diff options
| author | tedu <> | 2015-03-19 14:00:22 +0000 |
|---|---|---|
| committer | tedu <> | 2015-03-19 14:00:22 +0000 |
| commit | 985dda77b7930c0837c4acb74b7bd23252f849c1 (patch) | |
| tree | e1849327a9d18d917e7698c775d31f7ae7c4e34f /src/lib/libcrypto/asn1/a_set.c | |
| parent | 6b3d8d3164d1b68d078a0cf83583f3dd8bbcb340 (diff) | |
| download | openbsd-985dda77b7930c0837c4acb74b7bd23252f849c1.tar.gz openbsd-985dda77b7930c0837c4acb74b7bd23252f849c1.tar.bz2 openbsd-985dda77b7930c0837c4acb74b7bd23252f849c1.zip | |
Fix several crash causing defects from OpenSSL.
These include:
CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error
CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp
CVE-2015-0287 - ASN.1 structure reuse memory corruption
CVE-2015-0289 - PKCS7 NULL pointer dereferences
Several other issues did not apply or were already fixed.
Refer to https://www.openssl.org/news/secadv_20150319.txt
joint work with beck, doug, guenther, jsing, miod
Diffstat (limited to 'src/lib/libcrypto/asn1/a_set.c')
| -rw-r--r-- | src/lib/libcrypto/asn1/a_set.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/lib/libcrypto/asn1/a_set.c b/src/lib/libcrypto/asn1/a_set.c index ba4f28be34..63d55c3714 100644 --- a/src/lib/libcrypto/asn1/a_set.c +++ b/src/lib/libcrypto/asn1/a_set.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: a_set.c,v 1.16 2014/07/11 08:44:47 jsing Exp $ */ | 1 | /* $OpenBSD: a_set.c,v 1.17 2015/03/19 14:00:22 tedu Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -225,7 +225,7 @@ d2i_ASN1_SET(STACK_OF(OPENSSL_BLOCK) **a, const unsigned char **pp, long length, | |||
| 225 | return ret; | 225 | return ret; |
| 226 | 226 | ||
| 227 | err: | 227 | err: |
| 228 | if (ret != NULL && (a == NULL || *a != ret)) { | 228 | if (a == NULL || *a != ret) { |
| 229 | if (free_func != NULL) | 229 | if (free_func != NULL) |
| 230 | sk_OPENSSL_BLOCK_pop_free(ret, free_func); | 230 | sk_OPENSSL_BLOCK_pop_free(ret, free_func); |
| 231 | else | 231 | else |
