openbsd, branch OPENBSD_5_6_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_5_6_BASE 2014-08-08T05:06:57+00:00 This commit was manufactured by cvs2git to create tag 'OPENBSD_5_6_BASE'. 2014-08-08T05:06:57+00:00 cvs2svn admin@example.com 2014-08-08T05:06:57+00:00 urn:sha1:c3e2d8e8b5e43668b581b79da3e67e4ce5583ae5 Fix CVE-2014-3507, avoid allocating and then leaking a fresh fragment 2014-08-08T05:06:56+00:00 guenther 2014-08-08T05:06:56+00:00 urn:sha1:d4e460a24e2f9d4fe391e756145c2fdf4de7b218 structure when a zero-length fragment is received. Based on https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74 diff by miod@, ok guenther@ bcook@ deraadt@ Fix CVE-2014-3508, pretty printing and OID validation: 2014-08-08T04:53:43+00:00 guenther 2014-08-08T04:53:43+00:00 urn:sha1:39cb4488ec5412e0f592f7fabdb5ab22cded5edc - make sure the output buffer is always NUL terminated if buf_len was initially greater than zero. - reject OIDs that are too long, too short, or not in proper base-127 Based on https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=0042fb5fd1c9d257d713b15a1f45da05cf5c1c87 ok bcook@ Correct test reversed during merge of fix for CVE-2014-3509 2014-08-07T22:27:28+00:00 guenther 2014-08-07T22:27:28+00:00 urn:sha1:799e1b07f7a6a3c12b4d9bcb834487ad22b1f33b pointed out by Watson Ladd (watson (at) matasano.com) ok deraadt@ Fix CVE-2014-3506, DTLS handshake message size checks. From 2014-08-07T20:24:12+00:00 guenther 2014-08-07T20:24:12+00:00 urn:sha1:986fbb43f48b0f41d3a014d235f9443f69592f5f https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1250f12613b61758675848f6600ebd914ccd7636 with comment/whitespace style tweaks ok bcook@ miod@ Oops, revert changes commited by mistake. The previous commit was supposed 2014-08-07T20:02:23+00:00 miod 2014-08-07T20:02:23+00:00 urn:sha1:cfb04bdfd0fc6c114e72a57e4c98cf38bd7ff605 to only apply to s23_srvr.c. When you expect a function to return a particular value, don't put a comment 2014-08-07T19:46:31+00:00 miod 2014-08-07T19:46:31+00:00 urn:sha1:52fafe121652f8c5058ec964bbbf0d342db8037c saying that you expect it to return that value and compare it against zero because it is supposedly faster, for this leads to bugs (especially given the high rate of sloppy cut'n'paste within ssl3 and dtls1 routines in this library). Instead, compare for the exact value it ought to return upon success. ok deraadt@ Fix CVE-2014-3511; TLS downgrade, verbatim diff 2014-08-07T04:49:53+00:00 deraadt 2014-08-07T04:49:53+00:00 urn:sha1:d262467c46607aa30800e41ec750692ff8571476 https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=280b1f1ad12131defcd986676a8fc9717aaa601b ok guenther miod merge CVE-2014-3510; Fix DTLS anonymous EC(DH) denial of service 2014-08-07T01:24:10+00:00 deraadt 2014-08-07T01:24:10+00:00 urn:sha1:dd44686ea469034c579b75c8810a4fcebd190f7b https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=17160033765480453be0a41335fa6b833691c049 ok bcook merge fix for CVE-2014-3509 -- basically a missing s->hit check; ok guenther 2014-08-06T23:16:16+00:00 deraadt 2014-08-06T23:16:16+00:00 urn:sha1:4a67d2ffdf3376c2bdecf5e82c81a2176ac56cbe