openssl.git
4 years agocheck for error when creating PKCS#8 structure
Dr. Stephen Henson [Thu, 28 May 2015 14:44:20 +0000 (15:44 +0100)]
check for error when creating PKCS#8 structure

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 2849707fa65d2803e6d1c1603fdd3fd1fdc4c6cc)

4 years agoPEM doc fixes
Dr. Stephen Henson [Thu, 28 May 2015 14:45:57 +0000 (15:45 +0100)]
PEM doc fixes

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit f097f81c891bb1f479426d8ac9c9541390334983)

4 years agoHousekeeping 'make TABLE' update.
Andy Polyakov [Tue, 26 May 2015 08:36:56 +0000 (10:36 +0200)]
Housekeeping 'make TABLE' update.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoFix ssltest to use 1024-bit DHE parameters
Emilia Kasper [Fri, 22 May 2015 16:35:50 +0000 (18:35 +0200)]
Fix ssltest to use 1024-bit DHE parameters

Also add more ciphersuite test coverage, and a negative test for
512-bit DHE.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoDon't check for a negative SRP extension size
Matt Caswell [Mon, 25 May 2015 23:05:28 +0000 (00:05 +0100)]
Don't check for a negative SRP extension size

The size of the SRP extension can never be negative (the variable
|size| is unsigned). Therefore don't check if it is less than zero.

RT#3862

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 9c89d290834f3ed9146eeb8b64fe5de817679a0b)

4 years agoFix error check in GOST engine
Matt Caswell [Mon, 25 May 2015 23:02:57 +0000 (00:02 +0100)]
Fix error check in GOST engine

The return value of i2d functions can be negative if an error occurs.
Therefore don't assign the return value to an unsigned type and *then*
check if it is negative.

RT#3862

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 90e7cdff3aa66779486914f88333f6601f0c1cf4)

4 years agoHandle unsigned struct timeval members
Matt Caswell [Mon, 25 May 2015 22:57:41 +0000 (23:57 +0100)]
Handle unsigned struct timeval members

The members of struct timeval on OpenVMS are unsigned. The logic for
calculating timeouts needs adjusting to deal with this.

RT#3862

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit fc52ac9028b9492fb086ba35a3352ea46e03ecfc)

4 years agoConfigure: replace -mv8 with -mcpu=v8 in SPARC config lines.
Andy Polyakov [Tue, 26 May 2015 07:47:16 +0000 (09:47 +0200)]
Configure: replace -mv8 with -mcpu=v8 in SPARC config lines.

RT#3860

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit aa1e42215b6729c0143fb056e3791e3fcdf7af6a)

4 years agofix copy paste error in ec_GF2m function prototypes
Billy Brumley [Fri, 22 May 2015 14:44:49 +0000 (17:44 +0300)]
fix copy paste error in ec_GF2m function prototypes

RT#3858

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 71f6130b7a96bacbffae4611796ed98c2f724d96)

4 years agobn/bn_lcl.h: fix MIPS-specific gcc version check.
Andy Polyakov [Mon, 25 May 2015 08:17:14 +0000 (10:17 +0200)]
bn/bn_lcl.h: fix MIPS-specific gcc version check.

RT#3859

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 60c268b21ac81cc6b1af5c5470282a613b96f6fd)

4 years agomd32_common.h: backport ICC fix.
Andy Polyakov [Sun, 24 May 2015 20:51:12 +0000 (22:51 +0200)]
md32_common.h: backport ICC fix.

RT#3843

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoDon't send an alert if we've just received one
Matt Caswell [Sat, 23 May 2015 20:51:21 +0000 (21:51 +0100)]
Don't send an alert if we've just received one

If the record received is for a version that we don't support, previously we
were sending an alert back. However if the incoming record already looks
like an alert then probably we shouldn't do that. So suppress an outgoing
alert if it looks like we've got one incoming.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
4 years agoFix update and depend in engines/
Richard Levitte [Sat, 23 May 2015 04:33:41 +0000 (06:33 +0200)]
Fix update and depend in engines/

The update: target in engines/ didn't recurse into engines/ccgost.
The update: and depend: targets in engines/ccgost needed a fixup.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 8b822d2566853ee5e313c37529f71336209b28ab)

4 years agoMissed a couple of spots in the update change
Richard Levitte [Fri, 22 May 2015 17:23:43 +0000 (19:23 +0200)]
Missed a couple of spots in the update change

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 6f45032f6730622e8d484d92e07c7fce7d1f88ac)

Conflicts:
apps/Makefile

4 years agoFix the update target and remove duplicate file updates
Richard Levitte [Fri, 22 May 2015 15:54:06 +0000 (17:54 +0200)]
Fix the update target and remove duplicate file updates

We had updates of certain header files in both Makefile.org and the
Makefile in the directory the header file lived in.  This is error
prone and also sometimes generates slightly different results (usually
just a comment that differs) depending on which way the update was
done.

This removes the file update targets from the top level Makefile, adds
an update: target in all Makefiles and has it depend on the depend: or
local_depend: targets, whichever is appropriate, so we don't get a
double run through the whole file tree.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 0f539dc1a2f45580435c39dada44dd276e79cb88)

Conflicts:
Makefile.org
apps/Makefile
test/Makefile

4 years agoFix off-by-one in BN_rand
Matt Caswell [Tue, 19 May 2015 15:03:02 +0000 (16:03 +0100)]
Fix off-by-one in BN_rand

If BN_rand is called with |bits| set to 1 and |top| set to 1 then a 1 byte
buffer overflow can occur. There are no such instances within the OpenSSL at
the moment.

Thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke, Filip Palian for
discovering and reporting this issue.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
4 years agoReject negative shifts for BN_rshift and BN_lshift
Matt Caswell [Tue, 19 May 2015 14:19:30 +0000 (15:19 +0100)]
Reject negative shifts for BN_rshift and BN_lshift

The functions BN_rshift and BN_lshift shift their arguments to the right or
left by a specified number of bits. Unpredicatable results (including
crashes) can occur if a negative number is supplied for the shift value.

Thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke and Filip Palian
for discovering and reporting this issue.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 7cc18d8158b5fc2676393d99b51c30c135502107)

Conflicts:
crypto/bn/bn.h
crypto/bn/bn_err.c

4 years agoLost alert in DTLS
Lubom [Thu, 7 May 2015 13:20:31 +0000 (14:20 +0100)]
Lost alert in DTLS

If a client receives a bad hello request in DTLS then the alert is not
sent correctly.

RT#2801

Signed-off-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 4dc1aa0436fdb8af50960db676b739c8ef81f38c)

4 years agoAdd documentation for the -no_alt_chains option for various apps, as well as the...
Matt Caswell [Tue, 27 Jan 2015 11:15:15 +0000 (11:15 +0000)]
Add documentation for the -no_alt_chains option for various apps, as well as the X509_V_FLAG_NO_ALT_CHAINS flag.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Conflicts:
doc/apps/cms.pod
doc/apps/ocsp.pod
doc/apps/s_client.pod
doc/apps/s_server.pod
doc/apps/smime.pod
doc/apps/verify.pod

4 years agoAdd -no_alt_chains option to apps to implement the new X509_V_FLAG_NO_ALT_CHAINS...
Matt Caswell [Tue, 27 Jan 2015 10:50:38 +0000 (10:50 +0000)]
Add -no_alt_chains option to apps to implement the new X509_V_FLAG_NO_ALT_CHAINS flag. Using this option means that when building certificate chains, the first chain found will be the one used. Without this flag, if the first chain found is not trusted then we will keep looking to see if we can build an alternative chain instead.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Conflicts:
apps/cms.c
apps/ocsp.c
apps/s_client.c
apps/s_server.c
apps/smime.c
apps/verify.c

4 years agoAdd flag to inhibit checking for alternate certificate chains. Setting this behaviour...
Matt Caswell [Tue, 27 Jan 2015 10:35:27 +0000 (10:35 +0000)]
Add flag to inhibit checking for alternate certificate chains. Setting this behaviour will force behaviour as per previous versions of OpenSSL

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
4 years agoIn certain situations the server provided certificate chain may no longer be valid...
Matt Caswell [Tue, 27 Jan 2015 10:03:29 +0000 (10:03 +0000)]
In certain situations the server provided certificate chain may no longer be valid. However the issuer of the leaf, or some intermediate cert is in fact in the trust store.

When building a trust chain if the first attempt fails, then try to see if
alternate chains could be constructed that are trusted.

RT3637
RT3621

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
4 years agoCorrectly check for export size limit
Kurt Roeckx [Sat, 18 Apr 2015 10:50:25 +0000 (12:50 +0200)]
Correctly check for export size limit

40 bit ciphers are limited to 512 bit RSA, 56 bit ciphers to 1024 bit.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit ac38115c1a4fb61c66c2a8cd2a9800751828d328)

4 years agoclient: reject handshakes with DH parameters < 768 bits.
Emilia Kasper [Tue, 19 May 2015 10:05:22 +0000 (12:05 +0200)]
client: reject handshakes with DH parameters < 768 bits.

Since the client has no way of communicating her supported parameter
range to the server, connections to servers that choose weak DH will
simply fail.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
4 years agoUpdate documentation with Diffie-Hellman best practices.
Emilia Kasper [Tue, 12 May 2015 14:10:05 +0000 (16:10 +0200)]
Update documentation with Diffie-Hellman best practices.
- Do not advise generation of DH parameters with dsaparam to save
computation time.
- Promote use of custom parameters more, and explicitly forbid use of
built-in parameters weaker than 2048 bits.
- Advise the callback to ignore <keylength> - it is currently called
with 1024 bits, but this value can and should be safely ignored by
servers.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agodhparam: fix documentation
Emilia Kasper [Wed, 13 May 2015 10:05:41 +0000 (12:05 +0200)]
dhparam: fix documentation

The default bitlength is now 2048. Also clarify that either the number
of bits or the generator must be present:

$ openssl dhparam -2
and
$ openssl dhparam 2048
generate parameters but
$ openssl dhparam
does not.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agodhparam: set the default to 2048 bits
Emilia Kasper [Wed, 13 May 2015 09:57:55 +0000 (11:57 +0200)]
dhparam: set the default to 2048 bits

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
4 years agos_server: Use 2048-bit DH parameters by default.
Emilia Kasper [Tue, 12 May 2015 18:15:46 +0000 (20:15 +0200)]
s_server: Use 2048-bit DH parameters by default.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoGitHub284: Fix typo in xx-32.pl scripts.
StudioEtrange [Wed, 20 May 2015 08:35:39 +0000 (04:35 -0400)]
GitHub284: Fix typo in xx-32.pl scripts.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoDon't add write errors into bytecounts
Robert Swiecki [Mon, 18 May 2015 23:08:02 +0000 (19:08 -0400)]
Don't add write errors into bytecounts

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 00d565cfbe90fab3b157e644caca4eb4a2ebec79)

4 years agomk1mf.pl: replace chop for windows.
Andy Polyakov [Sun, 15 Jul 2012 13:40:04 +0000 (13:40 +0000)]
mk1mf.pl: replace chop for windows.

Backport old patch to make it work in mixture of perls for Windows.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Cherry-picked from 7bb98eee3c9e4694dfc2217001d5075ce8d2906e

(cherry picked from commit 051b41df4105355a5a9c7f1c0bd00cc70b2d324c)

4 years agoAdd NULL checks from master
Rich Salz [Tue, 12 May 2015 15:49:32 +0000 (11:49 -0400)]
Add NULL checks from master

The big "don't check for NULL" cleanup requires backporting some
of the lowest-level functions to actually do nothing if NULL is
given.  This will make it easier to backport fixes to release
branches, where master assumes those lower-level functions are "safe"

This commit addresses those tickets: 3798 3799 3801.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit f34b095fab1569d093b639bfcc9a77d6020148ff)

4 years agoCall of memcmp with null pointers in obj_cmp()
Hanno Böck [Mon, 11 May 2015 10:33:37 +0000 (11:33 +0100)]
Call of memcmp with null pointers in obj_cmp()

The function obj_cmp() (file crypto/objects/obj_dat.c) can in some
situations call memcmp() with a null pointer and a zero length.

This is invalid behaviour. When compiling openssl with undefined
behaviour sanitizer (add -fsanitize=undefined to compile flags) this
can be seen. One example that triggers this behaviour is the pkcs7
command (but there are others, e.g. I've seen it with the timestamp
function):
apps/openssl pkcs7 -in test/testp7.pem

What happens is that obj_cmp takes objects of the type ASN1_OBJECT and
passes their ->data pointer to memcmp. Zero-sized ASN1_OBJECT
structures can have a null pointer as data.

RT#3816

Signed-off-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 2b8dc08b74fc3c6d4c2fc855cc23bac691d985be)

4 years agoDon't allow a CCS when expecting a CertificateVerify
Matt Caswell [Wed, 6 May 2015 20:31:16 +0000 (21:31 +0100)]
Don't allow a CCS when expecting a CertificateVerify

Currently we set change_cipher_spec_ok to 1 before calling
ssl3_get_cert_verify(). This is because this message is optional and if it
is not sent then the next thing we would expect to get is the CCS. However,
although it is optional, we do actually know whether we should be receiving
one in advance. If we have received a client cert then we should expect
a CertificateVerify message. By the time we get to this point we will
already have bombed out if we didn't get a Certificate when we should have
done, so it is safe just to check whether |peer| is NULL or not. If it is
we won't get a CertificateVerify, otherwise we will. Therefore we should
change the logic so that we only attempt to get the CertificateVerify if
we are expecting one, and not allow a CCS in this scenario.

Whilst this is good practice for TLS it is even more important for DTLS.
In DTLS messages can be lost. Therefore we may be in a situation where a
CertificateVerify message does not arrive even though one was sent. In that
case the next message the server will receive will be the CCS. This could
also happen if messages get re-ordered in-flight. In DTLS if
|change_cipher_spec_ok| is not set and a CCS is received it is ignored.
However if |change_cipher_spec_ok| *is* set then a CCS arrival will
immediately move the server into the next epoch. Any messages arriving for
the previous epoch will be ignored. This means that, in this scenario, the
handshake can never complete. The client will attempt to retransmit
missing messages, but the server will ignore them because they are the wrong
epoch. The server meanwhile will still be waiting for the CertificateVerify
which is never going to arrive.

RT#2958

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit a0bd6493369d960abef11c2346b9bbb308b4285a)

4 years agoAdd missing NULL check in X509V3_parse_list()
Kurt Cancemi [Thu, 7 May 2015 20:12:33 +0000 (16:12 -0400)]
Add missing NULL check in X509V3_parse_list()

Matt's note: I added a call to X509V3err to Kurt's original patch.

RT#3840

Signed-off-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 344c271eb339fc2982e9a3584a94e51112d84584)

4 years agoFix for memcpy() and strcmp() being undefined.
Bjoern D. Rasmussen [Sun, 10 May 2015 05:51:29 +0000 (07:51 +0200)]
Fix for memcpy() and strcmp() being undefined.

clang says: "s_cb.c:958:9: error: implicitly declaring library function
'memcpy'"

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 8f744cceff5bce8cb00a6ddd739c1bbb85c142ea)

Conflicts:
apps/s_cb.c

4 years agoCheck sk_SSL_CIPHER_new_null return value
Matt Caswell [Sat, 9 May 2015 05:51:25 +0000 (13:51 +0800)]
Check sk_SSL_CIPHER_new_null return value

If sk_SSL_CIPHER_new_null() returns NULL then ssl_bytes_to_cipher_list()
should also return NULL.

Based on an original patch by mrpre <mrpre@163.com>.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 14def5f5375594830597cc153e11c6017f6adddf)

4 years agoAdd more error state transitions (DTLS)
Matt Caswell [Thu, 30 Apr 2015 10:50:08 +0000 (11:50 +0100)]
Add more error state transitions (DTLS)

Ensure all fatal errors transition into the new error state for DTLS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit cefc93910c4c0f7fa9f8c1f8f7aad084a7fa87d2)

Conflicts:
ssl/d1_srvr.c

Conflicts:
ssl/d1_srvr.c

4 years agoAdd more error state transitions (client)
Matt Caswell [Thu, 30 Apr 2015 10:32:35 +0000 (11:32 +0100)]
Add more error state transitions (client)

Ensure all fatal errors transition into the new error state on the client
side.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit cc273a93617a5c1e69cb5db6f655e463f8e31806)

Conflicts:
ssl/s3_clnt.c

Conflicts:
ssl/s3_clnt.c

4 years agoAdd more error state transitions
Matt Caswell [Thu, 30 Apr 2015 10:11:04 +0000 (11:11 +0100)]
Add more error state transitions

Ensure all fatal errors transition into the new error state on the server
side.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit cf9b0b6fb253fd40225d7c648a08646686e62d2d)

Conflicts:
ssl/s3_srvr.c

4 years agoAdd Error state
Matt Caswell [Thu, 23 Apr 2015 19:01:33 +0000 (20:01 +0100)]
Add Error state

Reusing an SSL object when it has encountered a fatal error can
have bad consequences. This is a bug in application code not libssl
but libssl should be more forgiving and not crash.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit a89db885e0d8aac3a9df1bbccb0c1ddfd8b2e10a)

Conflicts:
ssl/s3_srvr.c
ssl/ssl_stat.c

4 years agoRT2943: Check sizes if -iv and -K arguments
Richard Levitte [Mon, 4 May 2015 15:34:40 +0000 (17:34 +0200)]
RT2943: Check sizes if -iv and -K arguments

RT2943 only complains about the incorrect check of -K argument size,
we might as well do the same thing with the -iv argument.

Before this, we only checked that the given argument wouldn't give a
bitstring larger than EVP_MAX_KEY_LENGTH.  we can be more precise and
check against the size of the actual cipher used.

(cherry picked from commit 8920a7cd04f43b1a090d0b0a8c9e16b94c6898d4)

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoRT3820: Don't call GetDesktopWindow()
Gilles Khouzam [Sat, 2 May 2015 02:20:42 +0000 (22:20 -0400)]
RT3820: Don't call GetDesktopWindow()

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit bed2edf1cb73f1fe2c11029acc694086bc14443e)

4 years agoFix uninitialized variable.
Hanno Böck [Sat, 2 May 2015 02:27:20 +0000 (22:27 -0400)]
Fix uninitialized variable.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(cherry picked from commit 539ed89f686866b82a9ec9a4c3b112878d29cd73)

4 years agoFix buffer overrun in RSA signing
Matt Caswell [Wed, 29 Apr 2015 12:22:18 +0000 (13:22 +0100)]
Fix buffer overrun in RSA signing

The problem occurs in EVP_PKEY_sign() when using RSA with X931 padding.
It is only triggered if the RSA key size is smaller than the digest length.
So with SHA512 you can trigger the overflow with anything less than an RSA
512 bit key. I managed to trigger a 62 byte overflow when using a 16 bit RSA
key. This wasn't sufficient to cause a crash, although your mileage may
vary.

In practice RSA keys of this length are never used and X931 padding is very
rare. Even if someone did use an excessively short RSA key, the chances of
them combining that with a longer digest and X931 padding is very
small. For these reasons I do not believe there is a security implication to
this. Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3
Solutions) for reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 34166d41892643a36ad2d1f53cc0025e2edc2a39)

4 years agoAdd sanity check to print_bin function
Matt Caswell [Wed, 29 Apr 2015 08:58:10 +0000 (09:58 +0100)]
Add sanity check to print_bin function

Add a sanity check to the print_bin function to ensure that the |off|
argument is positive. Thanks to Kevin Wojtysiak (Int3 Solutions) and
Paramjot Oberoi (Int3 Solutions) for reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 3deeeeb61b0c5b9b5f0993a67b7967d2f85186da)

4 years agoAdd sanity check to ssl_get_prev_session
Matt Caswell [Tue, 28 Apr 2015 14:28:23 +0000 (15:28 +0100)]
Add sanity check to ssl_get_prev_session

Sanity check the |len| parameter to ensure it is positive. Thanks to Kevin
Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3 Solutions) for
reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit cb0f400b0cea2d2943f99b1e89c04ff6ed748cd5)

4 years agoSanity check the return from final_finish_mac
Matt Caswell [Tue, 28 Apr 2015 14:19:50 +0000 (15:19 +0100)]
Sanity check the return from final_finish_mac

The return value is checked for 0. This is currently safe but we should
really check for <= 0 since -1 is frequently used for error conditions.
Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3
Solutions) for reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit c427570e5098e120cbcb66e799f85c317aac7b91)

Conflicts:
ssl/ssl_locl.h

Conflicts:
ssl/ssl_locl.h

4 years agoAdd sanity check in ssl3_cbc_digest_record
Matt Caswell [Mon, 27 Apr 2015 14:41:42 +0000 (15:41 +0100)]
Add sanity check in ssl3_cbc_digest_record

For SSLv3 the code assumes that |header_length| > |md_block_size|. Whilst
this is true for all SSLv3 ciphersuites, this fact is far from obvious by
looking at the code. If this were not the case then an integer overflow
would occur, leading to a subsequent buffer overflow. Therefore I have
added an explicit sanity check to ensure header_length is always valid.
Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3
Solutions) for reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 29b0a15a480626544dd0c803d5de671552544de6)

4 years agoClarify logic in BIO_*printf functions
Matt Caswell [Mon, 27 Apr 2015 14:41:03 +0000 (15:41 +0100)]
Clarify logic in BIO_*printf functions

The static function dynamically allocates an output buffer if the output
grows larger than the static buffer that is normally used. The original
logic implied that |currlen| could be greater than |maxlen| which is
incorrect (and if so would cause a buffer overrun). Also the original
logic would call OPENSSL_malloc to create a dynamic buffer equal to the
size of the static buffer, and then immediately call OPENSSL_realloc to
make it bigger, rather than just creating a buffer than was big enough in
the first place. Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot
Oberoi (Int3 Solutions) for reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 9d9e37744cd5119f9921315864d1cd28717173cd)

4 years agoSanity check EVP_EncodeUpdate buffer len
Matt Caswell [Mon, 27 Apr 2015 10:13:56 +0000 (11:13 +0100)]
Sanity check EVP_EncodeUpdate buffer len

There was already a sanity check to ensure the passed buffer length is not
zero. Extend this to ensure that it also not negative. Thanks to Kevin
Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3 Solutions) for
reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit b86d7dca69f5c80abd60896c8ed3039fc56210cc)

4 years agoSanity check EVP_CTRL_AEAD_TLS_AAD
Matt Caswell [Mon, 27 Apr 2015 10:07:06 +0000 (11:07 +0100)]
Sanity check EVP_CTRL_AEAD_TLS_AAD

The various implementations of EVP_CTRL_AEAD_TLS_AAD expect a buffer of at
least 13 bytes long. Add sanity checks to ensure that the length is at
least that. Also add a new constant (EVP_AEAD_TLS1_AAD_LEN) to evp.h to
represent this length. Thanks to Kevin Wojtysiak (Int3 Solutions) and
Paramjot Oberoi (Int3 Solutions) for reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit c8269881093324b881b81472be037055571f73f3)

Conflicts:
ssl/record/ssl3_record.c

Conflicts:
apps/speed.c
crypto/evp/e_aes_cbc_hmac_sha256.c
crypto/evp/evp.h

4 years agoSanity check DES_enc_write buffer length
Matt Caswell [Mon, 27 Apr 2015 10:04:56 +0000 (11:04 +0100)]
Sanity check DES_enc_write buffer length

Add a sanity check to DES_enc_write to ensure the buffer length provided
is not negative. Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot
Oberoi (Int3 Solutions) for reporting this issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 873fb39f20b6763daba226b74e83fb194924c7bf)

4 years agoAdd length sanity check in SSLv2 n_do_ssl_write()
Matt Caswell [Wed, 29 Apr 2015 15:15:40 +0000 (16:15 +0100)]
Add length sanity check in SSLv2 n_do_ssl_write()

Fortify flagged up a problem in n_do_ssl_write() in SSLv2. Analysing the
code I do not believe there is a real problem here. However the logic flows
are complicated enough that a sanity check of |len| is probably worthwhile.

Thanks to Kevin Wojtysiak (Int3 Solutions) and Paramjot Oberoi (Int3
Solutions) for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit c5f8cd7bc661f90dc012c9d2bae1808a4281985f)

4 years agoFix CRYPTO_strdup
Loganaden Velvindron [Wed, 22 Apr 2015 15:16:30 +0000 (16:16 +0100)]
Fix CRYPTO_strdup

The function CRYPTO_strdup (aka OPENSSL_strdup) fails to check the return
value from CRYPTO_malloc to see if it is NULL before attempting to use it.
This patch adds a NULL check.

RT3786

Signed-off-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 37b0cf936744d9edb99b5dd82cae78a7eac6ad60)

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 20d21389c8b6f5b754573ffb6a4dc4f3986f2ca4)

4 years agoRepair EAP-FAST session resumption
Emilia Kasper [Tue, 21 Apr 2015 16:12:58 +0000 (18:12 +0200)]
Repair EAP-FAST session resumption

EAP-FAST session resumption relies on handshake message lookahead
to determine server intentions. Commits
980bc1ec6114f5511b20c2e6ca741e61a39b99d6
and
7b3ba508af5c86afe43e28174aa3c53a0a24f4d9
removed the lookahead so broke session resumption.

This change partially reverts the commits and brings the lookahead back
in reduced capacity for TLS + EAP-FAST only. Since EAP-FAST does not
support regular session tickets, the lookahead now only checks for a
Finished message.

Regular handshakes are unaffected by this change.

Reviewed-by: David Benjamin <davidben@chromium.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 6e3d015363ed09c4eff5c02ad41153387ffdf5af)

4 years agoInitialize variable
Emilia Kasper [Tue, 14 Apr 2015 15:42:42 +0000 (17:42 +0200)]
Initialize variable

newsig may be used (freed) uninitialized on a malloc error.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 68249414405500660578b337f1c8dd5dd4bb5bcc)

4 years agomake update
Emilia Kasper [Thu, 16 Apr 2015 16:11:56 +0000 (18:11 +0200)]
make update

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
4 years agoInitialised 'ok' and redo the logic.
Richard Levitte [Wed, 25 Mar 2015 13:41:58 +0000 (14:41 +0100)]
Initialised 'ok' and redo the logic.

The logic with how 'ok' was calculated didn't quite convey what's "ok",
so the logic is slightly redone to make it less confusing.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 06affe3dac65592a341547f5a47e52cedb7b71f8)

4 years agoFix return checks in GOST engine
Matt Caswell [Fri, 13 Mar 2015 16:48:01 +0000 (16:48 +0000)]
Fix return checks in GOST engine

Filled in lots of return value checks that were missing the GOST engine, and
added appropriate error handling.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 8817e2e0c998757d3bd036d7f45fe8d0a49fbe2d)

4 years agoFix misc NULL derefs in sureware engine
Matt Caswell [Fri, 13 Mar 2015 15:04:54 +0000 (15:04 +0000)]
Fix misc NULL derefs in sureware engine

Fix miscellaneous NULL pointer derefs in the sureware engine.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 7b611e5fe8eaac9512f72094c460f3ed6040076a)

4 years agoFix encoding bug in i2c_ASN1_INTEGER
Dr. Stephen Henson [Thu, 16 Apr 2015 15:43:09 +0000 (16:43 +0100)]
Fix encoding bug in i2c_ASN1_INTEGER

Fix bug where i2c_ASN1_INTEGER mishandles zero if it is marked as
negative.

Thanks to Huzaifa Sidhpurwala <huzaifas@redhat.com> and
Hanno Böck <hanno@hboeck.de> for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit a0eed48d37a4b7beea0c966caf09ad46f4a92a44)

4 years agoError out immediately on empty ciphers list.
Emilia Kasper [Wed, 15 Apr 2015 12:18:55 +0000 (14:18 +0200)]
Error out immediately on empty ciphers list.

A 0-length ciphers list is never permitted. The old code only used to
reject an empty ciphers list for connections with a session ID. It
would later error out on a NULL structure, so this change just moves
the alert closer to the problem source.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 3ae91cfb327c9ed689b9aaf7bca01a3f5a0657cb)

4 years agoCode style: space after 'if'
Viktor Dukhovni [Thu, 16 Apr 2015 06:51:52 +0000 (02:51 -0400)]
Code style: space after 'if'

Reviewed-by: Matt Caswell <gitlab@openssl.org>
4 years agoPlease Clang's sanitizer, addendum.
Andy Polyakov [Tue, 8 Jul 2014 21:06:59 +0000 (23:06 +0200)]
Please Clang's sanitizer, addendum.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoLimit depth of nested sequences when generating ASN.1
Dr. Stephen Henson [Wed, 15 Apr 2015 23:00:40 +0000 (00:00 +0100)]
Limit depth of nested sequences when generating ASN.1

Reported by Hanno Böck <hanno@hboeck.de>
PR#3800

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit c4137b5e828d8fab0b244defb79257619dad8fc7)

4 years agoReject empty generation strings.
Dr. Stephen Henson [Wed, 15 Apr 2015 23:21:05 +0000 (00:21 +0100)]
Reject empty generation strings.

Reported by Hanno Böck <hanno@hboeck.de>

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 111b60bea01d234b5873488c19ff2b9c5d4d58e9)

4 years agoFix ssl_get_prev_session overrun
Matt Caswell [Fri, 10 Apr 2015 15:49:33 +0000 (16:49 +0100)]
Fix ssl_get_prev_session overrun

If OpenSSL is configured with no-tlsext then ssl_get_prev_session can read
past the end of the ClientHello message if the session_id length in the
ClientHello is invalid. This should not cause any security issues since the
underlying buffer is 16k in size. It should never be possible to overrun by
that many bytes.

This is probably made redundant by the previous commit - but you can never be
too careful.

With thanks to Qinghao Tang for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 5e0a80c1c9b2b06c2d203ad89778ce1b98e0b5ad)

4 years agoCheck for ClientHello message overruns
Matt Caswell [Fri, 10 Apr 2015 16:25:27 +0000 (17:25 +0100)]
Check for ClientHello message overruns

The ClientHello processing is insufficiently rigorous in its checks to make
sure that we don't read past the end of the message. This does not have
security implications due to the size of the underlying buffer - but still
needs to be fixed.

With thanks to Qinghao Tang for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit c9642eb1ff79a30e2c7632ef8267cc34cc2b0d79)

4 years agodo_dirname: Don't change gen on failures
Kurt Roeckx [Sat, 11 Apr 2015 14:39:13 +0000 (16:39 +0200)]
do_dirname: Don't change gen on failures

It would set gen->d.dirn to a freed pointer in case X509V3_NAME_from_section
failed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 8ec5c5dd361343d9017eff8547b19e86e4944ebc)

4 years agoX509_VERIFY_PARAM_free: Check param for NULL
Kurt Roeckx [Sat, 11 Apr 2015 15:08:38 +0000 (17:08 +0200)]
X509_VERIFY_PARAM_free: Check param for NULL

Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
(cherry picked from commit f49baeff50d0be9c8d86aed6fb4a08841aa3da41)

4 years agoDon't set *pval to NULL in ASN1_item_ex_new.
Dr. Stephen Henson [Thu, 2 Apr 2015 12:45:14 +0000 (13:45 +0100)]
Don't set *pval to NULL in ASN1_item_ex_new.

While *pval is usually a pointer in rare circumstances it can be a long
value. One some platforms (e.g. WIN64) where
sizeof(long) < sizeof(ASN1_VALUE *) this will write past the field.

*pval is initialised correctly in the rest of ASN1_item_ex_new so setting it
to NULL is unecessary anyway.

Thanks to Julien Kauffmann for reporting this issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit f617b4969a9261b9d7d381670aefbe2cf766a2cb)

Conflicts:
crypto/asn1/tasn_new.c

4 years agoHave mkerr.pl treat already existing multiline string defs properly
Richard Levitte [Wed, 8 Apr 2015 17:26:11 +0000 (19:26 +0200)]
Have mkerr.pl treat already existing multiline string defs properly

Since source reformat, we ended up with some error reason string
definitions that spanned two lines.  That in itself is fine, but we
sometimes edited them to provide better strings than what could be
automatically determined from the reason macro, for example:

    {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER),
     "Peer haven't sent GOST certificate, required for selected ciphersuite"},

However, mkerr.pl didn't treat those two-line definitions right, and
they ended up being retranslated to whatever the macro name would
indicate, for example:

    {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER),
     "No gost certificate sent by peer"},

Clearly not what we wanted.  This change fixes this problem.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 2cfdfe0918f03f8323c9523a2beb2b363ae86ca7)

4 years agoIgnore the non-dll windows specific build directories
Richard Levitte [Wed, 1 Apr 2015 09:36:18 +0000 (11:36 +0200)]
Ignore the non-dll windows specific build directories

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 37d92b1b2bb6e6e04d62d6f7774a2d8190a99174)

4 years agoHarden SSLv2-supporting servers against Bleichenbacher's attack.
Emilia Kasper [Wed, 1 Apr 2015 15:08:45 +0000 (17:08 +0200)]
Harden SSLv2-supporting servers against Bleichenbacher's attack.

There is no indication that the timing differences are exploitable in
OpenSSL, and indeed there is some indication (Usenix '14) that they
are too small to be exploitable. Nevertheless, be careful and apply
the same countermeasures as in s3_srvr.c

Thanks to Nimrod Aviram, Sebastian Schinzel and Yuval Shavitt for
reporting this issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit ae50d8270026edf5b3c7f8aaa0c6677462b33d97)

4 years agoFix intermittent s_server issues with ECDHE
John Foley [Tue, 7 Apr 2015 22:05:05 +0000 (23:05 +0100)]
Fix intermittent s_server issues with ECDHE

Resolve a problem when using s_server with ECDHE cipher
suites in OpenSSL_1_0_1-stable.  Due to an uninitialized variable,
SSL_CTX_set_tmp_ecdh() is not always invoked within s_server. This bug
appears to have been introduced by
059907771b89549cbd07a81df1a5bdf51e062066.

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoEnsure EC private keys retain leading zeros
Douglas E Engert [Wed, 25 Mar 2015 23:52:28 +0000 (23:52 +0000)]
Ensure EC private keys retain leading zeros

RFC5915 requires the use of the I2OSP primitive as defined in RFC3447
for storing an EC Private Key. This converts the private key into an
OCTETSTRING and retains any leading zeros. This commit ensures that those
leading zeros are present if required.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 30cd4ff294252c4b6a4b69cbef6a5b4117705d22)

Conflicts:
crypto/ec/ec_asn1.c

4 years agoFix uninitialized variable warning
Emilia Kasper [Tue, 24 Mar 2015 18:59:14 +0000 (19:59 +0100)]
Fix uninitialized variable warning

While a true positive, it's almost harmless because EVP_DecryptInit_ex would have to fail and that doesn't happen under normal operation.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix bug in s_client. Previously default verify locations would only be loaded
Matt Caswell [Wed, 25 Feb 2015 11:30:43 +0000 (11:30 +0000)]
Fix bug in s_client. Previously default verify locations would only be loaded
if CAfile or CApath were also supplied and successfully loaded first.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 70e5fd877890489a3972bf8bf50bfec1fca3875e)

4 years agoFix HMAC to pass invalid key len test
Matt Caswell [Tue, 10 Feb 2015 13:15:25 +0000 (13:15 +0000)]
Fix HMAC to pass invalid key len test

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoAdd HMAC test for invalid key len
Matt Caswell [Tue, 10 Feb 2015 13:15:05 +0000 (13:15 +0000)]
Add HMAC test for invalid key len

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoEnsure that both the MD and key have been initialised before attempting to
Matt Caswell [Tue, 10 Feb 2015 11:39:52 +0000 (11:39 +0000)]
Ensure that both the MD and key have been initialised before attempting to
create an HMAC

Inspired by BoringSSL commit 2fe7f2d0d9a6fcc75b4e594eeec306cc55acd594

Reviewed-by: Richard Levitte <levitte@openssl.org>
Conflicts:
crypto/hmac/hmac.c

4 years agoAdd more HMAC tests
Matt Caswell [Tue, 10 Feb 2015 12:38:04 +0000 (12:38 +0000)]
Add more HMAC tests

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix RAND_(pseudo_)?_bytes returns
Matt Caswell [Thu, 26 Feb 2015 16:28:59 +0000 (16:28 +0000)]
Fix RAND_(pseudo_)?_bytes returns

Ensure all calls to RAND_bytes and RAND_pseudo_bytes have their return
value checked correctly

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 8f8e4e4f5253085ab673bb74094c3e492c56af44)

Conflicts:
crypto/evp/e_des3.c

4 years agoDon't send a for ServerKeyExchange for kDHr and kDHd
Kurt Roeckx [Sat, 14 Mar 2015 22:23:26 +0000 (23:23 +0100)]
Don't send a for ServerKeyExchange for kDHr and kDHd

The certificate already contains the DH parameters in that case.
ssl3_send_server_key_exchange() would fail in that case anyway.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 93f1c13619c5b41f2dcfdbf6ae666f867922a87a)

4 years agoConfiguration file examples.
Dr. Stephen Henson [Fri, 13 Mar 2015 14:16:32 +0000 (14:16 +0000)]
Configuration file examples.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 7b68c30da01b4eedcd546f81844156646387cacb)

4 years agoMake OCSP response verification more flexible.
Dr. Stephen Henson [Sun, 22 Mar 2015 17:34:56 +0000 (17:34 +0000)]
Make OCSP response verification more flexible.

If a set of certificates is supplied to OCSP_basic_verify use those in
addition to any present in the OCSP response as untrusted CAs when
verifying a certificate chain.

PR#3668

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 4ca5efc2874e094d6382b30416824eda6dde52fe)

4 years agoFix malloc define typo
Mike Frysinger [Sat, 21 Mar 2015 09:08:41 +0000 (05:08 -0400)]
Fix malloc define typo

Fix compilation failure when SCTP is compiled due to incorrect define.

Reported-by: Conrad Kostecki <ck+gentoobugzilla@bl4ckb0x.de>
URL: https://bugs.gentoo.org/543828

RT#3758
Signed-off-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 7c82e339a677f8546e1456c7a8f6788598a9de43)

4 years agoPrepare for 1.0.1n-dev
Matt Caswell [Thu, 19 Mar 2015 13:41:07 +0000 (13:41 +0000)]
Prepare for 1.0.1n-dev

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoPrepare for 1.0.1m release OpenSSL_1_0_1m
Matt Caswell [Thu, 19 Mar 2015 13:38:37 +0000 (13:38 +0000)]
Prepare for 1.0.1m release

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agomake update
Matt Caswell [Thu, 19 Mar 2015 13:38:37 +0000 (13:38 +0000)]
make update

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix unsigned/signed warnings
Matt Caswell [Thu, 19 Mar 2015 11:35:33 +0000 (11:35 +0000)]
Fix unsigned/signed warnings

Fix some unsigned/signed warnings introduced as part of the fix
for CVE-2015-0293

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix a failure to NULL a pointer freed on error.
Matt Caswell [Thu, 19 Mar 2015 10:16:32 +0000 (10:16 +0000)]
Fix a failure to NULL a pointer freed on error.

Reported by the LibreSSL project as a follow on to CVE-2015-0209

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoUpdate NEWS file
Matt Caswell [Tue, 17 Mar 2015 17:01:09 +0000 (17:01 +0000)]
Update NEWS file

Update the NEWS file with the latest entries from CHANGES ready for the
release.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoUpdate CHANGES for release
Matt Caswell [Tue, 17 Mar 2015 16:56:27 +0000 (16:56 +0000)]
Update CHANGES for release

Update CHANGES fiel with all the latest fixes ready for the release.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoRemove overlapping CHANGES/NEWS entries
Matt Caswell [Wed, 18 Mar 2015 09:48:03 +0000 (09:48 +0000)]
Remove overlapping CHANGES/NEWS entries

Remove entries from CHANGES and NEWS from letter releases that occur *after*
the next point release. Without this we get duplicate entries for the same
issue appearing multiple times.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix reachable assert in SSLv2 servers.
Emilia Kasper [Wed, 4 Mar 2015 17:05:02 +0000 (09:05 -0800)]
Fix reachable assert in SSLv2 servers.

This assert is reachable for servers that support SSLv2 and export ciphers.
Therefore, such servers can be DoSed by sending a specially crafted
SSLv2 CLIENT-MASTER-KEY.

Also fix s2_srvr.c to error out early if the key lengths are malformed.
These lengths are sent unencrypted, so this does not introduce an oracle.

CVE-2015-0293

This issue was discovered by Sean Burford (Google) and Emilia Käsper of
the OpenSSL development team.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoPKCS#7: avoid NULL pointer dereferences with missing content
Emilia Kasper [Fri, 27 Feb 2015 15:52:23 +0000 (16:52 +0100)]
PKCS#7: avoid NULL pointer dereferences with missing content

In PKCS#7, the ASN.1 content component is optional.
This typically applies to inner content (detached signatures),
however we must also handle unexpected missing outer content
correctly.

This patch only addresses functions reachable from parsing,
decryption and verification, and functions otherwise associated
with reading potentially untrusted data.

Correcting all low-level API calls requires further work.

CVE-2015-0289

Thanks to Michal Zalewski (Google) for reporting this issue.

Reviewed-by: Steve Henson <steve@openssl.org>
4 years agoFix ASN1_TYPE_cmp
Dr. Stephen Henson [Mon, 9 Mar 2015 23:11:45 +0000 (23:11 +0000)]
Fix ASN1_TYPE_cmp

Fix segmentation violation when ASN1_TYPE_cmp is passed a boolean type. This
can be triggered during certificate verification so could be a DoS attack
against a client or a server enabling client authentication.

CVE-2015-0286

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFree up ADB and CHOICE if already initialised.
Dr. Stephen Henson [Mon, 23 Feb 2015 02:32:44 +0000 (02:32 +0000)]
Free up ADB and CHOICE if already initialised.

CVE-2015-0287

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>