diff options
author | tedu <> | 2015-03-19 14:00:22 +0000 |
---|---|---|
committer | tedu <> | 2015-03-19 14:00:22 +0000 |
commit | 325847dec91a0775a2c9806147ab783c0737cc84 (patch) | |
tree | e1849327a9d18d917e7698c775d31f7ae7c4e34f /src/lib/libcrypto/asn1/a_set.c | |
parent | 5018b21486fe3d91084c0d32a86d1240d832e25e (diff) | |
download | openbsd-325847dec91a0775a2c9806147ab783c0737cc84.tar.gz openbsd-325847dec91a0775a2c9806147ab783c0737cc84.tar.bz2 openbsd-325847dec91a0775a2c9806147ab783c0737cc84.zip |
Fix several crash causing defects from OpenSSL.
These include:
CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error
CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp
CVE-2015-0287 - ASN.1 structure reuse memory corruption
CVE-2015-0289 - PKCS7 NULL pointer dereferences
Several other issues did not apply or were already fixed.
Refer to https://www.openssl.org/news/secadv_20150319.txt
joint work with beck, doug, guenther, jsing, miod
Diffstat (limited to 'src/lib/libcrypto/asn1/a_set.c')
-rw-r--r-- | src/lib/libcrypto/asn1/a_set.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/lib/libcrypto/asn1/a_set.c b/src/lib/libcrypto/asn1/a_set.c index ba4f28be34..63d55c3714 100644 --- a/src/lib/libcrypto/asn1/a_set.c +++ b/src/lib/libcrypto/asn1/a_set.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: a_set.c,v 1.16 2014/07/11 08:44:47 jsing Exp $ */ | 1 | /* $OpenBSD: a_set.c,v 1.17 2015/03/19 14:00:22 tedu Exp $ */ |
2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 | * All rights reserved. | 3 | * All rights reserved. |
4 | * | 4 | * |
@@ -225,7 +225,7 @@ d2i_ASN1_SET(STACK_OF(OPENSSL_BLOCK) **a, const unsigned char **pp, long length, | |||
225 | return ret; | 225 | return ret; |
226 | 226 | ||
227 | err: | 227 | err: |
228 | if (ret != NULL && (a == NULL || *a != ret)) { | 228 | if (a == NULL || *a != ret) { |
229 | if (free_func != NULL) | 229 | if (free_func != NULL) |
230 | sk_OPENSSL_BLOCK_pop_free(ret, free_func); | 230 | sk_OPENSSL_BLOCK_pop_free(ret, free_func); |
231 | else | 231 | else |