openbsd/src/lib/libcrypto/x509, branch libressl-v2.2.1 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v2.2.1 2015-06-13T08:38:10+00:00 Fix bad indenting in LibreSSL. 2015-06-13T08:38:10+00:00 doug 2015-06-13T08:38:10+00:00 urn:sha1:ffdde82e8fceeaaea8ca893d8bffc0dcc53daf40 jsg@ noticed that some of the lines in libssl and libcrypto are not indented properly. At a quick glance, it looks like it has a different control flow than it really does. I checked the history in our tree and in OpenSSL to make sure these were simple mistakes. ok miod@ jsing@ Avoid a potential out-of-bounds read in X509_cmp_time(), due to missing 2015-06-11T15:58:53+00:00 jsing 2015-06-11T15:58:53+00:00 urn:sha1:652913e0fc47c01c7ce25e6f73435f2bf88f6a2e length checks. Diff based on changes in OpenSSL. Fixes CVE-2015-1789. ok doug@ Don't ignore the reference count in X509_STORE_free. 2015-04-25T16:02:55+00:00 doug 2015-04-25T16:02:55+00:00 urn:sha1:db89ec62c9654a4fdabda5759955699428c4fbf2 Based on this upstream commit: bff9ce4db38b297c72a6d84617d71ae2934450f7 which didn't make it into a release until 1.0.2. Thanks to william at 25thandclement dot com for reporting this! ok deraadt@ jsing@ beck@ Remove d2i_X509_PKEY and i2d_X509_PKEY from the SSLeay days. 2015-04-12T15:15:51+00:00 doug 2015-04-12T15:15:51+00:00 urn:sha1:1796e4db97a7850cbac4fdb65b8ec74e85549050 i2d_X509_PKEY is a "needs to implement" and d2i_X509_PKEY is broken. Removed upstream in commit b1f3442857c1fd76e91941141bf671d19e90a79d. ok deraadt@, jsing@ Remove all getenv() calls, especially those wrapped by issetugid(). 2015-04-11T16:03:21+00:00 deraadt 2015-04-11T16:03:21+00:00 urn:sha1:b6e092d1e41107edc3265fcda97c497aa21950e1 getenv()'s wrapped by issetugid() are safe, but issetugid() is correct difficult to impliment on many operating systems. By accident, a grand experiment was run over the last year, where issetugid() returned 1 (the safe value) on a few operating systems. Noone noticed & complained that certain environment variables were not working....... ok doug beck jsing, discussion with others Avoid a NULL pointer deref when X509_get_pubkey() returns NULL. 2015-03-15T22:52:17+00:00 doug 2015-03-15T22:52:17+00:00 urn:sha1:4fb860a66d9312261140bce7cdc5fbdef4e6e43a A NULL pointer could be dereferenced when X509_REQ_set_pubkey() calls X509_PUBKEY_set() with pktmp. OpenSSL says it's the fix for CVE-2015-0288, but there aren't any public details yet to confirm. Either way, we should fix this. Based on OpenSSL commit 28a00bcd8e318da18031b2ac8778c64147cd54f9 and BoringSSL commit 9d102ddbc0f6ed835ed12272a3d8a627d6a8e728. "looks sane" beck@ ok miod@, bcook@ If you do not support POSIX I/O then you're not tall enough to ride... 2015-02-12T03:54:07+00:00 jsing 2015-02-12T03:54:07+00:00 urn:sha1:1c7b61ccfe1cdbe10dcf7459d3bc363f5c3c6b4d ok tedu@ More unifdef OPENSSL_NO_RFC3779 that got missed last time around. 2015-02-11T02:17:59+00:00 jsing 2015-02-11T02:17:59+00:00 urn:sha1:5a58ebc930587e6e3925e0e6a0fec0d76ccfbff9 Spotted by beck@ Remove more IMPLEMENT_STACK_OF noops that have been hiding for the last 2015-02-10T11:22:22+00:00 jsing 2015-02-10T11:22:22+00:00 urn:sha1:f615895acf9eb579a4183eb9a32ea5ab0e2d7cb6 15 years. The IMPLEMENT_STACK_OF and IMPLEMENT_ASN1_SET_OF macros were turned into 2015-02-10T08:33:10+00:00 jsing 2015-02-10T08:33:10+00:00 urn:sha1:398669e54cc64c0b7d0a009b29cd2f2ff9063ca9 noops around 15 years ago. Remove multiple occurances of both that still exist in the code today.