summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Fix two possible crash causing defects.OPENBSD_5_5tedu2015-03-192-0/+16
| | | | | CVE-2015-0286 - Apply fix from OpenSSL for ASN1_TYPE_cmp. CVE-2015-0292 - Backport existing fix for Base64 decoding.
* fix two remotely triggerable memory leaks.tedu2014-10-192-1/+4
| | | | tested by jasper
* backport relevant security fixes from openssl 1.0.1itedu2014-08-0914-193/+296
| | | | tested by bcook jsg
* MFC DTLS buffer overflow fix (CVE-2014-0195)sthen2014-06-051-1/+7
| | | | | | "Avoid a buffer overflow that can be triggered by sending specially crafted DTLS fragments. Fix for CVE-2014-0195, from OpenSSL. Reported to OpenSSL by Juri Aedla." From d1_both.c r1.19
* MFC DTLS "Hello Request" fix (CVE-2014-0221)sthen2014-06-051-2/+2
| | | | | | | | "Do not recurse when a 'Hello Request' message is received while getting DTLS fragments. A stream of 'Hello Request' messages will result in infinite recursion, eventually crashing the DTLS client or server. Fixes CVE-2014-0221, from OpenSSL. Reported to OpenSSL by Imre Rad." From d1_both.c r1.20
* MFC sess_cert fix (CVE-2014-3470)sthen2014-06-051-0/+8
| | | | | "Ensure that sess_cert is not NULL before trying to use it. Fixes CVE-2014-3470, from OpenSSL." From s3_clnt.c r1.66
* MFC ChangeCipherSpec fixes (CVE-2014-0224 and additional safeguard), ok jsing@sthen2014-06-054-4/+22
| | | | | | | | | | | | | "Be selective as to when ChangeCipherSpec messages will be accepted. Without this an early ChangeCipherSpec message would result in session keys being generated, along with the Finished hash for the handshake, using an empty master secret." From s3_clnt.c r1.64, s3_pkt.c r1.42, s3_srvr.c r1.59, ssl3.h r1.19 - note that the ssl3.h change has been applied to s3_locl.h instead to simplify patching. "Ensure that we do not process a ChangeCipherSpec with an empty master secret. This is an additional safeguard against early ChangeCipherSpec handling." From s3_pkt.c:1.43
* MFC, requested by deraadt@sthen2014-05-011-0/+4
| | | | | | | | | | | | | | | | | | -/-------------------------- revision 1.33 date: 2014/04/24 04:31:30; author: tedu; state: Exp; lines: +4 -0; on today's episode of things you didn't want to learn: do_ssl3_write() is recursive. and not in the simple, obvious way, but in the sneaky called through ssl3_dispatch_alert way. (alert level: fuchsia) this then has a decent chance of releasing the buffer that we thought we were going to use. check for this happening, and if the buffer has gone missing, put another one back in place. the direct recursive call is safe because it won't call ssl3_write_pending which is the function that actually does do the writing and releasing. as reported by David Ramos to openssl-dev: http://marc.info/?l=openssl-dev&m=139809493725682&w=2 ok beck -/--------------------------
* from head, will become 5.5 004_openssl.patchderaadt2014-04-121-1/+1
| | | | | | | | Changes by: tedu@cvs.openbsd.org 2014/04/10 13:01:37 Piotr Sikora pointed me at a more refined diff for the buffer release issue. Apply that version. Maybe someday upstream will wake up and then we can have the same code. https://rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guest
* MFC:djm2014-04-082-13/+27
| | | | | cherrypick fix for CVE-2014-0160 "heartbleed" vulnerability from OpenSSL git; ok sthen@
* This commit was manufactured by cvs2git to create branch 'OPENBSD_5_5'.cvs2svn2014-02-271001-357706/+0
|
* SECURITY fixes backported from openssl-1.0.1f. ok mikeb@jca2014-02-2712-26/+82
| | | | | | | | | | | | CVE-2013-4353 NULL pointer dereference with crafted Next Protocol Negotiation record in TLS handshake. Upstream: 197e0ea CVE-2013-6449 Fix crash with crafted traffic from a TLS 1.2 client. Upstream: ca98926, 0294b2b CVE-2013-6450 Fix DTLS retransmission from previous session. Upstream: 3462896
* solar's testsuite revealed insufficient validation of invalid input hashes.tedu2014-02-241-8/+10
| | | | add a more complete check for the rounds parameter. ok deraadt
* in HISTORY, say where this actually came from;schwarze2014-02-231-5/+7
| | | | ok deraadt@ bentley@
* replace spaces with tabs for indentationstsp2014-02-171-2/+2
|
* remove redundant testtedu2014-02-171-3/+2
|
* sticking strlen into a char leads to wraparound at 256. fix this andtedu2014-02-171-5/+18
| | | | | | introduce a new 'b' hash minor. still generate 'a' minors for now. reported by solar designer. diff by some combination of solar and jca. ok deraadt
* Fix inet6_opt_init() to only check extlen when extbuff is not NULLmpi2014-02-071-5/+2
| | | | | | as per RFC 3542, from DragonFlyBSD via Eitan Adler. ok bluhm@
* Remove unnecessary stdio.h include.stsp2014-02-051-2/+1
| | | | Patch by Jean-Philippe Ouellet ; ok krw@
* Always set errno when returning NULL. OK kettenis@ henning@millert2014-02-051-7/+17
|
* add explicit_bzero to NAME;jmc2014-01-221-2/+3
|
* add explicit_bzero to libc. implementation subject to change, but starttedu2014-01-223-4/+37
| | | | the ball rolling. ok deraadt.
* Ouch... recommend arc4random, not random.deraadt2014-01-211-3/+3
| | | | spotted by tedu
* obvious .Pa fixes; found with mandocdb(8)schwarze2014-01-2113-49/+49
|
* Fix an obvious .Fn/.Fa typo, found while testing mandocdb(8).schwarze2014-01-201-3/+3
|
* Usually, you don't want macros in the .Nd line, so remove instances of .Tnschwarze2014-01-191-5/+3
| | | | | | marking up words that are not trademarks (ASCII, I/O, NFS, TCP, TELNET). While here, remove .Tn markup from the same words in the body of these pages, too.
* Punctuation after macro arguments needs to be in a separate argument.schwarze2014-01-191-3/+4
| | | | Found while testing mandocdb(8).
* don't try writing past the end unless we have totedu2013-12-311-8/+16
| | | | ok gilles millert
* Move atexit(3) into crtbegin.c and certbeginS.c such that we can pass thekettenis2013-12-281-10/+1
| | | | | | | | | | right __dso_handle and have dlopen'ed shared objects run their atexit handlers when they get unloaded. This is what Linux does, and several ports depend on this behaviour (and will crash upon exit without this chang). Based on an earlier diff from matthew@ Tested by ajacoutot@ ok deraadt@
* Install a bunch more of OpenSSL manpages. ok deraadt@jca2013-12-231-1/+49
|
* Reliability fix for SHA384 SSL/TLS ciphers on strict alignmentjca2013-12-192-2/+16
| | | | | | | | | architectures. ok miod@ djm@ Upstream patch: commit cdd1acd788020d2c525331da1712ada778f1373c Author: Andy Polyakov <appro@openssl.org> Date: Wed Dec 18 21:27:35 2013 +0100
* fix double word error;jmc2013-12-191-2/+2
|
* Split out strncpy and strncat from strcpy and strcat manuals.millert2013-12-195-168/+308
| | | | Requested by deraadt@
* pseudo-code corrections from Solar Designer <solar@openwall.com>deraadt2013-12-191-4/+4
|
* inet_nsap_ntoa() and inet_nsap_addr() go away. Unused APIs from darkerderaadt2013-12-172-100/+4
| | | | days.
* no more regexp(3), so point to regex(3);jmc2013-12-051-3/+3
| | | | as advised by deraadt
* unsigned char changes for ctypederaadt2013-11-251-10/+11
| | | | re-re-reviewed by krw
* use an unsigned char instead, to avoid lots of castsderaadt2013-11-251-2/+2
|
* most obvious unsigned char casts for ctypederaadt2013-11-244-20/+27
| | | | ok jca krw ingo
* remove dead fileseric2013-11-1211-7785/+0
| | | | ok deraadt@
* permute15() should be static. Not cranking libc now, because it isderaadt2013-11-121-2/+2
| | | | not urgent.
* avoid arithetic on void *deraadt2013-11-121-4/+4
| | | | ok guenther otto
* Pull in gdtoa.h instead of declaring __dtoa() and __freedtoa() directlyguenther2013-11-012-7/+4
| | | | ok deraadt@
* tweak previous;jmc2013-10-221-4/+2
|
* delete extra words; Henri Kemppainenderaadt2013-10-221-3/+2
|
* update documentation for these functions. They now state the case regardingderaadt2013-10-211-63/+45
| | | | | | | pthreads and chroot, and safe initialization without /dev/random and such junk. If you are in control of an arc4random in another library, please look at these pages and get caught up. ok various
* Remove arc4random_stir() and arc4random_addrandom(), which none shouldderaadt2013-10-212-28/+2
| | | | | | be using directly. Well, a few rare people cloned it upstream and it will take a bit of time for them to learn. ok various
* Missed the file renames for the string functions when committing theguenther2013-10-141-1/+25
| | | | DIST_LIB/DIST_OBJ/*.do changes
* a couple of warning fixes and an RCS marker; ok markus@djm2013-10-041-2/+4
|
* replace rc4 with ChaCha20; inspired by Nick Mathewson's work on libottery;markus2013-10-012-98/+326
| | | | feedback and ok djm@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-18 11:06:46 +0000