openbsd/src/lib, branch OPENBSD_4_6 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_4_6 2010-03-31T12:17:29+00:00 Security fix for CVE-2010-0740 2010-03-31T12:17:29+00:00 jasper 2010-03-31T12:17:29+00:00 urn:sha1:48b786510a2e23cb712e96454a283cc7216d9070 "In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL." http://openssl.org/news/secadv_20100324.txt ok djm@ sthen@ MFC, original commit by djm@: 2010-03-12T13:26:08+00:00 jasper 2010-03-12T13:26:08+00:00 urn:sha1:e1d514d70c111ea04798fa6e97072ea06e0ae866 --------------------------- cherrypick patch from OpenSSL 0.9.8m: *) Always check bn_wexpend() return values for failure. (CVE-2009-3245) [Martin Olsson, Neel Mehta] --------------------------- ok sthen@ Pull Ben Lauries blind prefix injection fix for CVE-2009-3555 from 2009-11-17T14:34:56+00:00 sthen 2009-11-17T14:34:56+00:00 urn:sha1:de2fb3aaad9c4aa5d5d324196d0e51de75946223 openssl 0.9.8l. As suggested by markus@, for -stable the header change is being restricted to a private file, so the minor version is not cranked here. Discussed with markus, djm, deraadt. This commit was manufactured by cvs2git to create branch 'OPENBSD_4_6'. 2009-06-25T14:33:52+00:00 cvs2svn admin@example.com 2009-06-25T14:33:52+00:00 urn:sha1:dff7a49e263b7f35da41af95b2c037ed7cf6f71a abs conforms c99 -> imaxabs conforms c99. ok millert@ 2009-06-21T00:33:10+00:00 martynas 2009-06-21T00:33:10+00:00 urn:sha1:c2fd5f6b247d86a45d952c9b689af7c86ba86a46 quieten compiler by converting pointers to uintptr_t before truncating them 2009-06-08T19:21:08+00:00 deraadt 2009-06-08T19:21:08+00:00 urn:sha1:7da661713b58fcaf339fde465c90ead048d3745e to u_int32_t to do integer math with (in a situation where that is legit) ok otto millert compare and shift buffer against a fixed length not strlen derived values. 2009-06-05T09:52:26+00:00 pyr 2009-06-05T09:52:26+00:00 urn:sha1:9473bb6bbf2b4e61b9ebbe974edd44839206a598 ok otto@ simplify the 'family' option parser and make it more evident what we're 2009-06-04T21:38:29+00:00 pyr 2009-06-04T21:38:29+00:00 urn:sha1:67bdfcf045d3053a07637a70c9e1e9555375bc09 now doing. ok deraadt@ Don't assume that we can overwrite strings in the environment. 2009-06-04T20:39:13+00:00 millert 2009-06-04T20:39:13+00:00 urn:sha1:b77bc4fc41b396fdfad2c3601e64aa26f6c0ed7f Someone may have passed a read-only string to putenv() (I'm looking at you cron!). Add a resolv.conf option to specify the order in which getaddrinfo 2009-06-04T18:06:35+00:00 pyr 2009-06-04T18:06:35+00:00 urn:sha1:27641c0c9895f7604965e9477480977868caec77 PF_UNSPEC queries are made. While there change the default from inet6 first then inet4 to inet4 first then inet6, this prevents the many people with IPv4 only connectivity from constantly trying to contact IPv6 addresses, and also unbreaks many ports who don't use getaddrinfo right. ok deraadt@, plenty of cheering in the room wrt the idea, not loud enough complaining from the v6 crowd.