openbsd/src/lib/libcrypto/x509, branch libressl-v2.2.0A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=libressl-v2.2.02015-06-11T15:58:53+00:00Avoid a potential out-of-bounds read in X509_cmp_time(), due to missing2015-06-11T15:58:53+00:00jsing2015-06-11T15:58:53+00:00urn:sha1:652913e0fc47c01c7ce25e6f73435f2bf88f6a2e
length checks.
Diff based on changes in OpenSSL.
Fixes CVE-2015-1789.
ok doug@
Don't ignore the reference count in X509_STORE_free.2015-04-25T16:02:55+00:00doug2015-04-25T16:02:55+00:00urn:sha1:db89ec62c9654a4fdabda5759955699428c4fbf2
Based on this upstream commit: bff9ce4db38b297c72a6d84617d71ae2934450f7
which didn't make it into a release until 1.0.2.
Thanks to william at 25thandclement dot com for reporting this!
ok deraadt@ jsing@ beck@
Remove d2i_X509_PKEY and i2d_X509_PKEY from the SSLeay days.2015-04-12T15:15:51+00:00doug2015-04-12T15:15:51+00:00urn:sha1:1796e4db97a7850cbac4fdb65b8ec74e85549050
i2d_X509_PKEY is a "needs to implement" and d2i_X509_PKEY is broken.
Removed upstream in commit b1f3442857c1fd76e91941141bf671d19e90a79d.
ok deraadt@, jsing@
Remove all getenv() calls, especially those wrapped by issetugid().2015-04-11T16:03:21+00:00deraadt2015-04-11T16:03:21+00:00urn:sha1:b6e092d1e41107edc3265fcda97c497aa21950e1
getenv()'s wrapped by issetugid() are safe, but issetugid() is correct
difficult to impliment on many operating systems. By accident, a grand
experiment was run over the last year, where issetugid() returned 1 (the
safe value) on a few operating systems. Noone noticed & complained that
certain environment variables were not working.......
ok doug beck jsing, discussion with others
Avoid a NULL pointer deref when X509_get_pubkey() returns NULL.2015-03-15T22:52:17+00:00doug2015-03-15T22:52:17+00:00urn:sha1:4fb860a66d9312261140bce7cdc5fbdef4e6e43a
A NULL pointer could be dereferenced when X509_REQ_set_pubkey() calls
X509_PUBKEY_set() with pktmp.
OpenSSL says it's the fix for CVE-2015-0288, but there aren't any public
details yet to confirm. Either way, we should fix this.
Based on OpenSSL commit 28a00bcd8e318da18031b2ac8778c64147cd54f9
and BoringSSL commit 9d102ddbc0f6ed835ed12272a3d8a627d6a8e728.
"looks sane" beck@
ok miod@, bcook@
If you do not support POSIX I/O then you're not tall enough to ride...2015-02-12T03:54:07+00:00jsing2015-02-12T03:54:07+00:00urn:sha1:1c7b61ccfe1cdbe10dcf7459d3bc363f5c3c6b4d
ok tedu@
More unifdef OPENSSL_NO_RFC3779 that got missed last time around.2015-02-11T02:17:59+00:00jsing2015-02-11T02:17:59+00:00urn:sha1:5a58ebc930587e6e3925e0e6a0fec0d76ccfbff9
Spotted by beck@
Remove more IMPLEMENT_STACK_OF noops that have been hiding for the last2015-02-10T11:22:22+00:00jsing2015-02-10T11:22:22+00:00urn:sha1:f615895acf9eb579a4183eb9a32ea5ab0e2d7cb6
15 years.
The IMPLEMENT_STACK_OF and IMPLEMENT_ASN1_SET_OF macros were turned into2015-02-10T08:33:10+00:00jsing2015-02-10T08:33:10+00:00urn:sha1:398669e54cc64c0b7d0a009b29cd2f2ff9063ca9
noops around 15 years ago. Remove multiple occurances of both that still
exist in the code today.
Delete a lot of #if 0 code in libressl.2015-02-07T13:19:15+00:00doug2015-02-07T13:19:15+00:00urn:sha1:a58e958ffece1b48f50bc090357dee2cd5b1bc20
There are a few instances where #if 1 is removed but the code remains.
Based on the following OpenSSL commits. Some of the commits weren't
strictly deletions so they are going to be split up into separate commits.
6f91b017bbb7140f816721141ac156d1b828a6b3
3d47c1d331fdc7574d2275cda1a630ccdb624b08
dfb56425b68314b2b57e17c82c1df42e7a015132
c8fa2356a00cbaada8963f739e5570298311a060
f16a64d11f55c01f56baa62ebf1dec7f8fe718cb
9ccc00ef6ea65567622e40c49aca43f2c6d79cdb
02a938c953b3e1ced71d9a832de1618f907eb96d
75d0ebef2aef7a2c77b27575b8da898e22f3ccd5
d6fbb194095312f4722c81c9362dbd0de66cb656
6f1a93ad111c7dfe36a09a976c4c009079b19ea1
1a5adcfb5edfe23908b350f8757df405b0f5f71f
8de24b792743d11e1d5a0dcd336a49368750c577
a2b18e657ea1a932d125154f4e13ab2258796d90
8e964419603d2478dfb391c66e7ccb2dcc9776b4
32dfde107636ac9bc62a5b3233fe2a54dbc27008
input + ok jsing@, miod@, tedu@