openbsd/src/lib/libcrypto/asn1, branch libressl-v2.0.6 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v2.0.6 2014-08-08T05:06:58+00:00 This commit was manufactured by cvs2git to create branch 'OPENBSD_5_6'. 2014-08-08T05:06:58+00:00 cvs2svn admin@example.com 2014-08-08T05:06:58+00:00 urn:sha1:9033820a64c84908dee3f9261ad212f6b6c3449a Fix CVE-2014-3508, pretty printing and OID validation: 2014-08-08T04:53:43+00:00 guenther 2014-08-08T04:53:43+00:00 urn:sha1:39cb4488ec5412e0f592f7fabdb5ab22cded5edc - make sure the output buffer is always NUL terminated if buf_len was initially greater than zero. - reject OIDs that are too long, too short, or not in proper base-127 Based on https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=0042fb5fd1c9d257d713b15a1f45da05cf5c1c87 ok bcook@ BIO_free() returns immediately when the sole input is NULL. 2014-07-25T06:05:32+00:00 doug 2014-07-25T06:05:32+00:00 urn:sha1:d9473bfc95b9bc3edd71f25c11f0b47b27500df9 Remove unnecessary NULL check. ok miod@ The bell tolls for BUF_strdup - Start the migration to using 2014-07-13T16:03:10+00:00 beck 2014-07-13T16:03:10+00:00 urn:sha1:c7e9c2c6576cd5406680f9b69aff2038ba63b0dc intrinsics. This is the easy ones, a few left to check one at a time. ok miod@ deraadt@ Don't include asn1_mac.h if all you need is asn1.h. 2014-07-13T11:10:20+00:00 miod 2014-07-13T11:10:20+00:00 urn:sha1:781b01354d9fa99cac307d9fd44880ba3b30939c No need to include asn1_mac.h here. 2014-07-12T22:26:01+00:00 miod 2014-07-12T22:26:01+00:00 urn:sha1:e0fe7621bce09dd6ba62ddb9889bc82d64e677f7 A few fixes/improvements: 2014-07-12T16:42:47+00:00 miod 2014-07-12T16:42:47+00:00 urn:sha1:2608a374bc0d5bdbb8fff6d0477adf58542ee1e8 - first, BN_free == BN_clear_free in our libcrypto, so we do not need to treat CBIGNUM (crypto BN) separately from BIGNUM (regular BN). - then, in bn_i2c(), since BN_bn2bin returns BN_num_bytes(input), take advantage of this to avoid calling BN_num_bytes() a second time. BN_num_bytes() is cheap, but this not a reason to perform redundant work. - finally, in bn_c2i, if bn_new() fails, return early. Otherwise BN_bin2bn will try to create a BN too, and although this will probably fail since we were already out of memory, if we are on a threaded process and suddenly the allocation succeeds, we will leak it since it will never be stored in *pval. ok jsing@ Make sure the return value of X509_NAME_oneline(, NULL,) is checked against 2014-07-12T16:33:25+00:00 miod 2014-07-12T16:33:25+00:00 urn:sha1:f32d63e4f2007104dce73700052ad2ad2f26ee27 NULL. ok deraadt@ guenther@ jsing@ if (x) FOO_free(x) -> FOO_free(x). 2014-07-12T16:03:37+00:00 miod 2014-07-12T16:03:37+00:00 urn:sha1:068bf464df6ef084067943863d776f59762bfaf0 Improves readability, keeps the code smaller so that it is warmer in your cache. review & ok deraadt@ typos 2014-07-12T11:25:25+00:00 miod 2014-07-12T11:25:25+00:00 urn:sha1:f6d02d91130bc0ec3f15ccc3060f955bf75247e1