openbsd/src/lib/libcrypto/asn1, branch libressl-v3.5.0

Avoid potential single byte overread in asn1_parse2().

2022-02-12T03:07:24+00:00

A fix for this was previously commited in r1.32, however while this added a bounds check the logic means we still fall through and perform the overread. Fix the logic such that we only log the error if the bounds check fails. While here, flip the test around such that we check for validity then print (which is more readable and matches earlier code). ok inoguchi@ tb@

Add check for BIO_indent return value

2022-01-20T10:49:56+00:00

CID 24869 ok jsing@ millert@ tb@

Avoid buffer overflow in asn1_parse2

2022-01-14T23:55:46+00:00

asn1_par.c r1.29 changed to access p[0] directly, and this pointer could be overrun since ASN1_get_object advances pointer to the first content octet. In case invalid ASN1 Boolean data, it has length but no content, I thought this could be happen. Adding check p with tot (diff below) will avoid this failure. Reported by oss-fuzz 43633 and 43648(later) ok tb@

Move ASN1_BOOLEAN to internal only.

2022-01-14T08:53:53+00:00

This moves {d2i,i2d}_ASN1_BOOLEAN() to internal only. They are unused, but help us testing the encoding. ok jsing

Remove all asn1_* symbols from public visibility

2022-01-14T08:43:06+00:00

ok inoguchi jsing

Implement new-style OpenSSL BIO callbacks

2022-01-14T08:40:57+00:00

This provides support for new-style BIO callbacks in BIO_{read,write,gets,puts}() and a helper function to work out whether it should call the new or the old style callback. It also adds a few typedefs and minor code cleanup as well as the BIO_{get,set}_callback_ex() from jsing, ok tb

Remove legacy sign/verify from EVP_MD.

2022-01-14T08:38:06+00:00

This removes m_dss.c, m_dss1.c, and m_ecdsa.c and the corresponding public API EVP_{dss,dss1,ecdsa}(). This is basically the following OpenSSL commit. The mentioned change in RSA is already present in rsa/rsa_pmeth.c. ok inoguchi jsing commit 7f572e958b13041056f377a62d3219633cfb1e8a Author: Dr. Stephen Henson Date: Wed Dec 2 13:57:04 2015 +0000 Remove legacy sign/verify from EVP_MD. Remove sign/verify and required_pkey_type fields of EVP_MD: these are a legacy from when digests were linked to public key types. All signing is now handled by the corresponding EVP_PKEY_METHOD. Only allow supported digest types in RSA EVP_PKEY_METHOD: other algorithms already block unsupported types. Remove now obsolete EVP_dss1() and EVP_ecdsa(). Reviewed-by: Richard Levitte Plus OpenSSL commit 625a9baf11c1dd94f17e5876b6ee8d6271b3921d for m_dss.c

Garbage collect the app_items field of ASN1_ADB

2022-01-14T08:16:13+00:00

This is unused and was removed in OpenSSL 5b70372d when it was replaced with an ASN.1 ADB callback (which we don't support). ok inoguchi jsing

Remove NO_ASN1_FIELD_NAMES

2022-01-14T08:14:48+00:00

This follows OpenSSL commit 26f2412d. ok inoguchi jsing

Remove obsolete key formats

2022-01-14T08:12:31+00:00

This removes NETSCAPE_X509, NETSCAPE{,_ENCRYPTED}_PKEY, RSA_NET, Netscape_RSA things. Some of the nasty tentacles that could go in principle are used in some test suites, so we need to keep them... All this was removed as part of OpenSSL commit 0bc2f365. ok inoguchi jsing