Security fixes brought forward from 0.9.7.

8 files changed, 34 insertions, 13 deletions

diff --git a/crypto/bio/b_print.c b/crypto/bio/b_print.c
index 80c9cb69db..3f5d6a74bf 100644
--- a/crypto/bio/b_print.c
+++ b/crypto/bio/b_print.c
@@ -483,7 +483,7 @@ fmtint(
 {
     int signvalue = 0;
     unsigned LLONG uvalue;
-    char convert[20];
+    char convert[DECIMAL_SIZE(value)+1];
     int place = 0;
     int spadlen = 0;
     int zpadlen = 0;
@@ -508,8 +508,8 @@ fmtint(
             (caps ? "0123456789ABCDEF" : "0123456789abcdef")
             [uvalue % (unsigned) base];
         uvalue = (uvalue / (unsigned) base);
-    } while (uvalue && (place < 20));
-    if (place == 20)
+    } while (uvalue && (place < sizeof convert));
+    if (place == sizeof convert)
         place--;
     convert[place] = 0;
 
@@ -641,8 +641,8 @@ fmtfp(
             (caps ? "0123456789ABCDEF"
               : "0123456789abcdef")[intpart % 10];
         intpart = (intpart / 10);
-    } while (intpart && (iplace < 20));
-    if (iplace == 20)
+    } while (intpart && (iplace < sizeof iplace));
+    if (iplace == sizeof iplace)
         iplace--;
     iconvert[iplace] = 0;
 
@@ -653,7 +653,7 @@ fmtfp(
               : "0123456789abcdef")[fracpart % 10];
         fracpart = (fracpart / 10);
     } while (fplace < max);
-    if (fplace == 20)
+    if (fplace == sizeof fplace)
         fplace--;
     fconvert[fplace] = 0;
 
diff --git a/crypto/bio/b_sock.c b/crypto/bio/b_sock.c
index 45bd7c47e8..3188bcc69c 100644
--- a/crypto/bio/b_sock.c
+++ b/crypto/bio/b_sock.c
@@ -83,6 +83,7 @@
 static int wsa_init_done=0;
 #endif
 
+#if 0
 static unsigned long BIO_ghbn_hits=0L;
 static unsigned long BIO_ghbn_miss=0L;
 
@@ -93,6 +94,7 @@ static struct ghbn_cache_st
 	struct hostent *ent;
 	unsigned long order;
 	} ghbn_cache[GHBN_NUM];
+#endif
 
 static int get_ip(const char *str,unsigned char *ip);
 #if 0
@@ -230,6 +232,7 @@ int BIO_sock_error(int sock)
 		return(j);
 	}
 
+#if 0
 long BIO_ghbn_ctrl(int cmd, int iarg, char *parg)
 	{
 	int i;
@@ -267,6 +270,7 @@ long BIO_ghbn_ctrl(int cmd, int iarg, char *parg)
 		}
 	return(1);
 	}
+#endif
 
 #if 0
 static struct hostent *ghbn_dup(struct hostent *a)
diff --git a/crypto/bio/bf_buff.c b/crypto/bio/bf_buff.c
index 6ccda06596..1cecd70579 100644
--- a/crypto/bio/bf_buff.c
+++ b/crypto/bio/bf_buff.c
@@ -482,7 +482,7 @@ static int buffer_gets(BIO *b, char *buf, int size)
 			size-=i;
 			ctx->ibuf_len-=i;
 			ctx->ibuf_off+=i;
-			if ((flag) || (i == size))
+			if (flag || size == 0)
 				{
 				*buf='\0';
 				return(num);
diff --git a/crypto/bio/bio.h b/crypto/bio/bio.h
index c5caf253c9..ecd2899918 100644
--- a/crypto/bio/bio.h
+++ b/crypto/bio/bio.h
@@ -522,6 +522,7 @@ int	BIO_read(BIO *b, void *data, int len);
 int	BIO_gets(BIO *bp,char *buf, int size);
 int	BIO_write(BIO *b, const void *data, int len);
 int	BIO_puts(BIO *bp,const char *buf);
+int	BIO_indent(BIO *b,int indent,int max);
 long	BIO_ctrl(BIO *bp,int cmd,long larg,void *parg);
 long BIO_callback_ctrl(BIO *b, int cmd, void (*fp)(struct bio_st *, int, const char *, int, long, long));
 char *	BIO_ptr_ctrl(BIO *bp,int cmd,long larg);
@@ -608,7 +609,7 @@ int BIO_new_bio_pair(BIO **bio1, size_t writebuf1,
 
 void BIO_copy_next_retry(BIO *b);
 
-long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);
+/*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/
 
 int BIO_printf(BIO *bio, const char *format, ...);
 int BIO_vprintf(BIO *bio, const char *format, va_list args);
diff --git a/crypto/bio/bio_lib.c b/crypto/bio/bio_lib.c
index 50df2238fa..98ce395519 100644
--- a/crypto/bio/bio_lib.c
+++ b/crypto/bio/bio_lib.c
@@ -272,6 +272,18 @@ int BIO_gets(BIO *b, char *in, int inl)
 	return(i);
 	}
 
+int BIO_indent(BIO *b,int indent,int max)
+	{
+	if(indent < 0)
+		indent=0;
+	if(indent > max)
+		indent=max;
+	while(indent--)
+		if(BIO_puts(b," ") != 1)
+			return 0;
+	return 1;
+	}
+
 long BIO_int_ctrl(BIO *b, int cmd, long larg, int iarg)
 	{
 	int i;
diff --git a/crypto/bio/bss_conn.c b/crypto/bio/bss_conn.c
index f91ae4c8c6..743db6ff94 100644
--- a/crypto/bio/bss_conn.c
+++ b/crypto/bio/bss_conn.c
@@ -519,7 +519,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
 			else if (num == 2)
 				{
 				char buf[16];
-				char *p = ptr;
+				unsigned char *p = ptr;
 
 				sprintf(buf,"%d.%d.%d.%d",
 					p[0],p[1],p[2],p[3]);
@@ -530,7 +530,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
 				}
 			else if (num == 3)
 				{
-				char buf[16];
+				char buf[DECIMAL_SIZE(int)+1];
 
 				sprintf(buf,"%d",*(int *)ptr);
 				if (data->param_port != NULL)
diff --git a/crypto/bio/bss_log.c b/crypto/bio/bss_log.c
index a39d95297c..901b64f3ae 100644
--- a/crypto/bio/bss_log.c
+++ b/crypto/bio/bss_log.c
@@ -274,7 +274,7 @@ static void xsyslog(BIO *bp, int priority, const char *string)
 	LPCSTR lpszStrings[2];
 	WORD evtype= EVENTLOG_ERROR_TYPE;
 	int pid = _getpid();
-	char pidbuf[20];
+	char pidbuf[DECIMAL_SIZE(pid)+4];
 
 	switch (priority)
 		{
diff --git a/crypto/bio/bss_mem.c b/crypto/bio/bss_mem.c
index 28ff7582bf..a4edb711ae 100644
--- a/crypto/bio/bss_mem.c
+++ b/crypto/bio/bss_mem.c
@@ -190,7 +190,7 @@ static int mem_write(BIO *b, const char *in, int inl)
 
 	BIO_clear_retry_flags(b);
 	blen=bm->length;
-	if (BUF_MEM_grow(bm,blen+inl) != (blen+inl))
+	if (BUF_MEM_grow_clean(bm,blen+inl) != (blen+inl))
 		goto end;
 	memcpy(&(bm->data[blen]),in,inl);
 	ret=inl;
@@ -284,7 +284,11 @@ static int mem_gets(BIO *bp, char *buf, int size)
 
 	BIO_clear_retry_flags(bp);
 	j=bm->length;
-	if (j <= 0) return(0);
+	if (j <= 0)
+		{
+		*buf='\0';
+		return 0;
+		}
 	p=bm->data;
 	for (i=0; i<j; i++)
 		{