Fix a memory leak in 'sk_dup' in the case a realloc() fails. Also, tidy up

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index e0b2838c29e81cc5cd94f4c3bf429b31d7dbda78..03f9d02abe2f1d24d3e5a7d1ba7c23d78034d522 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,47 @@
          *) applies to 0.9.6a (/0.9.6b) and 0.9.7
          +) applies to 0.9.7 only
 
+  +) Fix a memory leak in 'sk_dup()' in the case reallocation fails. (Also
+     tidy up some unecessarily weird code in 'sk_new()').
+     [Geoff, reported by Diego Tartara <dtartara@novamens.com>]
+
+  +) Change the key loading routines for ENGINEs to use the same kind
+     callback (pem_password_cb) as all other routines that need this
+     kind of callback.
+     [Richard Levitte]
+
+  *) Fix for compatibility mode trust settings: ignore trust settings
+     unless some valid trust or reject settings are present.
+     [Steve Henson]
+
+  *) Fix for blowfish EVP: its a variable length cipher.
+     [Steve Henson]
+
+  +) Increase ENTROPY_NEEDED to 32 bytes, as Rijndael can operate with
+     256 bit (=32 byte) keys. Of course seeding with more entropy bytes
+     than this minimum value is recommended.
+     [Lutz Jaenicke]
+
+  +) New random seeder for OpenVMS, using the system process statistics
+     that are easily reachable.
+     [Richard Levitte]
+
+  +) Windows apparently can't transparently handle global
+     variables defined in DLLs. Initialisations such as:
+
+        const ASN1_ITEM *it = &ASN1_INTEGER_it;
+
+     wont compile. This is used by the any applications that need to
+     delcare their own ASN1 modules. This was fixed by adding the option
+     EXPORT_VAR_AS_FN to all Win32 platforms, although this isn't strictly
+     needed for static libraries under Win32.
+     [Steve Henson]
+
+  +) New functions X509_PURPOSE_set() and X509_TRUST_set() to handle
+     setting of purpose and trust fields. New X509_STORE trust and
+     purpose functions and tidy up setting in other SSL functions.
+     [Steve Henson]
+
   +) Add copies of X509_STORE_CTX fields and callbacks to X509_STORE
      structure. These are inherited by X509_STORE_CTX when it is 
      initialised. This allows various defaults to be set in the
@@ -73,7 +114,7 @@
      ENGINE structure.
      [Geoff]
 
-  +) Fix various bugs related to DSA S/MIME verification. Handle missing
+  *) Fix various bugs related to DSA S/MIME verification. Handle missing
      parameters in DSA public key structures and return an error in the
      DSA routines if parameters are absent.
      [Steve Henson]
@@ -797,9 +838,12 @@
      [Geoff Thorpe]
 
   +) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
-     If an EGD or PRNGD is running and enough entropy is returned, automatic
-     seeding like with /dev/[u]random will be performed.
-     Positions tried are: /etc/entropy, /var/run/egd-pool.
+     If /dev/[u]random devices are not available or do not return enough
+     entropy, EGD style sockets (served by EGD or PRNGD) will automatically
+     be queried.
+     The locations /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and
+     /etc/entropy will be queried once each in this sequence, quering stops
+     when enough entropy was collected without querying more sockets.
      [Lutz Jaenicke]
 
   +) Change the Unix RAND_poll() variant to be able to poll several
@@ -3396,7 +3440,7 @@
                                      copied!)
      [Bodo Moeller]
 
-  *) Bugfix: SSL_set_mode ignored its parameter, only SSL_CTX_set_mode
+  *) Bugfix: SSL_set_options ignored its parameter, only SSL_CTX_set_options
      worked.
 
   *) Fix problems with no-hmac etc.