Fix BN_[pseudo_]rand: 'mask' must be used even if top=-1.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 0259485dbea31270a14bbf079b2e0c40b37d6e47..4955e13732d551b66cab8680b5636ce44765d838 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -3,11 +3,21 @@
 
  Changes between 0.9.6 and 0.9.7  [xx XXX 2000]
 
+  *) Don't use getenv in library functions when run as setuid/setgid.
+     New function OPENSSL_issetugid().
+     [Ulf Moeller]
+
   *) Make all configuration macros available for application by making
      sure they are available in opensslconf.h, by giving them names starting
      with "OPENSSL_" to avoid conflicts with other packages and by making
      sure e_os2.h will cover all platform-specific cases together with
      opensslconf.h.
+     Additionally, it is now possible to define configuration/platform-
+     specific names (called "system identities").  In the C code, these
+     are prefixed with "OPENSSL_SYSNAME_".  e_os2.h will create another
+     macro with the name beginning with "OPENSSL_SYS_", which is determined
+     from "OPENSSL_SYSNAME_*" or compiler-specific macros depending on
+     what is available.
      [Richard Levitte]
 
   *) New option -set_serial to 'req' and 'x509' this allows the serial
@@ -103,6 +113,9 @@
 
   *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
      Bleichenbacher's DSA attack.
+     Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
+     to be set and top=0 forces the highest bit to be set; top=-1 is new
+     and leaves the highest bit random.
      [Ulf Moeller, Bodo Moeller]
 
   *) Update Rijndael code to version 3.0 and change EVP AES ciphers to