merge 0.9.7d

author: markus <> 2004-04-08 08:03:15 +0000
committer: markus <> 2004-04-08 08:03:15 +0000
commit: 40d673554117d24c9f46be721235d3e302c06e04 (patch)
tree: 341e7f38b840f3e503afb6e471123c0f2ba082c3 /src/lib/libc
parent: cbf88de39286be06cd20e0c65b6cb7633dce25a5 (diff)
download: openbsd-40d673554117d24c9f46be721235d3e302c06e04.tar.gz
openbsd-40d673554117d24c9f46be721235d3e302c06e04.tar.bz2
openbsd-40d673554117d24c9f46be721235d3e302c06e04.zip
79 files changed, 573 insertions, 503 deletions
diff --git a/src/lib/libcrypto/Makefile.ssl b/src/lib/libcrypto/Makefile.ssl
index 3071e3cb86..b9951a4600 100644
--- a/src/lib/libcrypto/Makefile.ssl
+++ b/src/lib/libcrypto/Makefile.ssl
@@ -50,7 +50,7 @@ ALL=    $(GENERAL) $(SRC) $(HEADER)
 top:
        @(cd ..; $(MAKE) DIRS=$(DIR) all)
-all: buildinf.h lib subdirs shared
+all: shared
 buildinf.h: ../Makefile.ssl
        ( echo "#ifndef MK1MF_BUILD"; \
@@ -96,7 +96,7 @@ lib:	$(LIBOBJ)
        $(RANLIB) $(LIB) || echo Never mind.
        @touch lib
-shared:
+shared: buildinf.h lib subdirs
        if [ -n "$(SHARED_LIBS)" ]; then \
                (cd ..; $(MAKE) $(SHARED_LIB)); \
        fi
diff --git a/src/lib/libcrypto/aes/aes_cbc.c b/src/lib/libcrypto/aes/aes_cbc.c
index 86b27b10d6..1222a21002 100644
--- a/src/lib/libcrypto/aes/aes_cbc.c
+++ b/src/lib/libcrypto/aes/aes_cbc.c
@@ -104,7 +104,7 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
                        memcpy(tmp, in, AES_BLOCK_SIZE);
                        AES_decrypt(tmp, tmp, key);
                        for(n=0; n < len; ++n)
-                                out[n] ^= ivec[n];
+                                out[n] = tmp[n] ^ ivec[n];
                        memcpy(ivec, tmp, AES_BLOCK_SIZE);
                }                       
        }
diff --git a/src/lib/libcrypto/asn1/a_gentm.c b/src/lib/libcrypto/asn1/a_gentm.c
index 48b923de1f..8581007868 100644
--- a/src/lib/libcrypto/asn1/a_gentm.c
+++ b/src/lib/libcrypto/asn1/a_gentm.c
@@ -220,7 +220,7 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
                return(NULL);
        p=(char *)s->data;
-        if ((p == NULL) || (s->length < len))
+        if ((p == NULL) || ((size_t)s->length < len))
                {
                p=OPENSSL_malloc(len);
                if (p == NULL) return(NULL);
@@ -229,8 +229,8 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
                s->data=(unsigned char *)p;
                }
-        snprintf(p,len,"%04d%02d%02d%02d%02d%02dZ",ts->tm_year + 1900,
+        BIO_snprintf(p,len,"%04d%02d%02d%02d%02d%02dZ",ts->tm_year + 1900,
-                 ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
+                     ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
        s->length=strlen(p);
        s->type=V_ASN1_GENERALIZEDTIME;
 #ifdef CHARSET_EBCDIC_not
diff --git a/src/lib/libcrypto/asn1/a_mbstr.c b/src/lib/libcrypto/asn1/a_mbstr.c
index c811b11776..208b3ec395 100644
--- a/src/lib/libcrypto/asn1/a_mbstr.c
+++ b/src/lib/libcrypto/asn1/a_mbstr.c
@@ -145,14 +145,14 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
        if((minsize > 0) && (nchar < minsize)) {
                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_SHORT);
-                snprintf(strbuf, sizeof strbuf, "%ld", minsize);
+                BIO_snprintf(strbuf, sizeof strbuf, "%ld", minsize);
                ERR_add_error_data(2, "minsize=", strbuf);
                return -1;
        }
        if((maxsize > 0) && (nchar > maxsize)) {
                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_LONG);
-                snprintf(strbuf, sizeof strbuf, "%ld", maxsize);
+                BIO_snprintf(strbuf, sizeof strbuf, "%ld", maxsize);
                ERR_add_error_data(2, "maxsize=", strbuf);
                return -1;
        }
diff --git a/src/lib/libcrypto/asn1/a_strex.c b/src/lib/libcrypto/asn1/a_strex.c
index 8abfdfe598..bde666a6ff 100644
--- a/src/lib/libcrypto/asn1/a_strex.c
+++ b/src/lib/libcrypto/asn1/a_strex.c
@@ -285,7 +285,7 @@ const static signed char tag2nbyte[] = {
        -1, -1, 0, -1,          /* 10-13 */
        -1, -1, -1, -1,         /* 15-17 */
        -1, 1, 1,               /* 18-20 */
-        -1, 1, -1,-1,           /* 21-24 */
+        -1, 1, 1, 1,            /* 21-24 */
        -1, 1, -1,              /* 25-27 */
        4, -1, 2                /* 28-30 */
 };
diff --git a/src/lib/libcrypto/asn1/a_time.c b/src/lib/libcrypto/asn1/a_time.c
index b8c031fc8f..159681fbcb 100644
--- a/src/lib/libcrypto/asn1/a_time.c
+++ b/src/lib/libcrypto/asn1/a_time.c
@@ -155,10 +155,10 @@ ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t, ASN1_GENERALIZE
        newlen = t->length + 2 + 1;
        str = (char *)ret->data;
        /* Work out the century and prepend */
-        if (t->data[0] >= '5') strlcpy(str, "19", newlen);
+        if (t->data[0] >= '5') BUF_strlcpy(str, "19", newlen);
-        else strlcpy(str, "20", newlen);
+        else BUF_strlcpy(str, "20", newlen);
-        strlcat(str, (char *)t->data, newlen);
+        BUF_strlcat(str, (char *)t->data, newlen);
        return ret;
        }
diff --git a/src/lib/libcrypto/asn1/a_utctm.c b/src/lib/libcrypto/asn1/a_utctm.c
index 41f6d421bb..999852dae5 100644
--- a/src/lib/libcrypto/asn1/a_utctm.c
+++ b/src/lib/libcrypto/asn1/a_utctm.c
@@ -200,7 +200,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
                return(NULL);
        p=(char *)s->data;
-        if ((p == NULL) || (s->length < len))
+        if ((p == NULL) || ((size_t)s->length < len))
                {
                p=OPENSSL_malloc(len);
                if (p == NULL) return(NULL);
@@ -209,8 +209,8 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
                s->data=(unsigned char *)p;
                }
-        snprintf(p,len,"%02d%02d%02d%02d%02d%02dZ",ts->tm_year%100,
+        BIO_snprintf(p,len,"%02d%02d%02d%02d%02d%02dZ",ts->tm_year%100,
-                 ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
+                     ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
        s->length=strlen(p);
        s->type=V_ASN1_UTCTIME;
 #ifdef CHARSET_EBCDIC_not
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index aed2895400..a74f1368d3 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -414,8 +414,8 @@ void asn1_add_error(unsigned char *address, int offset)
        {
        char buf1[DECIMAL_SIZE(address)+1],buf2[DECIMAL_SIZE(offset)+1];
-        snprintf(buf1,sizeof buf1,"%lu",(unsigned long)address);
+        BIO_snprintf(buf1,sizeof buf1,"%lu",(unsigned long)address);
-        snprintf(buf2,sizeof buf2,"%d",offset);
+        BIO_snprintf(buf2,sizeof buf2,"%d",offset);
        ERR_add_error_data(4,"address=",buf1," offset=",buf2);
        }
diff --git a/src/lib/libcrypto/asn1/asn1_par.c b/src/lib/libcrypto/asn1/asn1_par.c
index 1799657141..676d434f03 100644
--- a/src/lib/libcrypto/asn1/asn1_par.c
+++ b/src/lib/libcrypto/asn1/asn1_par.c
@@ -83,11 +83,11 @@ static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
        p=str;
        if ((xclass & V_ASN1_PRIVATE) == V_ASN1_PRIVATE)
-                snprintf(str,sizeof str,"priv [ %d ] ",tag);
+                BIO_snprintf(str,sizeof str,"priv [ %d ] ",tag);
        else if ((xclass & V_ASN1_CONTEXT_SPECIFIC) == V_ASN1_CONTEXT_SPECIFIC)
-                snprintf(str,sizeof str,"cont [ %d ]",tag);
+                BIO_snprintf(str,sizeof str,"cont [ %d ]",tag);
        else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
-                snprintf(str,sizeof str,"appl [ %d ]",tag);
+                BIO_snprintf(str,sizeof str,"appl [ %d ]",tag);
        else p = ASN1_tag2str(tag);
        if (p2 != NULL)
diff --git a/src/lib/libcrypto/asn1/asn_moid.c b/src/lib/libcrypto/asn1/asn_moid.c
index be20db4bad..edb44c988f 100644
--- a/src/lib/libcrypto/asn1/asn_moid.c
+++ b/src/lib/libcrypto/asn1/asn_moid.c
@@ -87,9 +87,14 @@ static int oid_module_init(CONF_IMODULE *md, const CONF *cnf)
                        }
                }
        return 1;
-}
+        }
+static void oid_module_finish(CONF_IMODULE *md)
+        {
+        OBJ_cleanup();
+        }
 void ASN1_add_oid_module(void)
        {
-        CONF_module_add("oid_section", oid_module_init, 0);
+        CONF_module_add("oid_section", oid_module_init, oid_module_finish);
        }
diff --git a/src/lib/libcrypto/asn1/t_pkey.c b/src/lib/libcrypto/asn1/t_pkey.c
index e1c5e5ae13..d15006e654 100644
--- a/src/lib/libcrypto/asn1/t_pkey.c
+++ b/src/lib/libcrypto/asn1/t_pkey.c
@@ -139,9 +139,9 @@ int RSA_print(BIO *bp, const RSA *x, int off)
                }
        if (x->d == NULL)
-                snprintf(str,sizeof str,"Modulus (%d bit):",BN_num_bits(x->n));
+                BIO_snprintf(str,sizeof str,"Modulus (%d bit):",BN_num_bits(x->n));
        else
-                strlcpy(str,"modulus:",sizeof str);
+                BUF_strlcpy(str,"modulus:",sizeof str);
        if (!print(bp,str,x->n,m,off)) goto err;
        s=(x->d == NULL)?"Exponent:":"publicExponent:";
        if (!print(bp,s,x->e,m,off)) goto err;
diff --git a/src/lib/libcrypto/bf/Makefile.ssl b/src/lib/libcrypto/bf/Makefile.ssl
index 7dfdf9d871..be3ad77a05 100644
--- a/src/lib/libcrypto/bf/Makefile.ssl
+++ b/src/lib/libcrypto/bf/Makefile.ssl
@@ -22,6 +22,7 @@ BF_ENC=		bf_enc.o
 #DES_ENC=       bx86-elf.o
 CFLAGS= $(INCLUDES) $(CFLAG)
+ASFLAGS= $(INCLUDES) $(ASFLAG)
 GENERAL=Makefile
 TEST=bftest.c
diff --git a/src/lib/libcrypto/bio/b_dump.c b/src/lib/libcrypto/bio/b_dump.c
index 983604fb49..f671e722fa 100644
--- a/src/lib/libcrypto/bio/b_dump.c
+++ b/src/lib/libcrypto/bio/b_dump.c
@@ -104,41 +104,41 @@ int BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
        for(i=0;i<rows;i++)
                {
                buf[0]='\0';    /* start with empty string */
-                strlcpy(buf,str,sizeof buf);
+                BUF_strlcpy(buf,str,sizeof buf);
-                snprintf(tmp,sizeof tmp,"%04x - ",i*dump_width);
+                BIO_snprintf(tmp,sizeof tmp,"%04x - ",i*dump_width);
-                strlcat(buf,tmp,sizeof buf);
+                BUF_strlcat(buf,tmp,sizeof buf);
                for(j=0;j<dump_width;j++)
                        {
                        if (((i*dump_width)+j)>=len)
                                {
-                                strlcat(buf,"   ",sizeof buf);
+                                BUF_strlcat(buf,"   ",sizeof buf);
                                }
                        else
                                {
                                ch=((unsigned char)*(s+i*dump_width+j)) & 0xff;
-                                snprintf(tmp,sizeof tmp,"%02x%c",ch,
+                                BIO_snprintf(tmp,sizeof tmp,"%02x%c",ch,
                                         j==7?'-':' ');
-                                strlcat(buf,tmp,sizeof buf);
+                                BUF_strlcat(buf,tmp,sizeof buf);
                                }
                        }
-                strlcat(buf,"  ",sizeof buf);
+                BUF_strlcat(buf,"  ",sizeof buf);
                for(j=0;j<dump_width;j++)
                        {
                        if (((i*dump_width)+j)>=len)
                                break;
                        ch=((unsigned char)*(s+i*dump_width+j)) & 0xff;
 #ifndef CHARSET_EBCDIC
-                        snprintf(tmp,sizeof tmp,"%c",
+                        BIO_snprintf(tmp,sizeof tmp,"%c",
                                 ((ch>=' ')&&(ch<='~'))?ch:'.');
 #else
-                        snprintf(tmp,sizeof tmp,"%c",
+                        BIO_snprintf(tmp,sizeof tmp,"%c",
                                 ((ch>=os_toascii[' '])&&(ch<=os_toascii['~']))
                                 ? os_toebcdic[ch]
                                 : '.');
 #endif
-                        strlcat(buf,tmp,sizeof buf);
+                        BUF_strlcat(buf,tmp,sizeof buf);
                        }
-                strlcat(buf,"\n",sizeof buf);
+                BUF_strlcat(buf,"\n",sizeof buf);
                /* if this is the last call then update the ddt_dump thing so that
                 * we will move the selection point in the debug window 
                 */
@@ -147,7 +147,7 @@ int BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
 #ifdef TRUNCATE
        if (trunc > 0)
                {
-                snprintf(buf,sizeof buf,"%s%04x - <SPACES/NULS>\n",str,
+                BIO_snprintf(buf,sizeof buf,"%s%04x - <SPACES/NULS>\n",str,
                         len+trunc);
                ret+=BIO_write(bio,(char *)buf,strlen(buf));
                }
diff --git a/src/lib/libcrypto/bio/b_print.c b/src/lib/libcrypto/bio/b_print.c
index 2cfc689dd6..fbff331796 100644
--- a/src/lib/libcrypto/bio/b_print.c
+++ b/src/lib/libcrypto/bio/b_print.c
@@ -576,12 +576,12 @@ abs_val(LDOUBLE value)
 }
 static LDOUBLE
-pow10(int exp)
+pow10(int in_exp)
 {
    LDOUBLE result = 1;
-    while (exp) {
+    while (in_exp) {
        result *= 10;
-        exp--;
+        in_exp--;
    }
    return result;
 }
@@ -652,8 +652,8 @@ fmtfp(
            (caps ? "0123456789ABCDEF"
              : "0123456789abcdef")[intpart % 10];
        intpart = (intpart / 10);
-    } while (intpart && (iplace < sizeof iplace));
+    } while (intpart && (iplace < sizeof iconvert));
-    if (iplace == sizeof iplace)
+    if (iplace == sizeof iconvert)
        iplace--;
    iconvert[iplace] = 0;
@@ -664,7 +664,7 @@ fmtfp(
              : "0123456789abcdef")[fracpart % 10];
        fracpart = (fracpart / 10);
    } while (fplace < max);
-    if (fplace == sizeof fplace)
+    if (fplace == sizeof fconvert)
        fplace--;
    fconvert[fplace] = 0;
diff --git a/src/lib/libcrypto/bio/b_sock.c b/src/lib/libcrypto/bio/b_sock.c
index 5282f8a8f7..c851298d1e 100644
--- a/src/lib/libcrypto/bio/b_sock.c
+++ b/src/lib/libcrypto/bio/b_sock.c
@@ -709,12 +709,12 @@ int BIO_accept(int sock, char **addr)
                        }
                *addr=p;
                }
-        snprintf(*addr,24,"%d.%d.%d.%d:%d",
+        BIO_snprintf(*addr,24,"%d.%d.%d.%d:%d",
-                 (unsigned char)(l>>24L)&0xff,
+                     (unsigned char)(l>>24L)&0xff,
-                 (unsigned char)(l>>16L)&0xff,
+                     (unsigned char)(l>>16L)&0xff,
-                 (unsigned char)(l>> 8L)&0xff,
+                     (unsigned char)(l>> 8L)&0xff,
-                 (unsigned char)(l     )&0xff,
+                     (unsigned char)(l     )&0xff,
-                 port);
+                     port);
 end:
        return(ret);
        }
diff --git a/src/lib/libcrypto/bio/bio_cb.c b/src/lib/libcrypto/bio/bio_cb.c
index ee9159ebd8..6f4254a114 100644
--- a/src/lib/libcrypto/bio/bio_cb.c
+++ b/src/lib/libcrypto/bio/bio_cb.c
@@ -75,56 +75,56 @@ long MS_CALLBACK BIO_debug_callback(BIO *bio, int cmd, const char *argp,
        if (BIO_CB_RETURN & cmd)
                r=ret;
-        snprintf(buf,sizeof buf,"BIO[%08lX]:",(unsigned long)bio);
+        BIO_snprintf(buf,sizeof buf,"BIO[%08lX]:",(unsigned long)bio);
        p= &(buf[14]);
        p_maxlen = sizeof buf - 14;
        switch (cmd)
                {
        case BIO_CB_FREE:
-                snprintf(p,p_maxlen,"Free - %s\n",bio->method->name);
+                BIO_snprintf(p,p_maxlen,"Free - %s\n",bio->method->name);
                break;
        case BIO_CB_READ:
                if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        snprintf(p,p_maxlen,"read(%d,%d) - %s fd=%d\n",
+                        BIO_snprintf(p,p_maxlen,"read(%d,%d) - %s fd=%d\n",
                                 bio->num,argi,bio->method->name,bio->num);
                else
-                        snprintf(p,p_maxlen,"read(%d,%d) - %s\n",
+                        BIO_snprintf(p,p_maxlen,"read(%d,%d) - %s\n",
                                 bio->num,argi,bio->method->name);
                break;
        case BIO_CB_WRITE:
                if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        snprintf(p,p_maxlen,"write(%d,%d) - %s fd=%d\n",
+                        BIO_snprintf(p,p_maxlen,"write(%d,%d) - %s fd=%d\n",
                                 bio->num,argi,bio->method->name,bio->num);
                else
-                        snprintf(p,p_maxlen,"write(%d,%d) - %s\n",
+                        BIO_snprintf(p,p_maxlen,"write(%d,%d) - %s\n",
                                 bio->num,argi,bio->method->name);
                break;
        case BIO_CB_PUTS:
-                snprintf(p,p_maxlen,"puts() - %s\n",bio->method->name);
+                BIO_snprintf(p,p_maxlen,"puts() - %s\n",bio->method->name);
                break;
        case BIO_CB_GETS:
-                snprintf(p,p_maxlen,"gets(%d) - %s\n",argi,bio->method->name);
+                BIO_snprintf(p,p_maxlen,"gets(%d) - %s\n",argi,bio->method->name);
                break;
        case BIO_CB_CTRL:
-                snprintf(p,p_maxlen,"ctrl(%d) - %s\n",argi,bio->method->name);
+                BIO_snprintf(p,p_maxlen,"ctrl(%d) - %s\n",argi,bio->method->name);
                break;
        case BIO_CB_RETURN|BIO_CB_READ:
-                snprintf(p,p_maxlen,"read return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"read return %ld\n",ret);
                break;
        case BIO_CB_RETURN|BIO_CB_WRITE:
-                snprintf(p,p_maxlen,"write return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"write return %ld\n",ret);
                break;
        case BIO_CB_RETURN|BIO_CB_GETS:
-                snprintf(p,p_maxlen,"gets return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"gets return %ld\n",ret);
                break;
        case BIO_CB_RETURN|BIO_CB_PUTS:
-                snprintf(p,p_maxlen,"puts return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"puts return %ld\n",ret);
                break;
        case BIO_CB_RETURN|BIO_CB_CTRL:
-                snprintf(p,p_maxlen,"ctrl return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"ctrl return %ld\n",ret);
                break;
        default:
-                snprintf(p,p_maxlen,"bio callback - unknown type (%d)\n",cmd);
+                BIO_snprintf(p,p_maxlen,"bio callback - unknown type (%d)\n",cmd);
                break;
                }
diff --git a/src/lib/libcrypto/bio/bss_conn.c b/src/lib/libcrypto/bio/bss_conn.c
index 8c694140ed..f5d0e759e2 100644
--- a/src/lib/libcrypto/bio/bss_conn.c
+++ b/src/lib/libcrypto/bio/bss_conn.c
@@ -521,8 +521,8 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                                char buf[16];
                                unsigned char *p = ptr;
-                                snprintf(buf,sizeof buf,"%d.%d.%d.%d",
+                                BIO_snprintf(buf,sizeof buf,"%d.%d.%d.%d",
-                                         p[0],p[1],p[2],p[3]);
+                                             p[0],p[1],p[2],p[3]);
                                if (data->param_hostname != NULL)
                                        OPENSSL_free(data->param_hostname);
                                data->param_hostname=BUF_strdup(buf);
@@ -532,7 +532,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                                {
                                char buf[DECIMAL_SIZE(int)+1];
-                                snprintf(buf,sizeof buf,"%d",*(int *)ptr);
+                                BIO_snprintf(buf,sizeof buf,"%d",*(int *)ptr);
                                if (data->param_port != NULL)
                                        OPENSSL_free(data->param_port);
                                data->param_port=BUF_strdup(buf);
diff --git a/src/lib/libcrypto/bio/bss_file.c b/src/lib/libcrypto/bio/bss_file.c
index 0ca603ee0a..9cdf159f82 100644
--- a/src/lib/libcrypto/bio/bss_file.c
+++ b/src/lib/libcrypto/bio/bss_file.c
@@ -249,15 +249,15 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
                if (num & BIO_FP_APPEND)
                        {
                        if (num & BIO_FP_READ)
-                                strlcpy(p,"a+",sizeof p);
+                                BUF_strlcpy(p,"a+",sizeof p);
-                        else    strlcpy(p,"a",sizeof p);
+                        else    BUF_strlcpy(p,"a",sizeof p);
                        }
                else if ((num & BIO_FP_READ) && (num & BIO_FP_WRITE))
-                        strlcpy(p,"r+",sizeof p);
+                        BUF_strlcpy(p,"r+",sizeof p);
                else if (num & BIO_FP_WRITE)
-                        strlcpy(p,"w",sizeof p);
+                        BUF_strlcpy(p,"w",sizeof p);
                else if (num & BIO_FP_READ)
-                        strlcpy(p,"r",sizeof p);
+                        BUF_strlcpy(p,"r",sizeof p);
                else
                        {
                        BIOerr(BIO_F_FILE_CTRL,BIO_R_BAD_FOPEN_MODE);
diff --git a/src/lib/libcrypto/bn/Makefile.ssl b/src/lib/libcrypto/bn/Makefile.ssl
index 0c6e796d17..50892ef44c 100644
--- a/src/lib/libcrypto/bn/Makefile.ssl
+++ b/src/lib/libcrypto/bn/Makefile.ssl
@@ -120,6 +120,9 @@ asm/ia64-cpp.o:	asm/ia64.S
 asm/x86_64-gcc.o: asm/x86_64-gcc.c
+asm/pa-risc2W.o: asm/pa-risc2W.s
+        /usr/ccs/bin/as -o asm/pa-rics2W.o asm/pa-risc2W.s
 files:
        $(PERL) $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO
diff --git a/src/lib/libcrypto/bn/asm/bn-586.pl b/src/lib/libcrypto/bn/asm/bn-586.pl
index 9a78f63be1..c4de4a2bee 100644
--- a/src/lib/libcrypto/bn/asm/bn-586.pl
+++ b/src/lib/libcrypto/bn/asm/bn-586.pl
@@ -11,7 +11,7 @@ require "x86asm.pl";
 &bn_div_words("bn_div_words");
 &bn_add_words("bn_add_words");
 &bn_sub_words("bn_sub_words");
-&bn_sub_part_words("bn_sub_part_words") unless $main'openbsd;
+#&bn_sub_part_words("bn_sub_part_words");
 &asm_finish();
diff --git a/src/lib/libcrypto/bn/bn_lcl.h b/src/lib/libcrypto/bn/bn_lcl.h
index 5614bc6164..253e195e23 100644
--- a/src/lib/libcrypto/bn/bn_lcl.h
+++ b/src/lib/libcrypto/bn/bn_lcl.h
@@ -433,19 +433,18 @@ void bn_sqr_comba4(BN_ULONG *r,const BN_ULONG *a);
 int bn_cmp_words(const BN_ULONG *a,const BN_ULONG *b,int n);
 int bn_cmp_part_words(const BN_ULONG *a, const BN_ULONG *b,
        int cl, int dl);
-#if 0
+#ifdef BN_RECURSION
-/* bn_mul.c rollback <appro> */
+void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
-void bn_mul_recursive(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b,int n2,
+        BN_ULONG *t);
-        int dna,int dnb,BN_ULONG *t);
+void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
-void bn_mul_part_recursive(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b,
+        int n, BN_ULONG *t);
-        int n,int tna,int tnb,BN_ULONG *t);
-#endif
-void bn_sqr_recursive(BN_ULONG *r,const BN_ULONG *a, int n2, BN_ULONG *t);
-void bn_mul_low_normal(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b, int n);
 void bn_mul_low_recursive(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b,int n2,
        BN_ULONG *t);
 void bn_mul_high(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b,BN_ULONG *l,int n2,
        BN_ULONG *t);
+void bn_sqr_recursive(BN_ULONG *r,const BN_ULONG *a, int n2, BN_ULONG *t);
+#endif
+void bn_mul_low_normal(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b, int n);
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libcrypto/bn/bn_lib.c b/src/lib/libcrypto/bn/bn_lib.c
index 463463cfcb..e1660450bc 100644
--- a/src/lib/libcrypto/bn/bn_lib.c
+++ b/src/lib/libcrypto/bn/bn_lib.c
@@ -145,11 +145,11 @@ char *BN_options(void)
                {
                init++;
 #ifdef BN_LLONG
-                snprintf(data,sizeof data,"bn(%d,%d)",(int)sizeof(BN_ULLONG)*8,
+                BIO_snprintf(data,sizeof data,"bn(%d,%d)",
-                        (int)sizeof(BN_ULONG)*8);
+                             (int)sizeof(BN_ULLONG)*8,(int)sizeof(BN_ULONG)*8);
 #else
-                snprintf(data,sizeof data,"bn(%d,%d)",(int)sizeof(BN_ULONG)*8,
+                BIO_snprintf(data,sizeof data,"bn(%d,%d)",
-                        (int)sizeof(BN_ULONG)*8);
+                             (int)sizeof(BN_ULONG)*8,(int)sizeof(BN_ULONG)*8);
 #endif
                }
        return(data);
diff --git a/src/lib/libcrypto/bn/bn_print.c b/src/lib/libcrypto/bn/bn_print.c
index ad80dab325..acba7ed7ee 100644
--- a/src/lib/libcrypto/bn/bn_print.c
+++ b/src/lib/libcrypto/bn/bn_print.c
@@ -140,12 +140,12 @@ char *BN_bn2dec(const BIGNUM *a)
                /* We now have a series of blocks, BN_DEC_NUM chars
                 * in length, where the last one needs truncation.
                 * The blocks need to be reversed in order. */
-                snprintf(p,BUF_REMAIN,BN_DEC_FMT1,*lp);
+                BIO_snprintf(p,BUF_REMAIN,BN_DEC_FMT1,*lp);
                while (*p) p++;
                while (lp != bn_data)
                        {
                        lp--;
-                        snprintf(p,BUF_REMAIN,BN_DEC_FMT2,*lp);
+                        BIO_snprintf(p,BUF_REMAIN,BN_DEC_FMT2,*lp);
                        while (*p) p++;
                        }
                }
diff --git a/src/lib/libcrypto/cast/Makefile.ssl b/src/lib/libcrypto/cast/Makefile.ssl
index 2dc1c855ad..98393a37ba 100644
--- a/src/lib/libcrypto/cast/Makefile.ssl
+++ b/src/lib/libcrypto/cast/Makefile.ssl
@@ -25,6 +25,7 @@ CAST_ENC=c_enc.o
 #CAST_ENC=asm/cx86bdsi.o
 CFLAGS= $(INCLUDES) $(CFLAG)
+ASFLAGS= $(INCLUDES) $(ASFLAG)
 GENERAL=Makefile
 TEST=casttest.c
diff --git a/src/lib/libcrypto/conf/conf_def.c b/src/lib/libcrypto/conf/conf_def.c
index b52ee01a3c..2e9f52f1fd 100644
--- a/src/lib/libcrypto/conf/conf_def.c
+++ b/src/lib/libcrypto/conf/conf_def.c
@@ -235,7 +235,7 @@ static int def_load_bio(CONF *conf, BIO *in, long *line)
                CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_MALLOC_FAILURE);
                goto err;
                }
-        strlcpy(section,"default",10);
+        BUF_strlcpy(section,"default",10);
        if (_CONF_new_data(conf) == 0)
                {
@@ -392,7 +392,7 @@ again:
                                                        ERR_R_MALLOC_FAILURE);
                                goto err;
                                }
-                        strlcpy(v->name,pname,strlen(pname)+1);
+                        BUF_strlcpy(v->name,pname,strlen(pname)+1);
                        if (!str_copy(conf,psection,&(v->value),start)) goto err;
                        if (strcmp(psection,section) != 0)
@@ -447,7 +447,7 @@ err:
        if (buff != NULL) BUF_MEM_free(buff);
        if (section != NULL) OPENSSL_free(section);
        if (line != NULL) *line=eline;
-        snprintf(btmp,sizeof btmp,"%ld",eline);
+        BIO_snprintf(btmp,sizeof btmp,"%ld",eline);
        ERR_add_error_data(2,"line ",btmp);
        if ((h != conf->data) && (conf->data != NULL))
                {
diff --git a/src/lib/libcrypto/conf/conf_mod.c b/src/lib/libcrypto/conf/conf_mod.c
index 5a747e8c84..d45adea851 100644
--- a/src/lib/libcrypto/conf/conf_mod.c
+++ b/src/lib/libcrypto/conf/conf_mod.c
@@ -232,7 +232,7 @@ static int module_run(const CONF *cnf, char *name, char *value,
                        {
                        char rcode[DECIMAL_SIZE(ret)+1];
                        CONFerr(CONF_F_CONF_MODULES_LOAD, CONF_R_MODULE_INITIALIZATION_ERROR);
-                        snprintf(rcode, sizeof rcode, "%-8d", ret);
+                        BIO_snprintf(rcode, sizeof rcode, "%-8d", ret);
                        ERR_add_error_data(6, "module=", name, ", value=", value, ", retcode=", rcode);
                        }
                }
@@ -561,11 +561,11 @@ char *CONF_get1_default_config_file(void)
        if (!file)
                return NULL;
-        strlcpy(file,X509_get_default_cert_area(),len + 1);
+        BUF_strlcpy(file,X509_get_default_cert_area(),len + 1);
 #ifndef OPENSSL_SYS_VMS
-        strlcat(file,"/",len + 1);
+        BUF_strlcat(file,"/",len + 1);
 #endif
-        strlcat(file,OPENSSL_CONF,len + 1);
+        BUF_strlcat(file,OPENSSL_CONF,len + 1);
        return file;
        }
@@ -576,12 +576,12 @@ char *CONF_get1_default_config_file(void)
 * be used to parse comma separated lists for example.
 */
-int CONF_parse_list(const char *list, int sep, int nospc,
+int CONF_parse_list(const char *list_, int sep, int nospc,
        int (*list_cb)(const char *elem, int len, void *usr), void *arg)
        {
        int ret;
        const char *lstart, *tmpend, *p;
-        lstart = list;
+        lstart = list_;
        for(;;)
                {
diff --git a/src/lib/libcrypto/cversion.c b/src/lib/libcrypto/cversion.c
index 56471fa74c..beeeb14013 100644
--- a/src/lib/libcrypto/cversion.c
+++ b/src/lib/libcrypto/cversion.c
@@ -74,7 +74,7 @@ const char *SSLeay_version(int t)
 #ifdef DATE
                static char buf[sizeof(DATE)+11];
-                snprintf(buf,sizeof buf,"built on: %s",DATE);
+                BIO_snprintf(buf,sizeof buf,"built on: %s",DATE);
                return(buf);
 #else
                return("built on: date not available");
@@ -85,7 +85,7 @@ const char *SSLeay_version(int t)
 #ifdef CFLAGS
                static char buf[sizeof(CFLAGS)+11];
-                snprintf(buf,sizeof buf,"compiler: %s",CFLAGS);
+                BIO_snprintf(buf,sizeof buf,"compiler: %s",CFLAGS);
                return(buf);
 #else
                return("compiler: information not available");
@@ -96,7 +96,7 @@ const char *SSLeay_version(int t)
 #ifdef PLATFORM
                static char buf[sizeof(PLATFORM)+11];
-                snprintf(buf,sizeof buf,"platform: %s", PLATFORM);
+                BIO_snprintf(buf,sizeof buf,"platform: %s", PLATFORM);
                return(buf);
 #else
                return("platform: information not available");
diff --git a/src/lib/libcrypto/des/Makefile.ssl b/src/lib/libcrypto/des/Makefile.ssl
index 45eba0b3c9..0d9ba2b42f 100644
--- a/src/lib/libcrypto/des/Makefile.ssl
+++ b/src/lib/libcrypto/des/Makefile.ssl
@@ -22,6 +22,7 @@ DES_ENC=	des_enc.o fcrypt_b.o
 #DES_ENC=       dx86-elf.o yx86-elf.o
 CFLAGS= $(INCLUDES) $(CFLAG)
+ASFLAGS= $(INCLUDES) $(ASFLAG)
 GENERAL=Makefile
 TEST=destest.c
@@ -157,12 +158,13 @@ cfb64enc.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
 cfb64enc.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 cfb64enc.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
 cfb64enc.o: cfb64enc.c des_locl.h
-cfb_enc.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+cfb_enc.o: ../../e_os.h ../../include/openssl/crypto.h
-cfb_enc.o: ../../include/openssl/des_old.h ../../include/openssl/e_os2.h
+cfb_enc.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
-cfb_enc.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+cfb_enc.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
-cfb_enc.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+cfb_enc.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
-cfb_enc.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
+cfb_enc.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
-cfb_enc.o: ../../include/openssl/ui_compat.h cfb_enc.c des_locl.h
+cfb_enc.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+cfb_enc.o: cfb_enc.c des_locl.h
 des_enc.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 des_enc.o: ../../include/openssl/des_old.h ../../include/openssl/e_os2.h
 des_enc.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
@@ -191,13 +193,13 @@ ecb3_enc.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
 ecb3_enc.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 ecb3_enc.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
 ecb3_enc.o: des_locl.h ecb3_enc.c
-ecb_enc.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+ecb_enc.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
-ecb_enc.o: ../../include/openssl/des_old.h ../../include/openssl/e_os2.h
+ecb_enc.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
-ecb_enc.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+ecb_enc.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
-ecb_enc.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+ecb_enc.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
-ecb_enc.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
+ecb_enc.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
-ecb_enc.o: ../../include/openssl/ui_compat.h des_locl.h des_ver.h ecb_enc.c
+ecb_enc.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
-ecb_enc.o: spr.h
+ecb_enc.o: des_locl.h des_ver.h ecb_enc.c spr.h
 ede_cbcm_enc.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 ede_cbcm_enc.o: ../../include/openssl/des_old.h ../../include/openssl/e_os2.h
 ede_cbcm_enc.o: ../../include/openssl/opensslconf.h
diff --git a/src/lib/libcrypto/des/cfb_enc.c b/src/lib/libcrypto/des/cfb_enc.c
index 2600bdfc93..03cabb223c 100644
--- a/src/lib/libcrypto/des/cfb_enc.c
+++ b/src/lib/libcrypto/des/cfb_enc.c
@@ -56,6 +56,7 @@
 * [including the GNU Public Licence.]
 */
+#include "e_os.h"
 #include "des_locl.h"
 /* The input and output are loaded in multiples of 8 bits.
@@ -64,17 +65,15 @@
 * the second.  The second 12 bits will come from the 3rd and half the 4th
 * byte.
 */
-/* WARNING WARNING: this uses in and out in 8-byte chunks regardless of
- * length */
 /* Until Aug 1 2003 this function did not correctly implement CFB-r, so it
 * will not be compatible with any encryption prior to that date. Ben. */
 void DES_cfb_encrypt(const unsigned char *in, unsigned char *out, int numbits,
                     long length, DES_key_schedule *schedule, DES_cblock *ivec,
                     int enc)
        {
-        register DES_LONG d0,d1,v0,v1,n=(numbits+7)/8;
+        register DES_LONG d0,d1,v0,v1;
-        register unsigned long l=length;
+        register unsigned long l=length,n=(numbits+7)/8;
-        register int num=numbits;
+        register int num=numbits,i;
        DES_LONG ti[2];
        unsigned char *iv;
        unsigned char ovec[16];
@@ -114,10 +113,10 @@ void DES_cfb_encrypt(const unsigned char *in, unsigned char *out, int numbits,
                                memmove(ovec,ovec+num/8,8+(num%8 ? 1 : 0));
                                /* now the remaining bits */
                                if(num%8 != 0)
-                                        for(n=0 ; n < 8 ; ++n)
+                                        for(i=0 ; i < 8 ; ++i)
                                                {
-                                                ovec[n]<<=num%8;
+                                                ovec[i]<<=num%8;
-                                                ovec[n]|=ovec[n+1]>>(8-num%8);
+                                                ovec[i]|=ovec[i+1]>>(8-num%8);
                                                }
                                iv=&ovec[0];
                                c2l(iv,v0);
@@ -152,10 +151,10 @@ void DES_cfb_encrypt(const unsigned char *in, unsigned char *out, int numbits,
                                memmove(ovec,ovec+num/8,8+(num%8 ? 1 : 0));
                                /* now the remaining bits */
                                if(num%8 != 0)
-                                        for(n=0 ; n < 8 ; ++n)
+                                        for(i=0 ; i < 8 ; ++i)
                                                {
-                                                ovec[n]<<=num%8;
+                                                ovec[i]<<=num%8;
-                                                ovec[n]|=ovec[n+1]>>(8-num%8);
+                                                ovec[i]|=ovec[i+1]>>(8-num%8);
                                                }
                                iv=&ovec[0];
                                c2l(iv,v0);
diff --git a/src/lib/libcrypto/des/ecb_enc.c b/src/lib/libcrypto/des/ecb_enc.c
index c828bdd45d..784aa5ba23 100644
--- a/src/lib/libcrypto/des/ecb_enc.c
+++ b/src/lib/libcrypto/des/ecb_enc.c
@@ -60,6 +60,7 @@
 #include "des_ver.h"
 #include "spr.h"
 #include <openssl/opensslv.h>
+#include <openssl/bio.h>
 OPENSSL_GLOBAL const char *libdes_version="libdes" OPENSSL_VERSION_PTEXT;
 OPENSSL_GLOBAL const char *DES_version="DES" OPENSSL_VERSION_PTEXT;
@@ -97,8 +98,8 @@ const char *DES_options(void)
                        size="int";
                else
                        size="long";
-                snprintf(buf,sizeof buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,
+                BIO_snprintf(buf,sizeof buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,
-                         size);
+                             size);
                init=0;
                }
        return(buf);
diff --git a/src/lib/libcrypto/doc/EVP_BytesToKey.pod b/src/lib/libcrypto/doc/EVP_BytesToKey.pod
index 5ce4add082..016381f3e9 100644
--- a/src/lib/libcrypto/doc/EVP_BytesToKey.pod
+++ b/src/lib/libcrypto/doc/EVP_BytesToKey.pod
@@ -2,7 +2,7 @@
 =head1 NAME
- EVP_BytesToKey - password based encryption routine
+EVP_BytesToKey - password based encryption routine
 =head1 SYNOPSIS
diff --git a/src/lib/libcrypto/doc/EVP_DigestInit.pod b/src/lib/libcrypto/doc/EVP_DigestInit.pod
index 58afd8f0b8..faa992286b 100644
--- a/src/lib/libcrypto/doc/EVP_DigestInit.pod
+++ b/src/lib/libcrypto/doc/EVP_DigestInit.pod
@@ -4,7 +4,7 @@
 EVP_MD_CTX_init, EVP_MD_CTX_create, EVP_DigestInit_ex, EVP_DigestUpdate,
 EVP_DigestFinal_ex, EVP_MD_CTX_cleanup, EVP_MD_CTX_destroy, EVP_MAX_MD_SIZE,
-EVP_MD_CTX_copy_ex EVP_MD_CTX_copy, EVP_MD_type, EVP_MD_pkey_type, EVP_MD_size,
+EVP_MD_CTX_copy_ex, EVP_MD_CTX_copy, EVP_MD_type, EVP_MD_pkey_type, EVP_MD_size,
 EVP_MD_block_size, EVP_MD_CTX_md, EVP_MD_CTX_size, EVP_MD_CTX_block_size, EVP_MD_CTX_type,
 EVP_md_null, EVP_md2, EVP_md5, EVP_sha, EVP_sha1, EVP_dss, EVP_dss1, EVP_mdc2,
 EVP_ripemd160, EVP_get_digestbyname, EVP_get_digestbynid, EVP_get_digestbyobj -
diff --git a/src/lib/libcrypto/doc/d2i_RSAPublicKey.pod b/src/lib/libcrypto/doc/d2i_RSAPublicKey.pod
index 7c71bcbf3d..279b29c873 100644
--- a/src/lib/libcrypto/doc/d2i_RSAPublicKey.pod
+++ b/src/lib/libcrypto/doc/d2i_RSAPublicKey.pod
@@ -9,6 +9,7 @@ d2i_Netscape_RSA - RSA public and private key encoding functions.
 =head1 SYNOPSIS
 #include <openssl/rsa.h>
+ #include <openssl/x509.h>
 RSA * d2i_RSAPublicKey(RSA **a, unsigned char **pp, long length);
@@ -31,8 +32,8 @@ d2i_Netscape_RSA - RSA public and private key encoding functions.
 d2i_RSAPublicKey() and i2d_RSAPublicKey() decode and encode a PKCS#1 RSAPublicKey
 structure.
-d2i_RSA_PUKEY() and i2d_RSA_PUKEY() decode and encode an RSA public key using a
+d2i_RSA_PUBKEY() and i2d_RSA_PUBKEY() decode and encode an RSA public key using
-SubjectPublicKeyInfo (certificate public key) structure.
+a SubjectPublicKeyInfo (certificate public key) structure.
 d2i_RSAPrivateKey(), i2d_RSAPrivateKey() decode and encode a PKCS#1 RSAPrivateKey
 structure.
diff --git a/src/lib/libcrypto/dso/dso_lib.c b/src/lib/libcrypto/dso/dso_lib.c
index 85ac5103cd..48d9fdb25e 100644
--- a/src/lib/libcrypto/dso/dso_lib.c
+++ b/src/lib/libcrypto/dso/dso_lib.c
@@ -383,7 +383,7 @@ int DSO_set_filename(DSO *dso, const char *filename)
                DSOerr(DSO_F_DSO_SET_FILENAME,ERR_R_MALLOC_FAILURE);
                return(0);
                }
-        strlcpy(copied, filename, strlen(filename) + 1);
+        BUF_strlcpy(copied, filename, strlen(filename) + 1);
        if(dso->filename)
                OPENSSL_free(dso->filename);
        dso->filename = copied;
@@ -422,7 +422,7 @@ char *DSO_convert_filename(DSO *dso, const char *filename)
                                        ERR_R_MALLOC_FAILURE);
                        return(NULL);
                        }
-                strlcpy(result, filename, strlen(filename) + 1);
+                BUF_strlcpy(result, filename, strlen(filename) + 1);
                }
        return(result);
        }
diff --git a/src/lib/libcrypto/ec/ecp_smpl.c b/src/lib/libcrypto/ec/ecp_smpl.c
index 4666a052bf..e9a51fb87a 100644
--- a/src/lib/libcrypto/ec/ecp_smpl.c
+++ b/src/lib/libcrypto/ec/ecp_smpl.c
@@ -896,7 +896,7 @@ int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
                }
        form = buf[0];
        y_bit = form & 1;
-        form = form & ~1;
+        form = form & ~1U;
        if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
                && (form != POINT_CONVERSION_UNCOMPRESSED)
                && (form != POINT_CONVERSION_HYBRID))
diff --git a/src/lib/libcrypto/engine/eng_ctrl.c b/src/lib/libcrypto/engine/eng_ctrl.c
index 0d56e69d27..412c73fb0f 100644
--- a/src/lib/libcrypto/engine/eng_ctrl.c
+++ b/src/lib/libcrypto/engine/eng_ctrl.c
@@ -160,19 +160,19 @@ static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p, void (*f)())
        case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD:
                return strlen(e->cmd_defns[idx].cmd_name);
        case ENGINE_CTRL_GET_NAME_FROM_CMD:
-                return snprintf(s,strlen(e->cmd_defns[idx].cmd_name) + 1,
+                return BIO_snprintf(s,strlen(e->cmd_defns[idx].cmd_name) + 1,
-                                "%s", e->cmd_defns[idx].cmd_name);
+                                    "%s", e->cmd_defns[idx].cmd_name);
        case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD:
                if(e->cmd_defns[idx].cmd_desc)
                        return strlen(e->cmd_defns[idx].cmd_desc);
                return strlen(int_no_description);
        case ENGINE_CTRL_GET_DESC_FROM_CMD:
                if(e->cmd_defns[idx].cmd_desc)
-                        return snprintf(s,
+                        return BIO_snprintf(s,
-                                        strlen(e->cmd_defns[idx].cmd_desc) + 1,
+                                            strlen(e->cmd_defns[idx].cmd_desc) + 1,
-                                        "%s", e->cmd_defns[idx].cmd_desc);
+                                            "%s", e->cmd_defns[idx].cmd_desc);
-                return snprintf(s, strlen(int_no_description) + 1,"%s",
+                return BIO_snprintf(s, strlen(int_no_description) + 1,"%s",
-                                int_no_description);
+                                    int_no_description);
        case ENGINE_CTRL_GET_CMD_FLAGS:
                return e->cmd_defns[idx].cmd_flags;
                }
diff --git a/src/lib/libcrypto/engine/eng_fat.c b/src/lib/libcrypto/engine/eng_fat.c
index 0d7dae00b2..7ccf7022ee 100644
--- a/src/lib/libcrypto/engine/eng_fat.c
+++ b/src/lib/libcrypto/engine/eng_fat.c
@@ -107,14 +107,14 @@ static int int_def_cb(const char *alg, int len, void *arg)
        }
-int ENGINE_set_default_string(ENGINE *e, const char *list)
+int ENGINE_set_default_string(ENGINE *e, const char *def_list)
        {
        unsigned int flags = 0;
-        if (!CONF_parse_list(list, ',', 1, int_def_cb, &flags))
+        if (!CONF_parse_list(def_list, ',', 1, int_def_cb, &flags))
                {
                ENGINEerr(ENGINE_F_ENGINE_SET_DEFAULT_STRING,
                                        ENGINE_R_INVALID_STRING);
-                ERR_add_error_data(2, "str=",list);
+                ERR_add_error_data(2, "str=",def_list);
                return 0;
                }
        return ENGINE_set_default(e, flags);
diff --git a/src/lib/libcrypto/engine/engine.h b/src/lib/libcrypto/engine/engine.h
index 9c3ab182d3..900f75ce8d 100644
--- a/src/lib/libcrypto/engine/engine.h
+++ b/src/lib/libcrypto/engine/engine.h
@@ -513,7 +513,7 @@ ENGINE *ENGINE_get_digest_engine(int nid);
 * structure will have had its reference count up'd so the caller
 * should still free their own reference 'e'. */
 int ENGINE_set_default_RSA(ENGINE *e);
-int ENGINE_set_default_string(ENGINE *e, const char *list);
+int ENGINE_set_default_string(ENGINE *e, const char *def_list);
 /* Same for the other "methods" */
 int ENGINE_set_default_DSA(ENGINE *e);
 int ENGINE_set_default_DH(ENGINE *e);
@@ -616,17 +616,20 @@ typedef int (*dynamic_bind_engine)(ENGINE *e, const char *id,
                                const dynamic_fns *fns);
 #define IMPLEMENT_DYNAMIC_BIND_FN(fn) \
        int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { \
-                if(!CRYPTO_set_mem_functions(fns->mem_fns.malloc_cb, \
+                if (ERR_get_implementation() != fns->err_fns) \
-                        fns->mem_fns.realloc_cb, fns->mem_fns.free_cb)) \
+                        { \
-                        return 0; \
+                        if(!CRYPTO_set_mem_functions(fns->mem_fns.malloc_cb, \
-                CRYPTO_set_locking_callback(fns->lock_fns.lock_locking_cb); \
+                                fns->mem_fns.realloc_cb, fns->mem_fns.free_cb)) \
-                CRYPTO_set_add_lock_callback(fns->lock_fns.lock_add_lock_cb); \
+                                return 0; \
-                CRYPTO_set_dynlock_create_callback(fns->lock_fns.dynlock_create_cb); \
+                        CRYPTO_set_locking_callback(fns->lock_fns.lock_locking_cb); \
-                CRYPTO_set_dynlock_lock_callback(fns->lock_fns.dynlock_lock_cb); \
+                        CRYPTO_set_add_lock_callback(fns->lock_fns.lock_add_lock_cb); \
-                CRYPTO_set_dynlock_destroy_callback(fns->lock_fns.dynlock_destroy_cb); \
+                        CRYPTO_set_dynlock_create_callback(fns->lock_fns.dynlock_create_cb); \
-                if(!CRYPTO_set_ex_data_implementation(fns->ex_data_fns)) \
+                        CRYPTO_set_dynlock_lock_callback(fns->lock_fns.dynlock_lock_cb); \
-                        return 0; \
+                        CRYPTO_set_dynlock_destroy_callback(fns->lock_fns.dynlock_destroy_cb); \
-                if(!ERR_set_implementation(fns->err_fns)) return 0; \
+                        if(!CRYPTO_set_ex_data_implementation(fns->ex_data_fns)) \
+                                return 0; \
+                        if(!ERR_set_implementation(fns->err_fns)) return 0; \
+                        } \
                if(!fn(e,id)) return 0; \
                return 1; }
diff --git a/src/lib/libcrypto/engine/hw_cryptodev.c b/src/lib/libcrypto/engine/hw_cryptodev.c
index 2fe84a5002..21de0a9fdd 100644
--- a/src/lib/libcrypto/engine/hw_cryptodev.c
+++ b/src/lib/libcrypto/engine/hw_cryptodev.c
@@ -1257,14 +1257,17 @@ ENGINE_load_cryptodev(void)
        if (engine == NULL)
                return;
-        if ((fd = get_dev_crypto()) < 0)
+        if ((fd = get_dev_crypto()) < 0) {
+                ENGINE_free(engine);
                return;
+        }
        /*
         * find out what asymmetric crypto algorithms we support
         */
        if (ioctl(fd, CIOCASYMFEAT, &cryptodev_asymfeat) == -1) {
                close(fd);
+                ENGINE_free(engine);
                return;
        }
        close(fd);
diff --git a/src/lib/libcrypto/err/err.c b/src/lib/libcrypto/err/err.c
index 6ab119c1ef..792f329600 100644
--- a/src/lib/libcrypto/err/err.c
+++ b/src/lib/libcrypto/err/err.c
@@ -1065,7 +1065,7 @@ void ERR_add_error_data(int num, ...)
                                else
                                        str=p;
                                }
-                        strlcat(str,a,s+1);
+                        BUF_strlcat(str,a,s+1);
                        }
                }
        ERR_set_error_data(str,ERR_TXT_MALLOCED|ERR_TXT_STRING);
diff --git a/src/lib/libcrypto/evp/digest.c b/src/lib/libcrypto/evp/digest.c
index b22eed4421..0623ddf1f0 100644
--- a/src/lib/libcrypto/evp/digest.c
+++ b/src/lib/libcrypto/evp/digest.c
@@ -248,6 +248,7 @@ int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
 int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
        {
+        unsigned char *tmp_buf;
        if ((in == NULL) || (in->digest == NULL))
                {
                EVPerr(EVP_F_EVP_MD_CTX_COPY,EVP_R_INPUT_NOT_INITIALIZED);
@@ -262,15 +263,22 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
                }
 #endif
+        if (out->digest == in->digest)
+                {
+                tmp_buf = out->md_data;
+                EVP_MD_CTX_set_flags(out,EVP_MD_CTX_FLAG_REUSE);
+                }
+        else tmp_buf = NULL;
        EVP_MD_CTX_cleanup(out);
        memcpy(out,in,sizeof *out);
        if (out->digest->ctx_size)
                {
-                out->md_data=OPENSSL_malloc(out->digest->ctx_size);
+                if (tmp_buf) out->md_data = tmp_buf;
+                else out->md_data=OPENSSL_malloc(out->digest->ctx_size);
                memcpy(out->md_data,in->md_data,out->digest->ctx_size);
                }
-        
        if (out->digest->copy)
                return out->digest->copy(out,in);
        
@@ -308,7 +316,8 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
        if (ctx->digest && ctx->digest->cleanup
            && !EVP_MD_CTX_test_flags(ctx,EVP_MD_CTX_FLAG_CLEANED))
                ctx->digest->cleanup(ctx);
-        if (ctx->digest && ctx->digest->ctx_size && ctx->md_data)
+        if (ctx->digest && ctx->digest->ctx_size && ctx->md_data
+            && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE))
                {
                OPENSSL_cleanse(ctx->md_data,ctx->digest->ctx_size);
                OPENSSL_free(ctx->md_data);
diff --git a/src/lib/libcrypto/evp/evp.h b/src/lib/libcrypto/evp/evp.h
index 5d8a07d33c..f9b48792ce 100644
--- a/src/lib/libcrypto/evp/evp.h
+++ b/src/lib/libcrypto/evp/evp.h
@@ -275,6 +275,8 @@ struct env_md_ctx_st
                                                * once only */
 #define EVP_MD_CTX_FLAG_CLEANED         0x0002 /* context has already been
                                                * cleaned */
+#define EVP_MD_CTX_FLAG_REUSE           0x0004 /* Don't free up ctx->md_data
+                                                * in EVP_MD_CTX_cleanup */
 struct evp_cipher_st
        {
diff --git a/src/lib/libcrypto/evp/evp_enc.c b/src/lib/libcrypto/evp/evp_enc.c
index be0758a879..8ea5aa935d 100644
--- a/src/lib/libcrypto/evp/evp_enc.c
+++ b/src/lib/libcrypto/evp/evp_enc.c
@@ -148,7 +148,19 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
 #endif
                ctx->cipher=cipher;
-                ctx->cipher_data=OPENSSL_malloc(ctx->cipher->ctx_size);
+                if (ctx->cipher->ctx_size)
+                        {
+                        ctx->cipher_data=OPENSSL_malloc(ctx->cipher->ctx_size);
+                        if (!ctx->cipher_data)
+                                {
+                                EVPerr(EVP_F_EVP_CIPHERINIT, ERR_R_MALLOC_FAILURE);
+                                return 0;
+                                }
+                        }
+                else
+                        {
+                        ctx->cipher_data = NULL;
+                        }
                ctx->key_len = cipher->key_len;
                ctx->flags = 0;
                if(ctx->cipher->flags & EVP_CIPH_CTRL_INIT)
diff --git a/src/lib/libcrypto/evp/evp_pbe.c b/src/lib/libcrypto/evp/evp_pbe.c
index bc98e63363..91e545a141 100644
--- a/src/lib/libcrypto/evp/evp_pbe.c
+++ b/src/lib/libcrypto/evp/evp_pbe.c
@@ -87,7 +87,7 @@ int EVP_PBE_CipherInit (ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
        if (i == -1) {
                char obj_tmp[80];
                EVPerr(EVP_F_EVP_PBE_CIPHERINIT,EVP_R_UNKNOWN_PBE_ALGORITHM);
-                if (!pbe_obj) strlcpy (obj_tmp, "NULL", sizeof obj_tmp);
+                if (!pbe_obj) BUF_strlcpy (obj_tmp, "NULL", sizeof obj_tmp);
                else i2t_ASN1_OBJECT(obj_tmp, sizeof obj_tmp, pbe_obj);
                ERR_add_error_data(2, "TYPE=", obj_tmp);
                return 0;
diff --git a/src/lib/libcrypto/evp/evp_pkey.c b/src/lib/libcrypto/evp/evp_pkey.c
index 30b6fbb03d..eb481ec661 100644
--- a/src/lib/libcrypto/evp/evp_pkey.c
+++ b/src/lib/libcrypto/evp/evp_pkey.c
@@ -210,7 +210,7 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
 #endif
                default:
                EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);
-                if (!a->algorithm) strlcpy (obj_tmp, "NULL", sizeof obj_tmp);
+                if (!a->algorithm) BUF_strlcpy (obj_tmp, "NULL", sizeof obj_tmp);
                else i2t_ASN1_OBJECT(obj_tmp, 80, a->algorithm);
                ERR_add_error_data(2, "TYPE=", obj_tmp);
                EVP_PKEY_free (pkey);
diff --git a/src/lib/libcrypto/mem.c b/src/lib/libcrypto/mem.c
index bb862db499..dd86733b77 100644
--- a/src/lib/libcrypto/mem.c
+++ b/src/lib/libcrypto/mem.c
@@ -252,7 +252,7 @@ void *CRYPTO_malloc_locked(int num, const char *file, int line)
        void *ret = NULL;
        extern unsigned char cleanse_ctr;
-        if (num < 0) return NULL;
+        if (num <= 0) return NULL;
        allow_customize = 0;
        if (malloc_debug_func != NULL)
@@ -293,7 +293,7 @@ void *CRYPTO_malloc(int num, const char *file, int line)
        void *ret = NULL;
        extern unsigned char cleanse_ctr;
-        if (num < 0) return NULL;
+        if (num <= 0) return NULL;
        allow_customize = 0;
        if (malloc_debug_func != NULL)
@@ -324,7 +324,7 @@ void *CRYPTO_realloc(void *str, int num, const char *file, int line)
        if (str == NULL)
                return CRYPTO_malloc(num, file, line);
-        if (num < 0) return NULL;
+        if (num <= 0) return NULL;
 
        if (realloc_debug_func != NULL)
                realloc_debug_func(str, NULL, num, file, line, 0);
@@ -346,7 +346,7 @@ void *CRYPTO_realloc_clean(void *str, int old_len, int num, const char *file,
        if (str == NULL)
                return CRYPTO_malloc(num, file, line);
 
-        if (num < 0) return NULL;
+        if (num <= 0) return NULL;
 
        if (realloc_debug_func != NULL)
                realloc_debug_func(str, NULL, num, file, line, 0);
diff --git a/src/lib/libcrypto/mem_dbg.c b/src/lib/libcrypto/mem_dbg.c
index 9221df00bd..e212de27e4 100644
--- a/src/lib/libcrypto/mem_dbg.c
+++ b/src/lib/libcrypto/mem_dbg.c
@@ -606,22 +606,22 @@ static void print_leak(const MEM *m, MEM_LEAK *l)
                {
                lcl = localtime(&m->time);
        
-                snprintf(bufp, BUF_REMAIN, "[%02d:%02d:%02d] ",
+                BIO_snprintf(bufp, BUF_REMAIN, "[%02d:%02d:%02d] ",
                        lcl->tm_hour,lcl->tm_min,lcl->tm_sec);
                bufp += strlen(bufp);
                }
-        snprintf(bufp, BUF_REMAIN, "%5lu file=%s, line=%d, ",
+        BIO_snprintf(bufp, BUF_REMAIN, "%5lu file=%s, line=%d, ",
                m->order,m->file,m->line);
        bufp += strlen(bufp);
        if (options & V_CRYPTO_MDEBUG_THREAD)
                {
-                snprintf(bufp, BUF_REMAIN, "thread=%lu, ", m->thread);
+                BIO_snprintf(bufp, BUF_REMAIN, "thread=%lu, ", m->thread);
                bufp += strlen(bufp);
                }
-        snprintf(bufp, BUF_REMAIN, "number=%d, address=%08lX\n",
+        BIO_snprintf(bufp, BUF_REMAIN, "number=%d, address=%08lX\n",
                m->num,(unsigned long)m->addr);
        bufp += strlen(bufp);
@@ -643,7 +643,7 @@ static void print_leak(const MEM *m, MEM_LEAK *l)
                ami_cnt++;
                memset(buf,'>',ami_cnt);
-                snprintf(buf + ami_cnt, sizeof buf - ami_cnt,
+                BIO_snprintf(buf + ami_cnt, sizeof buf - ami_cnt,
                        " thread=%lu, file=%s, line=%d, info=\"",
                        amip->thread, amip->file, amip->line);
                buf_len=strlen(buf);
@@ -655,11 +655,11 @@ static void print_leak(const MEM *m, MEM_LEAK *l)
                        }
                else
                        {
-                        strlcpy(buf + buf_len, amip->info,
+                        BUF_strlcpy(buf + buf_len, amip->info,
-                                sizeof buf - buf_len);
+                                    sizeof buf - buf_len);
                        buf_len = strlen(buf);
                        }
-                snprintf(buf + buf_len, sizeof buf - buf_len, "\"\n");
+                BIO_snprintf(buf + buf_len, sizeof buf - buf_len, "\"\n");
                
                BIO_puts(l->bio,buf);
diff --git a/src/lib/libcrypto/objects/obj_dat.c b/src/lib/libcrypto/objects/obj_dat.c
index ae97108e93..4534dc0985 100644
--- a/src/lib/libcrypto/objects/obj_dat.c
+++ b/src/lib/libcrypto/objects/obj_dat.c
@@ -462,7 +462,7 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
                if (i > 2) i=2;
                l-=(long)(i*40);
-                snprintf(tbuf,sizeof tbuf,"%d.%lu",i,l);
+                BIO_snprintf(tbuf,sizeof tbuf,"%d.%lu",i,l);
                i=strlen(tbuf);
                BUF_strlcpy(buf,tbuf,buf_len);
                buf_len-=i;
@@ -473,7 +473,7 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
                for (; idx<len; idx++) {
                        l|=p[idx]&0x7f;
                        if (!(p[idx] & 0x80)) {
-                                snprintf(tbuf,sizeof tbuf,".%lu",l);
+                                BIO_snprintf(tbuf,sizeof tbuf,".%lu",l);
                                i=strlen(tbuf);
                                if (buf_len > 0)
                                        BUF_strlcpy(buf,tbuf,buf_len);
diff --git a/src/lib/libcrypto/ocsp/ocsp_ext.c b/src/lib/libcrypto/ocsp/ocsp_ext.c
index d6c8899f58..57399433fc 100644
--- a/src/lib/libcrypto/ocsp/ocsp_ext.c
+++ b/src/lib/libcrypto/ocsp/ocsp_ext.c
@@ -305,6 +305,8 @@ err:
 /* Add a nonce to an extension stack. A nonce can be specificed or if NULL
 * a random nonce will be generated.
+ * Note: OpenSSL 0.9.7d and later create an OCTET STRING containing the 
+ * nonce, previous versions used the raw nonce.
 */
 static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val, int len)
@@ -313,20 +315,28 @@ static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val,
        ASN1_OCTET_STRING os;
        int ret = 0;
        if (len <= 0) len = OCSP_DEFAULT_NONCE_LENGTH;
-        if (val) tmpval = val;
+        /* Create the OCTET STRING manually by writing out the header and
+         * appending the content octets. This avoids an extra memory allocation
+         * operation in some cases. Applications should *NOT* do this because
+         * it relies on library internals.
+         */
+        os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING);
+        os.data = OPENSSL_malloc(os.length);
+        if (os.data == NULL)
+                goto err;
+        tmpval = os.data;
+        ASN1_put_object(&tmpval, 0, len, V_ASN1_OCTET_STRING, V_ASN1_UNIVERSAL);
+        if (val)
+                memcpy(tmpval, val, len);
        else
-                {
-                if (!(tmpval = OPENSSL_malloc(len))) goto err;
                RAND_pseudo_bytes(tmpval, len);
-                }
-        os.data = tmpval;
-        os.length = len;
        if(!X509V3_add1_i2d(exts, NID_id_pkix_OCSP_Nonce,
                        &os, 0, X509V3_ADD_REPLACE))
                                goto err;
        ret = 1;
        err:
-        if(!val) OPENSSL_free(tmpval);
+        if (os.data)
+                OPENSSL_free(os.data);
        return ret;
        }
diff --git a/src/lib/libcrypto/ocsp/ocsp_lib.c b/src/lib/libcrypto/ocsp/ocsp_lib.c
index 3875af165c..9e87fc7895 100644
--- a/src/lib/libcrypto/ocsp/ocsp_lib.c
+++ b/src/lib/libcrypto/ocsp/ocsp_lib.c
@@ -253,6 +253,7 @@ int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pss
        err:
+        if (buf) OPENSSL_free(buf);
        if (*ppath) OPENSSL_free(*ppath);
        if (*pport) OPENSSL_free(*pport);
        if (*phost) OPENSSL_free(*phost);
diff --git a/src/lib/libcrypto/ocsp/ocsp_vfy.c b/src/lib/libcrypto/ocsp/ocsp_vfy.c
index 1f5fda7ca3..3d58dfb06c 100644
--- a/src/lib/libcrypto/ocsp/ocsp_vfy.c
+++ b/src/lib/libcrypto/ocsp/ocsp_vfy.c
@@ -3,7 +3,7 @@
 * project 2000.
 */
 /* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
@@ -272,7 +272,7 @@ static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret)
        for (i = 1; i < idcount; i++)
                {
-                tmpid = sk_OCSP_SINGLERESP_value(sresp, 0)->certId;
+                tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;
                /* Check to see if IDs match */
                if (OCSP_id_issuer_cmp(cid, tmpid))
                        {
@@ -330,7 +330,7 @@ static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
                OCSP_CERTID *tmpid;
                for (i = 0; i < sk_OCSP_SINGLERESP_num(sresp); i++)
                        {
-                        tmpid = sk_OCSP_SINGLERESP_value(sresp, 0)->certId;
+                        tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;
                        ret = ocsp_match_issuerid(cert, tmpid, NULL);
                        if (ret <= 0) return ret;
                        }
diff --git a/src/lib/libcrypto/opensslv.h b/src/lib/libcrypto/opensslv.h
index e226d9de79..02f1710fb3 100644
--- a/src/lib/libcrypto/opensslv.h
+++ b/src/lib/libcrypto/opensslv.h
@@ -25,8 +25,8 @@
 * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
 *  major minor fix final patch/beta)
 */
-#define OPENSSL_VERSION_NUMBER  0x0090703fL
+#define OPENSSL_VERSION_NUMBER  0x0090704fL
-#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.7c 30 Sep 2003"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.7d 17 Mar 2004"
 #define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
diff --git a/src/lib/libcrypto/pem/pem_lib.c b/src/lib/libcrypto/pem/pem_lib.c
index 3bec2d7e9f..7785039b99 100644
--- a/src/lib/libcrypto/pem/pem_lib.c
+++ b/src/lib/libcrypto/pem/pem_lib.c
@@ -131,9 +131,9 @@ void PEM_proc_type(char *buf, int type)
        else
                str="BAD-TYPE";
                
-        strlcat(buf,"Proc-Type: 4,",PEM_BUFSIZE);
+        BUF_strlcat(buf,"Proc-Type: 4,",PEM_BUFSIZE);
-        strlcat(buf,str,PEM_BUFSIZE);
+        BUF_strlcat(buf,str,PEM_BUFSIZE);
-        strlcat(buf,"\n",PEM_BUFSIZE);
+        BUF_strlcat(buf,"\n",PEM_BUFSIZE);
        }
 void PEM_dek_info(char *buf, const char *type, int len, char *str)
@@ -142,9 +142,9 @@ void PEM_dek_info(char *buf, const char *type, int len, char *str)
        long i;
        int j;
-        strlcat(buf,"DEK-Info: ",PEM_BUFSIZE);
+        BUF_strlcat(buf,"DEK-Info: ",PEM_BUFSIZE);
-        strlcat(buf,type,PEM_BUFSIZE);
+        BUF_strlcat(buf,type,PEM_BUFSIZE);
-        strlcat(buf,",",PEM_BUFSIZE);
+        BUF_strlcat(buf,",",PEM_BUFSIZE);
        j=strlen(buf);
        if (j + (len * 2) + 1 > PEM_BUFSIZE)
                return;
@@ -535,7 +535,7 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
             long len)
        {
        int nlen,n,i,j,outl;
-        unsigned char *buf;
+        unsigned char *buf = NULL;
        EVP_ENCODE_CTX ctx;
        int reason=ERR_R_BUF_LIB;
        
@@ -555,7 +555,7 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
                        goto err;
                }
-        buf=(unsigned char *)OPENSSL_malloc(PEM_BUFSIZE*8);
+        buf = OPENSSL_malloc(PEM_BUFSIZE*8);
        if (buf == NULL)
                {
                reason=ERR_R_MALLOC_FAILURE;
@@ -576,12 +576,15 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
        EVP_EncodeFinal(&ctx,buf,&outl);
        if ((outl > 0) && (BIO_write(bp,(char *)buf,outl) != outl)) goto err;
        OPENSSL_free(buf);
+        buf = NULL;
        if (    (BIO_write(bp,"-----END ",9) != 9) ||
                (BIO_write(bp,name,nlen) != nlen) ||
                (BIO_write(bp,"-----\n",6) != 6))
                goto err;
        return(i+outl);
 err:
+        if (buf)
+                OPENSSL_free(buf);
        PEMerr(PEM_F_PEM_WRITE_BIO,reason);
        return(0);
        }
diff --git a/src/lib/libcrypto/pem/pem_pkey.c b/src/lib/libcrypto/pem/pem_pkey.c
index d96ecf6940..f77c949e87 100644
--- a/src/lib/libcrypto/pem/pem_pkey.c
+++ b/src/lib/libcrypto/pem/pem_pkey.c
@@ -87,6 +87,10 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, vo
                p8inf=d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, len);
                if(!p8inf) goto p8err;
                ret = EVP_PKCS82PKEY(p8inf);
+                if(x) {
+                        if(*x) EVP_PKEY_free((EVP_PKEY *)*x);
+                        *x = ret;
+                }
                PKCS8_PRIV_KEY_INFO_free(p8inf);
        } else if (strcmp(nm,PEM_STRING_PKCS8) == 0) {
                PKCS8_PRIV_KEY_INFO *p8inf;
diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index 190ca0e9bf..35c7dcd0b3 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -91,17 +91,19 @@ static int PKCS7_type_is_other(PKCS7* p7)
        }
-static int PKCS7_type_is_octet_string(PKCS7* p7)
+static ASN1_OCTET_STRING *PKCS7_get_octet_string(PKCS7 *p7)
        {
-        if ( 0==PKCS7_type_is_other(p7) )
+        if ( PKCS7_type_is_data(p7))
-                return 0;
+                return p7->d.data;
+        if ( PKCS7_type_is_other(p7) && p7->d.other
-        return (V_ASN1_OCTET_STRING==p7->d.other->type) ? 1 : 0;
+                && (p7->d.other->type == V_ASN1_OCTET_STRING))
+                return p7->d.other->value.octet_string;
+        return NULL;
        }
 BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
        {
-        int i,j;
+        int i;
        BIO *out=NULL,*btmp=NULL;
        X509_ALGOR *xa;
        const EVP_MD *evp_md;
@@ -159,8 +161,7 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                                goto err;
                                }
-                        j=OBJ_obj2nid(xa->algorithm);
+                        evp_md=EVP_get_digestbyobj(xa->algorithm);
-                        evp_md=EVP_get_digestbyname(OBJ_nid2sn(j));
                        if (evp_md == NULL)
                                {
                                PKCS7err(PKCS7_F_PKCS7_DATAINIT,PKCS7_R_UNKNOWN_DIGEST_TYPE);
@@ -250,29 +251,22 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                btmp=NULL;
                }
-        if (bio == NULL) {
+        if (bio == NULL)
+                {
                if (PKCS7_is_detached(p7))
                        bio=BIO_new(BIO_s_null());
-                else {
+                else
-                        if (PKCS7_type_is_signed(p7) ) { 
+                        {
-                                if ( PKCS7_type_is_data(p7->d.sign->contents)) {
+                        ASN1_OCTET_STRING *os;
-                                        ASN1_OCTET_STRING *os;
+                        os = PKCS7_get_octet_string(p7->d.sign->contents);
-                                        os=p7->d.sign->contents->d.data;
+                        if (os && os->length > 0)
-                                        if (os->length > 0)
+                                bio = BIO_new_mem_buf(os->data, os->length);
-                                                bio = BIO_new_mem_buf(os->data, os->length);
+                        if(bio == NULL)
-                                }
+                                {
-                                else if ( PKCS7_type_is_octet_string(p7->d.sign->contents) ) {
-                                        ASN1_OCTET_STRING *os;
-                                        os=p7->d.sign->contents->d.other->value.octet_string;
-                                        if (os->length > 0)
-                                                bio = BIO_new_mem_buf(os->data, os->length);
-                                }
-                        }
-                        if(bio == NULL) {
                                bio=BIO_new(BIO_s_mem());
                                BIO_set_mem_eof_return(bio,0);
+                                }
                        }
-                }
        }
        BIO_push(out,bio);
        bio=NULL;
@@ -311,7 +305,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
        switch (i)
                {
        case NID_pkcs7_signed:
-                data_body=p7->d.sign->contents->d.data;
+                data_body=PKCS7_get_octet_string(p7->d.sign->contents);
                md_sk=p7->d.sign->md_algs;
                break;
        case NID_pkcs7_signedAndEnveloped:
@@ -319,7 +313,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                md_sk=p7->d.signed_and_enveloped->md_algs;
                data_body=p7->d.signed_and_enveloped->enc_data->enc_data;
                enc_alg=p7->d.signed_and_enveloped->enc_data->algorithm;
-                evp_cipher=EVP_get_cipherbyname(OBJ_nid2sn(OBJ_obj2nid(enc_alg->algorithm)));
+                evp_cipher=EVP_get_cipherbyobj(enc_alg->algorithm);
                if (evp_cipher == NULL)
                        {
                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
@@ -331,7 +325,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                rsk=p7->d.enveloped->recipientinfo;
                enc_alg=p7->d.enveloped->enc_data->algorithm;
                data_body=p7->d.enveloped->enc_data->enc_data;
-                evp_cipher=EVP_get_cipherbyname(OBJ_nid2sn(OBJ_obj2nid(enc_alg->algorithm)));
+                evp_cipher=EVP_get_cipherbyobj(enc_alg->algorithm);
                if (evp_cipher == NULL)
                        {
                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
@@ -357,7 +351,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                                }
                        j=OBJ_obj2nid(xa->algorithm);
-                        evp_md=EVP_get_digestbyname(OBJ_nid2sn(j));
+                        evp_md=EVP_get_digestbynid(j);
                        if (evp_md == NULL)
                                {
                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNKNOWN_DIGEST_TYPE);
@@ -531,9 +525,9 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                break;
        case NID_pkcs7_signed:
                si_sk=p7->d.sign->signer_info;
-                os=p7->d.sign->contents->d.data;
+                os=PKCS7_get_octet_string(p7->d.sign->contents);
                /* If detached data then the content is excluded */
-                if(p7->detached) {
+                if(PKCS7_type_is_data(p7->d.sign->contents) && p7->detached) {
                        M_ASN1_OCTET_STRING_free(os);
                        p7->d.sign->contents->d.data = NULL;
                }
diff --git a/src/lib/libcrypto/rand/Makefile.ssl b/src/lib/libcrypto/rand/Makefile.ssl
index df80702373..e5cbe5319c 100644
--- a/src/lib/libcrypto/rand/Makefile.ssl
+++ b/src/lib/libcrypto/rand/Makefile.ssl
@@ -101,7 +101,8 @@ md_rand.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 md_rand.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 md_rand.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
 md_rand.o: md_rand.c rand_lcl.h
-rand_egd.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+rand_egd.o: ../../include/openssl/buffer.h ../../include/openssl/e_os2.h
+rand_egd.o: ../../include/openssl/opensslconf.h
 rand_egd.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
 rand_egd.o: rand_egd.c
 rand_err.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
@@ -186,8 +187,9 @@ rand_win.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 rand_win.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 rand_win.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
 rand_win.o: ../cryptlib.h rand_lcl.h rand_win.c
-randfile.o: ../../e_os.h ../../include/openssl/crypto.h
+randfile.o: ../../e_os.h ../../include/openssl/buffer.h
-randfile.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+randfile.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+randfile.o: ../../include/openssl/opensslconf.h
 randfile.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 randfile.o: ../../include/openssl/rand.h ../../include/openssl/safestack.h
 randfile.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
diff --git a/src/lib/libcrypto/rand/rand_egd.c b/src/lib/libcrypto/rand/rand_egd.c
index 895967476e..6f742900a0 100644
--- a/src/lib/libcrypto/rand/rand_egd.c
+++ b/src/lib/libcrypto/rand/rand_egd.c
@@ -56,6 +56,7 @@
 #include <openssl/e_os2.h>
 #include <openssl/rand.h>
+#include <openssl/buffer.h>
 /*
 * Query the EGD <URL: http://www.lothar.com/tech/crypto/>.
@@ -145,7 +146,7 @@ int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
        addr.sun_family = AF_UNIX;
        if (strlen(path) >= sizeof(addr.sun_path))
                return (-1);
-        strlcpy(addr.sun_path,path,sizeof addr.sun_path);
+        BUF_strlcpy(addr.sun_path,path,sizeof addr.sun_path);
        len = offsetof(struct sockaddr_un, sun_path) + strlen(path);
        fd = socket(AF_UNIX, SOCK_STREAM, 0);
        if (fd == -1) return (-1);
diff --git a/src/lib/libcrypto/rand/rand_win.c b/src/lib/libcrypto/rand/rand_win.c
index 263068d256..3584842224 100644
--- a/src/lib/libcrypto/rand/rand_win.c
+++ b/src/lib/libcrypto/rand/rand_win.c
@@ -646,7 +646,7 @@ static void readtimer(void)
 * Created 960901 by Gertjan van Oosten, gertjan@West.NL, West Consulting B.V.
 *
 * Code adapted from
- * <URL:http://www.microsoft.com/kb/developr/win_dk/q97193.htm>;
+ * <URL:http://support.microsoft.com/default.aspx?scid=kb;[LN];97193>;
 * the original copyright message is:
 *
 *   (C) Copyright Microsoft Corp. 1993.  All rights reserved.
diff --git a/src/lib/libcrypto/rand/randfile.c b/src/lib/libcrypto/rand/randfile.c
index cfbec2ac1f..d88ee0d780 100644
--- a/src/lib/libcrypto/rand/randfile.c
+++ b/src/lib/libcrypto/rand/randfile.c
@@ -56,6 +56,9 @@
 * [including the GNU Public Licence.]
 */
+/* We need to define this to get macros like S_IFBLK and S_IFCHR */
+#define _XOPEN_SOURCE 1
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -64,6 +67,7 @@
 #include "e_os.h"
 #include <openssl/crypto.h>
 #include <openssl/rand.h>
+#include <openssl/buffer.h>
 #ifdef OPENSSL_SYS_VMS
 #include <unixio.h>
@@ -106,6 +110,7 @@ int RAND_load_file(const char *file, long bytes)
        in=fopen(file,"rb");
        if (in == NULL) goto err;
+#if defined(S_IFBLK) && defined(S_IFCHR)
        if (sb.st_mode & (S_IFBLK | S_IFCHR)) {
          /* this file is a device. we don't want read an infinite number
           * of bytes from a random device, nor do we want to use buffered
@@ -114,6 +119,7 @@ int RAND_load_file(const char *file, long bytes)
          bytes = (bytes == -1) ? 2048 : bytes; /* ok, is 2048 enough? */
          setvbuf(in, NULL, _IONBF, 0); /* don't do buffered reads */
        }
+#endif
        for (;;)
                {
                if (bytes > 0)
@@ -147,6 +153,7 @@ int RAND_write_file(const char *file)
        
        i=stat(file,&sb);
        if (i != -1) { 
+#if defined(S_IFBLK) && defined(S_IFCHR)
          if (sb.st_mode & (S_IFBLK | S_IFCHR)) {
            /* this file is a device. we don't write back to it. 
             * we "succeed" on the assumption this is some sort 
@@ -155,6 +162,7 @@ int RAND_write_file(const char *file)
             */
            return(1); 
          }
+#endif
        }
 #if defined(O_CREAT) && !defined(OPENSSL_SYS_WIN32)
@@ -219,13 +227,15 @@ const char *RAND_file_name(char *buf, size_t size)
        {
        char *s=NULL;
        int ok = 0;
+#ifdef __OpenBSD__
        struct stat sb;
+#endif
        if (issetugid() == 0)
                s=getenv("RANDFILE");
        if (s != NULL && *s && strlen(s) + 1 < size)
                {
-                if (strlcpy(buf,s,size) >= size)
+                if (BUF_strlcpy(buf,s,size) >= size)
                        return NULL;
                }
        else
@@ -240,11 +250,11 @@ const char *RAND_file_name(char *buf, size_t size)
 #endif
                if (s && *s && strlen(s)+strlen(RFILE)+2 < size)
                        {
-                        strlcpy(buf,s,size);
+                        BUF_strlcpy(buf,s,size);
 #ifndef OPENSSL_SYS_VMS
-                        strlcat(buf,"/",size);
+                        BUF_strlcat(buf,"/",size);
 #endif
-                        strlcat(buf,RFILE,size);
+                        BUF_strlcat(buf,RFILE,size);
                        ok = 1;
                        }
                else
@@ -260,11 +270,11 @@ const char *RAND_file_name(char *buf, size_t size)
         */
        if (!ok)
-                if (strlcpy(buf,"/dev/arandom",size) >= size) {
+                if (BUF_strlcpy(buf,"/dev/arandom",size) >= size) {
                        return(NULL);
                }       
        if (stat(buf,&sb) == -1)
-                if (strlcpy(buf,"/dev/arandom",size) >= size) {
+                if (BUF_strlcpy(buf,"/dev/arandom",size) >= size) {
                        return(NULL);
                }       
diff --git a/src/lib/libcrypto/rc4/Makefile.ssl b/src/lib/libcrypto/rc4/Makefile.ssl
index 9f9e16068f..3e602662be 100644
--- a/src/lib/libcrypto/rc4/Makefile.ssl
+++ b/src/lib/libcrypto/rc4/Makefile.ssl
@@ -25,6 +25,7 @@ RC4_ENC=rc4_enc.o
 #RC4_ENC=asm/rx86bdsi.o
 CFLAGS= $(INCLUDES) $(CFLAG)
+ASFLAGS= $(INCLUDES) $(ASFLAG)
 GENERAL=Makefile
 TEST=rc4test.c
diff --git a/src/lib/libcrypto/rc5/Makefile.ssl b/src/lib/libcrypto/rc5/Makefile.ssl
index a86f202f7b..3f9632f8f7 100644
--- a/src/lib/libcrypto/rc5/Makefile.ssl
+++ b/src/lib/libcrypto/rc5/Makefile.ssl
@@ -22,6 +22,7 @@ RC5_ENC=		rc5_enc.o
 #DES_ENC=       r586-elf.o
 CFLAGS= $(INCLUDES) $(CFLAG)
+ASFLAGS= $(INCLUDES) $(ASFLAG)
 GENERAL=Makefile
 TEST=rc5test.c
diff --git a/src/lib/libcrypto/ripemd/Makefile.ssl b/src/lib/libcrypto/ripemd/Makefile.ssl
index d85515353b..f22ac790ae 100644
--- a/src/lib/libcrypto/ripemd/Makefile.ssl
+++ b/src/lib/libcrypto/ripemd/Makefile.ssl
@@ -20,6 +20,7 @@ AR=             ar r
 RIP_ASM_OBJ=
 CFLAGS= $(INCLUDES) $(CFLAG)
+ASFLAGS= $(INCLUDES) $(ASFLAG)
 GENERAL=Makefile
 TEST=rmdtest.c
diff --git a/src/lib/libcrypto/sha/Makefile.ssl b/src/lib/libcrypto/sha/Makefile.ssl
index d52fb62b4f..4ba201c787 100644
--- a/src/lib/libcrypto/sha/Makefile.ssl
+++ b/src/lib/libcrypto/sha/Makefile.ssl
@@ -20,6 +20,7 @@ AR=             ar r
 SHA1_ASM_OBJ=
 CFLAGS= $(INCLUDES) $(CFLAG)
+ASFLAGS= $(INCLUDES) $(ASFLAG)
 GENERAL=Makefile
 TEST=shatest.c sha1test.c
diff --git a/src/lib/libcrypto/sha/asm/sha1-586.pl b/src/lib/libcrypto/sha/asm/sha1-586.pl
index fe51fd0794..e00f709553 100644
--- a/src/lib/libcrypto/sha/asm/sha1-586.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-586.pl
@@ -1,5 +1,30 @@
 #!/usr/local/bin/perl
+# It was noted that Intel IA-32 C compiler generates code which
+# performs ~30% *faster* on P4 CPU than original *hand-coded*
+# SHA1 assembler implementation. To address this problem (and
+# prove that humans are still better than machines:-), the
+# original code was overhauled, which resulted in following
+# performance changes:
+#
+#               compared with original  compared with Intel cc
+#               assembler impl.         generated code
+# Pentium       -25%                    +37%
+# PIII/AMD      +8%                     +16%
+# P4            +85%(!)                 +45%
+#
+# As you can see Pentium came out as looser:-( Yet I reckoned that
+# improvement on P4 outweights the loss and incorporate this
+# re-tuned code to 0.9.7 and later.
+# ----------------------------------------------------------------
+# Those who for any particular reason absolutely must score on
+# Pentium can replace this module with one from 0.9.6 distribution.
+# This "offer" shall be revoked the moment programming interface to
+# this module is changed, in which case this paragraph should be
+# removed.
+# ----------------------------------------------------------------
+#                                       <appro@fy.chalmers.se>
 $normal=0;
 push(@INC,"perlasm","../../perlasm");
@@ -77,54 +102,21 @@ sub BODY_00_15
        {
        local($pos,$K,$X,$n,$a,$b,$c,$d,$e,$f)=@_;
-return if $n & 1;
        &comment("00_15 $n");
-         &mov($f,$c);
-        &mov($tmp1,$a);
-         &xor($f,$d);                   # F2
-        &rotl($tmp1,5);                 # A2
-        &and($f,$b);                    # F3
-         &add($tmp1,$e);
-        &rotr($b,1);                    # B1    <- F
-         &mov($e,&swtmp($n));           # G1
-        &rotr($b,1);                    # B1    <- F
-         &xor($f,$d);                   # F4
-        &lea($tmp1,&DWP($K,$tmp1,$e,1));
-############################
-#       &BODY_40_59( 0,$K[2],$X,42,$A,$B,$C,$D,$E,$T);
-#       &BODY_40_59( 0,$K[2],$X,43,$T,$A,$B,$C,$D,$E);
-$n++;
-        local($n0,$n1,$n2,$n3,$np)=&Na($n);
-        ($b,$c,$d,$e,$f,$a)=($a,$b,$c,$d,$e,$f);
-         &mov($f,$c);
-        &add($a,$tmp1);         # MOVED DOWN
-         &xor($f,$d);                   # F2
        &mov($tmp1,$a);
-         &and($f,$b);                   # F3
+         &mov($f,$c);                   # f to hold F_00_19(b,c,d)
+        &rotl($tmp1,5);                 # tmp1=ROTATE(a,5)
-        &rotl($tmp1,5);                 # A2
+         &xor($f,$d);
+        &and($f,$b);
-        &add($tmp1,$e);
+         &rotr($b,2);                   # b=ROTATE(b,30)
-         &mov($e,&swtmp($n));           # G1
+        &add($tmp1,$e);                 # tmp1+=e;
+         &mov($e,&swtmp($n));           # e becomes volatile and
-        &rotr($b,1);                    # B1    <- F
+                                        # is loaded with xi
-         &xor($f,$d);                   # F4
+        &xor($f,$d);                    # f holds F_00_19(b,c,d)
+         &lea($tmp1,&DWP($K,$tmp1,$e,1));# tmp1+=K_00_19+xi
-        &rotr($b,1);                    # B1    <- F
+        
-         &lea($tmp1,&DWP($K,$tmp1,$e,1));
+        &add($f,$tmp1);                 # f+=tmp1
-        &add($f,$tmp1);
        }
 sub BODY_16_19
@@ -132,66 +124,24 @@ sub BODY_16_19
        local($pos,$K,$X,$n,$a,$b,$c,$d,$e,$f)=@_;
        local($n0,$n1,$n2,$n3,$np)=&Na($n);
-return if $n & 1;
        &comment("16_19 $n");
- &nop() if ($pos < 0);
+        &mov($f,&swtmp($n1));           # f to hold Xupdate(xi,xa,xb,xc,xd)
-&mov($tmp1,&swtmp($n0));                        # X1
+         &mov($tmp1,$c);                # tmp1 to hold F_00_19(b,c,d)
- &mov($f,&swtmp($n1));                  # X2
+        &xor($f,&swtmp($n0));
-&xor($f,$tmp1);                         # X3
+         &xor($tmp1,$d);
- &mov($tmp1,&swtmp($n2));               # X4
+        &xor($f,&swtmp($n2));
-&xor($f,$tmp1);                         # X5
+         &and($tmp1,$b);                # tmp1 holds F_00_19(b,c,d)
- &mov($tmp1,&swtmp($n3));               # X6
+        &xor($f,&swtmp($n3));           # f holds xa^xb^xc^xd
-&xor($f,$tmp1);                         # X7 - slot
+         &rotr($b,2);                   # b=ROTATE(b,30)
- &mov($tmp1,$c);                        # F1
+        &xor($tmp1,$d);                 # tmp1=F_00_19(b,c,d)
-&rotl($f,1);                            # X8 - slot
+         &rotl($f,1);                   # f=ROATE(f,1)
- &xor($tmp1,$d);                        # F2
+        &mov(&swtmp($n0),$f);           # xi=f
-&mov(&swtmp($n0),$f);                   # X9 - anytime
+        &lea($f,&DWP($K,$f,$e,1));      # f+=K_00_19+e
- &and($tmp1,$b);                        # F3
+         &mov($e,$a);                   # e becomes volatile
-&lea($f,&DWP($K,$f,$e,1));              # tot=X+K+e
+        &add($f,$tmp1);                 # f+=F_00_19(b,c,d)
- &xor($tmp1,$d);                                # F4
+         &rotl($e,5);                   # e=ROTATE(a,5)
-&mov($e,$a);                            # A1
+        &add($f,$e);                    # f+=ROTATE(a,5)
- &add($f,$tmp1);                        # tot+=F();
-&rotl($e,5);                            # A2
-&rotr($b,1);                            # B1    <- F
- &add($f,$e);                           # tot+=a
-############################
-#       &BODY_40_59( 0,$K[2],$X,42,$A,$B,$C,$D,$E,$T);
-#       &BODY_40_59( 0,$K[2],$X,43,$T,$A,$B,$C,$D,$E);
-$n++;
-        local($n0,$n1,$n2,$n3,$np)=&Na($n);
-        ($b,$c,$d,$e,$f,$a)=($a,$b,$c,$d,$e,$f);
-&mov($f,&swtmp($n0));                   # X1
- &mov($tmp1,&swtmp($n1));               # X2
-&xor($f,$tmp1);                         # X3
- &mov($tmp1,&swtmp($n2));               # X4
-&xor($f,$tmp1);                         # X5
- &mov($tmp1,&swtmp($n3));               # X6
-&rotr($c,1); #&rotr($b,1);              # B1    <- F # MOVED DOWN
- &xor($f,$tmp1);                                # X7 - slot
-&rotl($f,1);                            # X8 - slot
- &mov($tmp1,$c);                        # F1
-&xor($tmp1,$d);                 # F2
- &mov(&swtmp($n0),$f);                  # X9 - anytime
-&and($tmp1,$b);                 # F3
- &lea($f,&DWP($K,$f,$e,1));             # tot=X+K+e
-&xor($tmp1,$d);                         # F4
- &mov($e,$a);                           # A1
-&rotl($e,5);                            # A2
-&rotr($b,1);                            # B1    <- F
- &add($f,$e);                           # tot+=a
-&rotr($b,1);                            # B1    <- F
- &add($f,$tmp1);                        # tot+=F();
        }
 sub BODY_20_39
@@ -201,42 +151,21 @@ sub BODY_20_39
        &comment("20_39 $n");
        local($n0,$n1,$n2,$n3,$np)=&Na($n);
-&mov($f,&swtmp($n0));                   # X1
+        &mov($f,&swtmp($n0));           # f to hold Xupdate(xi,xa,xb,xc,xd)
- &mov($tmp1,&swtmp($n1));               # X2
+         &mov($tmp1,$b);                # tmp1 to hold F_20_39(b,c,d)
-&xor($f,$tmp1);                         # X3
+        &xor($f,&swtmp($n1));
- &mov($tmp1,&swtmp($n2));               # X4
+         &rotr($b,2);                   # b=ROTATE(b,30)
-&xor($f,$tmp1);                         # X5
+        &xor($f,&swtmp($n2));
- &mov($tmp1,&swtmp($n3));               # X6
+         &xor($tmp1,$c);
-&xor($f,$tmp1);                         # X7 - slot
+        &xor($f,&swtmp($n3));           # f holds xa^xb^xc^xd
- &mov($tmp1,$b);                        # F1
+         &xor($tmp1,$d);                # tmp1 holds F_20_39(b,c,d)
-&rotl($f,1);                            # X8 - slot
+        &rotl($f,1);                    # f=ROTATE(f,1)
- &xor($tmp1,$c);                        # F2
+        &mov(&swtmp($n0),$f);           # xi=f
-&mov(&swtmp($n0),$f);                   # X9 - anytime
+        &lea($f,&DWP($K,$f,$e,1));      # f+=K_20_39+e
- &xor($tmp1,$d);                        # F3
+         &mov($e,$a);                   # e becomes volatile
+        &rotl($e,5);                    # e=ROTATE(a,5)
-&lea($f,&DWP($K,$f,$e,1));              # tot=X+K+e
+         &add($f,$tmp1);                # f+=F_20_39(b,c,d)
- &mov($e,$a);                           # A1
+        &add($f,$e);                    # f+=ROTATE(a,5)
-&rotl($e,5);                            # A2
-if ($n != 79) # last loop       
-        {
-        &rotr($b,1);                            # B1    <- F
-         &add($e,$tmp1);                        # tmp1=F()+a
-        &rotr($b,1);                            # B2    <- F
-         &add($f,$e);                           # tot+=tmp1;
-        }
-else
-        {
-        &add($e,$tmp1);                         # tmp1=F()+a
-         &mov($tmp1,&wparam(0));
-        &rotr($b,1);                            # B1    <- F
-         &add($f,$e);                           # tot+=tmp1;
-        &rotr($b,1);                            # B2    <- F
-        }
        }
 sub BODY_40_59
@@ -244,70 +173,27 @@ sub BODY_40_59
        local($pos,$K,$X,$n,$a,$b,$c,$d,$e,$f)=@_;
        &comment("40_59 $n");
-        return if $n & 1;
        local($n0,$n1,$n2,$n3,$np)=&Na($n);
-&mov($f,&swtmp($n0));                   # X1
+        &mov($f,&swtmp($n0));           # f to hold Xupdate(xi,xa,xb,xc,xd)
- &mov($tmp1,&swtmp($n1));               # X2
+         &mov($tmp1,$b);                # tmp1 to hold F_40_59(b,c,d)
-&xor($f,$tmp1);                         # X3
+        &xor($f,&swtmp($n1));
- &mov($tmp1,&swtmp($n2));               # X4
+         &or($tmp1,$c);
-&xor($f,$tmp1);                         # X5
+        &xor($f,&swtmp($n2));
- &mov($tmp1,&swtmp($n3));               # X6
+         &and($tmp1,$d);
-&xor($f,$tmp1);                         # X7 - slot
+        &xor($f,&swtmp($n3));           # f holds xa^xb^xc^xd
- &mov($tmp1,$b);                        # F1
+        &rotl($f,1);                    # f=ROTATE(f,1)
-&rotl($f,1);                            # X8 - slot
+        &mov(&swtmp($n0),$f);           # xi=f
- &or($tmp1,$c);                         # F2
+        &lea($f,&DWP($K,$f,$e,1));      # f+=K_40_59+e
-&mov(&swtmp($n0),$f);                   # X9 - anytime
+         &mov($e,$b);                   # e becomes volatile and is used
- &and($tmp1,$d);                        # F3
+                                        # to calculate F_40_59(b,c,d)
+        &rotr($b,2);                    # b=ROTATE(b,30)
-&lea($f,&DWP($K,$f,$e,1));              # tot=X+K+e
+         &and($e,$c);
- &mov($e,$b);                           # F4
+        &or($tmp1,$e);                  # tmp1 holds F_40_59(b,c,d)             
+         &mov($e,$a);
-&rotr($b,1);                            # B1    <- F
+        &rotl($e,5);                    # e=ROTATE(a,5)
- &and($e,$c);                           # F5
+        &add($tmp1,$e);                 # tmp1+=ROTATE(a,5)
+        &add($f,$tmp1);                 # f+=tmp1;
-&or($tmp1,$e);                          # F6
- &mov($e,$a);                           # A1
-&rotl($e,5);                            # A2
-&add($tmp1,$e);                 # tmp1=F()+a
-############################
-#       &BODY_40_59( 0,$K[2],$X,42,$A,$B,$C,$D,$E,$T);
-#       &BODY_40_59( 0,$K[2],$X,43,$T,$A,$B,$C,$D,$E);
-$n++;
-        local($n0,$n1,$n2,$n3,$np)=&Na($n);
-        ($b,$c,$d,$e,$f,$a)=($a,$b,$c,$d,$e,$f);
- &mov($f,&swtmp($n0));                  # X1
-&add($a,$tmp1);                         # tot+=tmp1; # moved was add f,tmp1
- &mov($tmp1,&swtmp($n1));               # X2
-&xor($f,$tmp1);                         # X3
- &mov($tmp1,&swtmp($n2));               # X4
-&xor($f,$tmp1);                         # X5
- &mov($tmp1,&swtmp($n3));               # X6
-&rotr($c,1);                            # B2    <- F # moved was rotr b,1
- &xor($f,$tmp1);                        # X7 - slot
-&rotl($f,1);                            # X8 - slot
- &mov($tmp1,$b);                        # F1
-&mov(&swtmp($n0),$f);                   # X9 - anytime
- &or($tmp1,$c);                         # F2
-&lea($f,&DWP($K,$f,$e,1));              # tot=X+K+e
- &mov($e,$b);                           # F4
-&and($tmp1,$d);                         # F3
- &and($e,$c);                           # F5
-&or($tmp1,$e);                          # F6
- &mov($e,$a);                           # A1
-&rotl($e,5);                            # A2
-&rotr($b,1);                            # B1    <- F
- &add($tmp1,$e);                        # tmp1=F()+a
-&rotr($b,1);                            # B2    <- F
- &add($f,$tmp1);                        # tot+=tmp1;
        }
 sub BODY_60_79
@@ -495,8 +381,7 @@ sub sha1_block_data
        # C -> E
        # D -> T
-        # The last 2 have been moved into the last loop
+        &mov($tmp1,&wparam(0));
-        # &mov($tmp1,&wparam(0));
         &mov($D,       &DWP(12,$tmp1,"",0));
        &add($D,$B);
diff --git a/src/lib/libcrypto/threads/mttest.c b/src/lib/libcrypto/threads/mttest.c
index 8973921778..7588966cb2 100644
--- a/src/lib/libcrypto/threads/mttest.c
+++ b/src/lib/libcrypto/threads/mttest.c
@@ -243,7 +243,7 @@ bad:
                goto end;
                }
-        if (cipher == NULL && issetugid() == 0)
+        if (cipher == NULL && OPENSSL_issetugid() == 0)
                cipher=getenv("SSL_CIPHER");
        SSL_load_error_strings();
diff --git a/src/lib/libcrypto/ui/ui_lib.c b/src/lib/libcrypto/ui/ui_lib.c
index 33c86d76ef..dbc9711a2d 100644
--- a/src/lib/libcrypto/ui/ui_lib.c
+++ b/src/lib/libcrypto/ui/ui_lib.c
@@ -430,14 +430,14 @@ char *UI_construct_prompt(UI *ui, const char *object_desc,
                len += sizeof(prompt3) - 1;
                prompt = (char *)OPENSSL_malloc(len + 1);
-                strlcpy(prompt, prompt1, len + 1);
+                BUF_strlcpy(prompt, prompt1, len + 1);
-                strlcat(prompt, object_desc, len + 1);
+                BUF_strlcat(prompt, object_desc, len + 1);
                if (object_name)
                        {
-                        strlcat(prompt, prompt2, len + 1);
+                        BUF_strlcat(prompt, prompt2, len + 1);
-                        strlcat(prompt, object_name, len + 1);
+                        BUF_strlcat(prompt, object_name, len + 1);
                        }
-                strlcat(prompt, prompt3, len + 1);
+                BUF_strlcat(prompt, prompt3, len + 1);
                }
        return prompt;
        }
@@ -865,8 +865,8 @@ int UI_set_result(UI *ui, UI_STRING *uis, const char *result)
                        return -1;
                        }
-                strlcpy(uis->result_buf, result,
+                BUF_strlcpy(uis->result_buf, result,
-                        uis->_.string_data.result_maxsize + 1);
+                            uis->_.string_data.result_maxsize + 1);
                break;
        case UIT_BOOLEAN:
                {
diff --git a/src/lib/libcrypto/util/mk1mf.pl b/src/lib/libcrypto/util/mk1mf.pl
index c538f9dffb..b4bc0457e5 100644
--- a/src/lib/libcrypto/util/mk1mf.pl
+++ b/src/lib/libcrypto/util/mk1mf.pl
@@ -277,6 +277,8 @@ $defs= <<"EOF";
 EOF
+$defs .= $preamble if defined $preamble;
 if ($platform eq "VC-CE")
        {
        $defs.= <<"EOF";
diff --git a/src/lib/libcrypto/util/mkdef.pl b/src/lib/libcrypto/util/mkdef.pl
index cdd2164c4e..01a1bfda19 100644
--- a/src/lib/libcrypto/util/mkdef.pl
+++ b/src/lib/libcrypto/util/mkdef.pl
@@ -1116,27 +1116,55 @@ sub print_test_file
        }
 }
+sub get_version {
+   local *MF;
+   my $v = '?';
+   open MF, 'Makefile.ssl' or return $v;
+   while (<MF>) {
+     $v = $1, last if /^VERSION=(.*?)\s*$/;
+   }
+   close MF;
+   return $v;
+}
 sub print_def_file
 {
        (*OUT,my $name,*nums,my @symbols)=@_;
        my $n = 1; my @e; my @r; my @v; my $prev="";
        my $liboptions="";
+        my $libname = $name;
+        my $http_vendor = 'www.openssl.org/';
+        my $version = get_version();
+        my $what = "OpenSSL: implementation of Secure Socket Layer";
+        my $description = "$what $version, $name - http://$http_vendor";
        if ($W32)
-                { $name.="32"; }
+                { $libname.="32"; }
        elsif ($W16)
-                { $name.="16"; }
+                { $libname.="16"; }
        elsif ($OS2)
-                { $liboptions = "INITINSTANCE\nDATA NONSHARED"; }
+                { # DLL names should not clash on the whole system.
+                  # However, they should not have any particular relationship
+                  # to the name of the static library.  Chose descriptive names
+                  # (must be at most 8 chars).
+                  my %translate = (ssl => 'open_ssl', crypto => 'cryptssl');
+                  $libname = $translate{$name} || $name;
+                  $liboptions = <<EOO;
+INITINSTANCE
+DATA MULTIPLE NONSHARED
+EOO
+                  # Vendor field can't contain colon, drat; so we omit http://
+                  $description = "\@#$http_vendor:$version#\@$what; DLL for library $name.  Build for EMX -Zmtd";
+                }
        print OUT <<"EOF";
 ;
 ; Definition file for the DLL version of the $name library from OpenSSL
 ;
-LIBRARY         $name   $liboptions
+LIBRARY         $libname        $liboptions
-DESCRIPTION     'OpenSSL $name - http://www.openssl.org/'
+DESCRIPTION     '$description'
 EOF
diff --git a/src/lib/libcrypto/util/pl/OS2-EMX.pl b/src/lib/libcrypto/util/pl/OS2-EMX.pl
index d695dda623..ddb3524210 100644
--- a/src/lib/libcrypto/util/pl/OS2-EMX.pl
+++ b/src/lib/libcrypto/util/pl/OS2-EMX.pl
@@ -3,10 +3,12 @@
 # OS2-EMX.pl - for EMX GCC on OS/2
 #
-$o='\\';
+$o='/';
-$cp='copy';
+$cp='cp';
 $rm='rm -f';
+$preamble = "SHELL=sh\n";
 # C compiler stuff
 $cc='gcc';
@@ -48,24 +50,24 @@ $bf_enc_src="";
 if (!$no_asm)
        {
-        $bn_asm_obj="crypto\\bn\\asm\\bn-os2$obj crypto\\bn\\asm\\co-os2$obj";
+        $bn_asm_obj="crypto/bn/asm/bn-os2$obj crypto/bn/asm/co-os2$obj";
-        $bn_asm_src="crypto\\bn\\asm\\bn-os2.asm crypto\\bn\\asm\\co-os2.asm";
+        $bn_asm_src="crypto/bn/asm/bn-os2.asm crypto/bn/asm/co-os2.asm";
-        $des_enc_obj="crypto\\des\\asm\\d-os2$obj crypto\\des\\asm\\y-os2$obj";
+        $des_enc_obj="crypto/des/asm/d-os2$obj crypto/des/asm/y-os2$obj";
-        $des_enc_src="crypto\\des\\asm\\d-os2.asm crypto\\des\\asm\\y-os2.asm";
+        $des_enc_src="crypto/des/asm/d-os2.asm crypto/des/asm/y-os2.asm";
-        $bf_enc_obj="crypto\\bf\\asm\\b-os2$obj";
+        $bf_enc_obj="crypto/bf/asm/b-os2$obj";
-        $bf_enc_src="crypto\\bf\\asm\\b-os2.asm";
+        $bf_enc_src="crypto/bf/asm/b-os2.asm";
-        $cast_enc_obj="crypto\\cast\\asm\\c-os2$obj";
+        $cast_enc_obj="crypto/cast/asm/c-os2$obj";
-        $cast_enc_src="crypto\\cast\\asm\\c-os2.asm";
+        $cast_enc_src="crypto/cast/asm/c-os2.asm";
-        $rc4_enc_obj="crypto\\rc4\\asm\\r4-os2$obj";
+        $rc4_enc_obj="crypto/rc4/asm/r4-os2$obj";
-        $rc4_enc_src="crypto\\rc4\\asm\\r4-os2.asm";
+        $rc4_enc_src="crypto/rc4/asm/r4-os2.asm";
-        $rc5_enc_obj="crypto\\rc5\\asm\\r5-os2$obj";
+        $rc5_enc_obj="crypto/rc5/asm/r5-os2$obj";
-        $rc5_enc_src="crypto\\rc5\\asm\\r5-os2.asm";
+        $rc5_enc_src="crypto/rc5/asm/r5-os2.asm";
-        $md5_asm_obj="crypto\\md5\\asm\\m5-os2$obj";
+        $md5_asm_obj="crypto/md5/asm/m5-os2$obj";
-        $md5_asm_src="crypto\\md5\\asm\\m5-os2.asm";
+        $md5_asm_src="crypto/md5/asm/m5-os2.asm";
-        $sha1_asm_obj="crypto\\sha\\asm\\s1-os2$obj";
+        $sha1_asm_obj="crypto/sha/asm/s1-os2$obj";
-        $sha1_asm_src="crypto\\sha\\asm\\s1-os2.asm";
+        $sha1_asm_src="crypto/sha/asm/s1-os2.asm";
-        $rmd160_asm_obj="crypto\\ripemd\\asm\\rm-os2$obj";
+        $rmd160_asm_obj="crypto/ripemd/asm/rm-os2$obj";
-        $rmd160_asm_src="crypto\\ripemd\\asm\\rm-os2.asm";
+        $rmd160_asm_src="crypto/ripemd/asm/rm-os2.asm";
        }
 if ($shlib)
diff --git a/src/lib/libcrypto/x509/by_dir.c b/src/lib/libcrypto/x509/by_dir.c
index a5c306f1fd..6207340472 100644
--- a/src/lib/libcrypto/x509/by_dir.c
+++ b/src/lib/libcrypto/x509/by_dir.c
@@ -302,8 +302,38 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                k=0;
                for (;;)
                        {
-                        snprintf(b->data,b->max,"%s/%08lx.%s%d",ctx->dirs[i],h,
+                        char c = '/';
-                                 postfix,k);
+#ifdef OPENSSL_SYS_VMS
+                        c = ctx->dirs[i][strlen(ctx->dirs[i])-1];
+                        if (c != ':' && c != '>' && c != ']')
+                                {
+                                /* If no separator is present, we assume the
+                                   directory specifier is a logical name, and
+                                   add a colon.  We really should use better
+                                   VMS routines for merging things like this,
+                                   but this will do for now...
+                                   -- Richard Levitte */
+                                c = ':';
+                                }
+                        else
+                                {
+                                c = '\0';
+                                }
+#endif
+                        if (c == '\0')
+                                {
+                                /* This is special.  When c == '\0', no
+                                   directory separator should be added. */
+                                BIO_snprintf(b->data,b->max,
+                                        "%s%08lx.%s%d",ctx->dirs[i],h,
+                                        postfix,k);
+                                }
+                        else
+                                {
+                                BIO_snprintf(b->data,b->max,
+                                        "%s%c%08lx.%s%d",ctx->dirs[i],c,h,
+                                        postfix,k);
+                                }
                        k++;
                        if (stat(b->data,&st) < 0)
                                break;
diff --git a/src/lib/libcrypto/x509/x509.h b/src/lib/libcrypto/x509/x509.h
index eaad5685a8..8d0c7e2e17 100644
--- a/src/lib/libcrypto/x509/x509.h
+++ b/src/lib/libcrypto/x509/x509.h
@@ -810,10 +810,6 @@ X509_REQ *X509_REQ_dup(X509_REQ *req);
 X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn);
 X509_NAME *X509_NAME_dup(X509_NAME *xn);
 X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);
-#ifndef OPENSSL_NO_RSA
-RSA *RSAPublicKey_dup(RSA *rsa);
-RSA *RSAPrivateKey_dup(RSA *rsa);
-#endif
 #endif /* !SSLEAY_MACROS */
diff --git a/src/lib/libcrypto/x509/x509_txt.c b/src/lib/libcrypto/x509/x509_txt.c
index 9d09ae17e8..e31ebc6741 100644
--- a/src/lib/libcrypto/x509/x509_txt.c
+++ b/src/lib/libcrypto/x509/x509_txt.c
@@ -147,8 +147,14 @@ const char *X509_verify_cert_error_string(long n)
        case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
                return("unhandled critical extension");
+        case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
+                return("key usage does not include CRL signing");
+        case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
+                return("unhandled critical CRL extension");
        default:
-                snprintf(buf,sizeof buf,"error number %ld",n);
+                BIO_snprintf(buf,sizeof buf,"error number %ld",n);
                return(buf);
                }
        }
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 2bb21b443e..2e4d0b823a 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -383,6 +383,7 @@ static int check_chain_purpose(X509_STORE_CTX *ctx)
        /* Check all untrusted certificates */
        for (i = 0; i < ctx->last_untrusted; i++)
                {
+                int ret;
                x = sk_X509_value(ctx->chain, i);
                if (!(ctx->flags & X509_V_FLAG_IGNORE_CRITICAL)
                        && (x->ex_flags & EXFLAG_CRITICAL))
@@ -393,7 +394,10 @@ static int check_chain_purpose(X509_STORE_CTX *ctx)
                        ok=cb(0,ctx);
                        if (!ok) goto end;
                        }
-                if (!X509_check_purpose(x, ctx->purpose, i))
+                ret = X509_check_purpose(x, ctx->purpose, i);
+                if ((ret == 0)
+                         || ((ctx->flags & X509_V_FLAG_X509_STRICT)
+                                && (ret != 1)))
                        {
                        if (i)
                                ctx->error = X509_V_ERR_INVALID_CA;
@@ -537,6 +541,14 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
        if(issuer)
                {
+                /* Check for cRLSign bit if keyUsage present */
+                if ((issuer->ex_flags & EXFLAG_KUSAGE) &&
+                        !(issuer->ex_kusage & KU_CRL_SIGN))
+                        {
+                        ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN;
+                        ok = ctx->verify_cb(0, ctx);
+                        if(!ok) goto err;
+                        }
                /* Attempt to get issuer certificate public key */
                ikey = X509_get_pubkey(issuer);
@@ -611,17 +623,46 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
        {
        int idx, ok;
        X509_REVOKED rtmp;
+        STACK_OF(X509_EXTENSION) *exts;
+        X509_EXTENSION *ext;
        /* Look for serial number of certificate in CRL */
        rtmp.serialNumber = X509_get_serialNumber(x);
        idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp);
-        /* Not found: OK */
+        /* If found assume revoked: want something cleverer than
-        if(idx == -1) return 1;
-        /* Otherwise revoked: want something cleverer than
         * this to handle entry extensions in V2 CRLs.
         */
-        ctx->error = X509_V_ERR_CERT_REVOKED;
+        if(idx >= 0)
-        ok = ctx->verify_cb(0, ctx);
+                {
-        return ok;
+                ctx->error = X509_V_ERR_CERT_REVOKED;
+                ok = ctx->verify_cb(0, ctx);
+                if (!ok) return 0;
+                }
+        if (ctx->flags & X509_V_FLAG_IGNORE_CRITICAL)
+                return 1;
+        /* See if we have any critical CRL extensions: since we
+         * currently don't handle any CRL extensions the CRL must be
+         * rejected. 
+         * This code accesses the X509_CRL structure directly: applications
+         * shouldn't do this.
+         */
+        exts = crl->crl->extensions;
+        for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++)
+                {
+                ext = sk_X509_EXTENSION_value(exts, idx);
+                if (ext->critical > 0)
+                        {
+                        ctx->error =
+                                X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
+                        ok = ctx->verify_cb(0, ctx);
+                        if(!ok) return 0;
+                        break;
+                        }
+                }
+        return 1;
        }
 static int internal_verify(X509_STORE_CTX *ctx)
diff --git a/src/lib/libcrypto/x509/x509_vfy.h b/src/lib/libcrypto/x509/x509_vfy.h
index f0be21f452..198495884c 100644
--- a/src/lib/libcrypto/x509/x509_vfy.h
+++ b/src/lib/libcrypto/x509/x509_vfy.h
@@ -304,17 +304,26 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
 #define         X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER             33
 #define         X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION         34
+#define         X509_V_ERR_KEYUSAGE_NO_CRL_SIGN                 35
+#define         X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION     36
 /* The application is not happy */
 #define         X509_V_ERR_APPLICATION_VERIFICATION             50
 /* Certificate verify flags */
-#define X509_V_FLAG_CB_ISSUER_CHECK             0x1     /* Send issuer+subject checks to verify_cb */
+/* Send issuer+subject checks to verify_cb */
-#define X509_V_FLAG_USE_CHECK_TIME              0x2     /* Use check time instead of current time */
+#define X509_V_FLAG_CB_ISSUER_CHECK             0x1
-#define X509_V_FLAG_CRL_CHECK                   0x4     /* Lookup CRLs */
+/* Use check time instead of current time */
-#define X509_V_FLAG_CRL_CHECK_ALL               0x8     /* Lookup CRLs for whole chain */
+#define X509_V_FLAG_USE_CHECK_TIME              0x2
-#define X509_V_FLAG_IGNORE_CRITICAL             0x10    /* Ignore unhandled critical extensions */
+/* Lookup CRLs */
+#define X509_V_FLAG_CRL_CHECK                   0x4
+/* Lookup CRLs for whole chain */
+#define X509_V_FLAG_CRL_CHECK_ALL               0x8
+/* Ignore unhandled critical extensions */
+#define X509_V_FLAG_IGNORE_CRITICAL             0x10
+/* Disable workarounds for broken certificates */
+#define X509_V_FLAG_X509_STRICT                 0x20
 int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
             X509_NAME *name);
diff --git a/src/lib/libcrypto/x509/x509type.c b/src/lib/libcrypto/x509/x509type.c
index f78c2a6b43..c25959a742 100644
--- a/src/lib/libcrypto/x509/x509type.c
+++ b/src/lib/libcrypto/x509/x509type.c
@@ -106,7 +106,7 @@ int X509_certificate_type(X509 *x, EVP_PKEY *pkey)
                break;
                }
-        if (EVP_PKEY_size(pk) <= 512/8) /* /8 because it's 512 bits we look
+        if (EVP_PKEY_size(pk) <= 1024/8)/* /8 because it's 1024 bits we look
                                           for, not bytes */
                ret|=EVP_PKT_EXP;
        if(pkey==NULL) EVP_PKEY_free(pk);
diff --git a/src/lib/libcrypto/x509v3/v3_alt.c b/src/lib/libcrypto/x509v3/v3_alt.c
index 0fae31a3a6..58b935a3b6 100644
--- a/src/lib/libcrypto/x509v3/v3_alt.c
+++ b/src/lib/libcrypto/x509v3/v3_alt.c
@@ -137,8 +137,8 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
                        X509V3_add_value("IP Address","<invalid>", &ret);
                        break;
                }
-                snprintf(oline, sizeof oline, "%d.%d.%d.%d", p[0], p[1], p[2],
+                BIO_snprintf(oline, sizeof oline,
-                         p[3]);
+                             "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
                X509V3_add_value("IP Address",oline, &ret);
                break;
diff --git a/src/lib/libcrypto/x509v3/v3_crld.c b/src/lib/libcrypto/x509v3/v3_crld.c
index 894a8b94d8..f90829c574 100644
--- a/src/lib/libcrypto/x509v3/v3_crld.c
+++ b/src/lib/libcrypto/x509v3/v3_crld.c
@@ -156,7 +156,7 @@ ASN1_SEQUENCE(DIST_POINT) = {
 IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
 ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) = 
-        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, DIST_POINT, DIST_POINT)
+        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)
 ASN1_ITEM_TEMPLATE_END(CRL_DIST_POINTS)
 IMPLEMENT_ASN1_FUNCTIONS(CRL_DIST_POINTS)
diff --git a/src/lib/libcrypto/x509v3/v3_info.c b/src/lib/libcrypto/x509v3/v3_info.c
index 28cc00686a..53e3f48859 100644
--- a/src/lib/libcrypto/x509v3/v3_info.c
+++ b/src/lib/libcrypto/x509v3/v3_info.c
@@ -121,9 +121,9 @@ static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method
                                        ERR_R_MALLOC_FAILURE);
                        return NULL;
                }
-                strlcpy(ntmp, objtmp, nlen);
+                BUF_strlcpy(ntmp, objtmp, nlen);
-                strlcat(ntmp, " - ", nlen);
+                BUF_strlcat(ntmp, " - ", nlen);
-                strlcat(ntmp, vtmp->name, nlen);
+                BUF_strlcat(ntmp, vtmp->name, nlen);
                OPENSSL_free(vtmp->name);
                vtmp->name = ntmp;
                
diff --git a/src/lib/libcrypto/x509v3/v3_purp.c b/src/lib/libcrypto/x509v3/v3_purp.c
index 4d145f71fd..b3d1ae5d1c 100644
--- a/src/lib/libcrypto/x509v3/v3_purp.c
+++ b/src/lib/libcrypto/x509v3/v3_purp.c
@@ -3,7 +3,7 @@
 * project 2001.
 */
 /* ====================================================================
- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
@@ -415,6 +415,7 @@ static void x509v3_cache_extensions(X509 *x)
 * 1 is a CA
 * 2 basicConstraints absent so "maybe" a CA
 * 3 basicConstraints absent but self signed V1.
+ * 4 basicConstraints absent but keyUsage present and keyCertSign asserted.
 */
 #define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
@@ -436,7 +437,7 @@ static int ca_check(const X509 *x)
        } else {
                if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;
                /* If key usage present it must have certSign so tolerate it */
-                else if (x->ex_flags & EXFLAG_KUSAGE) return 3;
+                else if (x->ex_flags & EXFLAG_KUSAGE) return 4;
                else return 2;
        }
 }
author	markus <>	2004-04-08 08:03:15 +0000
committer	markus <>	2004-04-08 08:03:15 +0000
commit	40d673554117d24c9f46be721235d3e302c06e04 (patch)
tree	341e7f38b840f3e503afb6e471123c0f2ba082c3 /src/lib/libc
parent	cbf88de39286be06cd20e0c65b6cb7633dce25a5 (diff)
download	openbsd-40d673554117d24c9f46be721235d3e302c06e04.tar.gz openbsd-40d673554117d24c9f46be721235d3e302c06e04.tar.bz2 openbsd-40d673554117d24c9f46be721235d3e302c06e04.zip