A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_2 2022-09-03T16:01:23+00:00 2022-09-03T16:01:23+00:00 jsing 2022-09-03T16:01:23+00:00 urn:sha1:2b62b98b944c0df9fbd9e41e33ea96b45b98e84b CBIGNUM_it is supposed to be the "clear bignum" or "secure" bignum - that is one which zeros its memory after use and ensures that the constant time flags are set... in LibreSSL we always do both of these things for BIGNUMs, so just use BIGNUM_it instead. ok tb@ 2022-08-31T13:28:39+00:00 tb 2022-08-31T13:28:39+00:00 urn:sha1:bef184c688c711a88c484877b5864988ede7840d 2022-08-31T13:01:01+00:00 tb 2022-08-31T13:01:01+00:00 urn:sha1:5a012dc99251d6861841dbe500e21ff7a4f63ccc DSA_size() and ECDSA_size() have a very special hack. They fudge up an ASN1_INTEGER with a size which is typically > 100 bytes, backed by a buffer of size 4. This was "fine", however, since they set buf[0] = 0xff, where the craziness that was i2c_ASN1_INTEGER() only looks at the first octet (one may then ask why a buffer of size 4 was necessary...). This changed with the rewrite of i2c_ASN1_INTEGER(), which doesn't respect this particular hack and rightly assumes that it is fed an actual ASN1_INTEGER... Instead, create an appropriate signature and use i2d to determine its size. Fixes an out-of-bounds read flagged by ASAN and oss-fuzz. ok jsing 2022-07-12T14:42:50+00:00 kn 2022-07-12T14:42:50+00:00 urn:sha1:89e42d5857196a8071fbafb5565388d0e20ec32b This script is not used at all and files are edited by hand instead. Thus remove misleading comments incl. the obsolete script/config. Feedback OK jsing tb 2022-07-11T05:33:14+00:00 bcook 2022-07-11T05:33:14+00:00 urn:sha1:6b7fc4c14ffb7f8bb75a64987ffc6c93e60e8534 ok tb@ 2022-07-07T13:01:28+00:00 tb 2022-07-07T13:01:28+00:00 urn:sha1:7986c6c16406e5ad9f53a49107428df9f9fd70c1 These are mostly security-level related, but there are also ASN1_TIME and ASN_INTEGER functions here, as well as some missing accessors. ok jsing 2022-07-04T12:22:32+00:00 tb 2022-07-04T12:22:32+00:00 urn:sha1:76cd62b3a22a0de732f8f93e3f6698a2a779f82b Also follow OpenSSL by making the name non-const to avoid ugly casting. Used by OpenSC's pkcs11-helper, as reported by Fabrice Fontaine in https://github.com/libressl-portable/openbsd/issues/130 ok jsing sthen 2022-06-27T12:36:06+00:00 tb 2022-06-27T12:36:06+00:00 urn:sha1:3a9b1012fb6b57946e4cf3ee7b795a4bdcb905cc This also provides a pkey_security_bits member to the PKEY ASN.1 methods and a corresponding setter EVP_PKEY_asn1_set_security_bits(). ok beck jsing 2022-06-27T12:28:46+00:00 tb 2022-06-27T12:28:46+00:00 urn:sha1:896e0608790949d4649607486dfb63df13261954 ok beck jsing 2022-05-07T10:31:54+00:00 tb 2022-05-07T10:31:54+00:00 urn:sha1:0d00ae34d6e94054857b66fb87afcfa23e4a0095