OpenSSL 0.9.5 merge

*warning* this bumps shared lib minors for libssl and libcrypto from 2.1 to 2.2
if you are using the ssl26 packages for ssh and other things to work you will
need to get new ones (see ~beck/libsslsnap/<arch>) on cvs or ~beck/src-patent.tar.gz on cvs

1 files changed, 12 insertions, 7 deletions

diff --git a/src/lib/libcrypto/dh/dh_gen.c b/src/lib/libcrypto/dh/dh_gen.c
index b7bcd2c7a4..7a6a38fbb4 100644
--- a/src/lib/libcrypto/dh/dh_gen.c
+++ b/src/lib/libcrypto/dh/dh_gen.c
@@ -72,14 +72,14 @@
  * Having said all that,
  * there is another special case method for the generators 2, 3 and 5.
  * for 2, p mod 24 == 11
- * for 3, p mod 12 == 5  <<<<< does not work for strong primes.
+ * for 3, p mod 12 == 5  <<<<< does not work for safe primes.
  * for 5, p mod 10 == 3 or 7
  *
  * Thanks to Phil Karn <karn@qualcomm.com> for the pointers about the
  * special generators and for answering some of my questions.
  *
  * I've implemented the second simple method :-).
- * Since DH should be using a strong prime (both p and q are prime),
+ * Since DH should be using a safe prime (both p and q are prime),
  * this generator function can take a very very long time to run.
  */
 
@@ -95,9 +95,10 @@ DH *DH_generate_parameters(int prime_len, int generator,
         if (ret == NULL) goto err;
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
-        t1= &(ctx->bn[0]);
-        t2= &(ctx->bn[1]);
-        ctx->tos=2;
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        t2 = BN_CTX_get(ctx);
+        if (t1 == NULL || t2 == NULL) goto err;
         
         if (generator == DH_GENERATOR_2)
                 {
@@ -105,7 +106,7 @@ DH *DH_generate_parameters(int prime_len, int generator,
                 BN_set_word(t2,11);
                 g=2;
                 }
-#ifdef undef  /* does not work for strong primes */
+#ifdef undef  /* does not work for safe primes */
         else if (generator == DH_GENERATOR_3)
                 {
                 BN_set_word(t1,12);
@@ -138,7 +139,11 @@ err:
                 ok=0;
                 }
 
-        if (ctx != NULL) BN_CTX_free(ctx);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
         if (!ok && (ret != NULL))
                 {
                 DH_free(ret);