps/apps.c
@@ -118,7 +118,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#if !defined(OPENSSL_SYSNAME_WIN32) && !defined(NETWARE_CLIB)
+#if !defined(OPENSSL_SYSNAME_WIN32) && !defined(OPENSSL_SYSNAME_WINCE) && !defined(NETWARE_CLIB)
 #include <strings.h>
 #endif
 #include <sys/types.h>
@@ -263,6 +263,8 @@ int str2fmt(char *s)
                return(FORMAT_ASN1);
        else if ((*s == 'T') || (*s == 't'))
                return(FORMAT_TEXT);
+       else if ((strcmp(s,"NSS") == 0) || (strcmp(s,"nss") == 0))
+               return(FORMAT_NSS);
        else if ((*s == 'N') || (*s == 'n'))
                return(FORMAT_NETSCAPE);
        else if ((*s == 'S') || (*s == 's'))
@@ -392,6 +394,8 @@ int chopup_args(ARGS *arg, char *buf, int *argc, char **argv[])
                {
                arg->count=20;
                arg->data=(char **)OPENSSL_malloc(sizeof(char *)*arg->count);
+               if (arg->data == NULL)
+                       return 0;
                }
        for (i=0; i<arg->count; i++)
                arg->data[i]=NULL;
@@ -588,12 +592,12 @@ int password_callback(char *buf, int bufsiz, int verify,
 
                if (ok >= 0)
                        ok = UI_add_input_string(ui,prompt,ui_flags,buf,
-                               PW_MIN_LENGTH,BUFSIZ-1);
+                               PW_MIN_LENGTH,bufsiz-1);
                if (ok >= 0 && verify)
                        {
                        buff = (char *)OPENSSL_malloc(bufsiz);
                        ok = UI_add_verify_string(ui,prompt,ui_flags,buff,
-                               PW_MIN_LENGTH,BUFSIZ-1, buf);
+                               PW_MIN_LENGTH,bufsiz-1, buf);
                        }
                if (ok >= 0)
                        do
@@ -1661,6 +1665,8 @@ char *make_config_name()
 
        len=strlen(t)+strlen(OPENSSL_CONF)+2;
        p=OPENSSL_malloc(len);
+       if (p == NULL)
+               return NULL;
        BUF_strlcpy(p,t,len);
 #ifndef OPENSSL_SYS_VMS
        BUF_strlcat(p,"/",len);
@@ -2382,7 +2388,8 @@ int args_verify(char ***pargs, int *pargc,
        char *arg = **pargs, *argn = (*pargs)[1];
        const X509_VERIFY_PARAM *vpm = NULL;
        time_t at_time = 0;
-       const unsigned char *hostname = NULL, *email = NULL;
+       char *hostname = NULL;
+       char *email = NULL;
        char *ipasc = NULL;
        if (!strcmp(arg, "-policy"))
                {
@@ -2476,14 +2483,14 @@ int args_verify(char ***pargs, int *pargc,
                {
                if (!argn)
                        *badarg = 1;
-               hostname = (unsigned char *)argn;
+               hostname = argn;
                (*pargs)++;
                }
        else if (strcmp(arg,"-verify_email") == 0)
                {
                if (!argn)
                        *badarg = 1;
-               email = (unsigned char *)argn;
+               email = argn;
                (*pargs)++;
                }
        else if (strcmp(arg,"-verify_ip") == 0)
@@ -2527,6 +2534,8 @@ int args_verify(char ***pargs, int *pargc,
                flags |= X509_V_FLAG_SUITEB_128_LOS;
        else if (!strcmp(arg, "-suiteB_192"))
                flags |= X509_V_FLAG_SUITEB_192_LOS;
+       else if (!strcmp(arg, "-partial_chain"))
+               flags |= X509_V_FLAG_PARTIAL_CHAIN;
        else
                return 0;
 
@@ -2862,6 +2871,9 @@ void jpake_client_auth(BIO *out, BIO *conn, const char *secret)
 
        BIO_puts(out, "JPAKE authentication succeeded, setting PSK\n");
 
+       if (psk_key)
+               OPENSSL_free(psk_key);
+
        psk_key = BN_bn2hex(JPAKE_get_shared_key(ctx));
 
        BIO_pop(bconn);
@@ -2891,6 +2903,9 @@ void jpake_server_auth(BIO *out, BIO *conn, const char *secret)
 
        BIO_puts(out, "JPAKE authentication succeeded, setting PSK\n");
 
+       if (psk_key)
+               OPENSSL_free(psk_key);
+
        psk_key = BN_bn2hex(JPAKE_get_shared_key(ctx));
 
        BIO_pop(bconn);
@@ -2901,7 +2916,7 @@ void jpake_server_auth(BIO *out, BIO *conn, const char *secret)
 
 #endif
 
-#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
+#ifndef OPENSSL_NO_TLSEXT
 /* next_protos_parse parses a comma separated list of strings into a string
  * in a format suitable for passing to SSL_CTX_set_next_protos_advertised.
  *   outlen: (output) set to the length of the resulting buffer on success.
@@ -2943,11 +2958,11 @@ unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
        *outlen = len + 1;
        return out;
        }
-#endif  /* !OPENSSL_NO_TLSEXT && !OPENSSL_NO_NEXTPROTONEG */
+#endif  /* ndef OPENSSL_NO_TLSEXT */
 
 void print_cert_checks(BIO *bio, X509 *x,
-                               const unsigned char *checkhost,
-                               const unsigned char *checkemail,
+                               const char *checkhost,
+                               const char *checkemail,
                                const char *checkip)
        {
        if (x == NULL)
@@ -2955,7 +2970,8 @@ void print_cert_checks(BIO *bio, X509 *x,
        if (checkhost)
                {
                BIO_printf(bio, "Hostname %s does%s match certificate\n",
-                               checkhost, X509_check_host(x, checkhost, 0, 0)
+                               checkhost,
+                               X509_check_host(x, checkhost, 0, 0, NULL)
                                                ? "" : " NOT");
                }
 
@@ -3125,7 +3141,7 @@ double app_tminterval(int stop,int usertime)
 
        if (proc==NULL)
                {
-               if (GetVersion() < 0x80000000)
+               if (check_winnt())
                        proc = OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,
                                                GetCurrentProcessId());
                if (proc==NULL) proc = (HANDLE)-1;