summaryrefslogtreecommitdiffstats
path: root/crypto/asn1
AgeCommit message (Collapse)Author
2015-01-06use correct function nameDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit cb62ab4b17818fe66d2fed0a7fe71969131c811b)
2015-01-05Constify ASN1_TYPE_cmp add X509_ALGOR_cmp.Dr. Stephen Henson
Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 4c52816d35681c0533c25fdd3abb4b7c6962302d)
2015-01-05Fix various certificate fingerprint issues.Dr. Stephen Henson
By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 684400ce192dac51df3d3e92b61830a6ef90be3e)
2015-01-04RT2914: NULL check missing in X509_name_canonRich Salz
Check for NULL return from X509_NAME_ENTRY_new() Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 2c60925d1ccc0b96287bdc9acb90198e7180d642)
2014-12-18Return error when a bit string indicates an invalid amount of bits leftKurt Roeckx
Reviewed-by: Matt Caswell <matt@openssl.org>
2014-12-17Reject invalid constructed encodings.Dr. Stephen Henson
According to X6.90 null, object identifier, boolean, integer and enumerated types can only have primitive encodings: return an error if any of these are received with a constructed encoding. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit f5e4b6b5b566320a8d774f9475540f7d0e6a704d)
2014-08-27RT2400: ASN1_STRING_to_UTF8 missing initializerRaphael Spreitzer
Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit f9fb43e176ad2a914108cd2b403425dc1ebc7262)
2014-08-06Fix OID handling:Emilia Kasper
- Upon parsing, reject OIDs with invalid base-128 encoding. - Always NUL-terminate the destination buffer in OBJ_obj2txt printing function. CVE-2014-3508 Reviewed-by: Dr. Stephen Henson <steve@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-04Add license info.Dr. Stephen Henson
(cherry picked from commit 55707a36cce3584457f687ff020842c079624ee8)
2014-07-02ASN1 sanity check.Dr. Stephen Henson
Primitive encodings shouldn't use indefinite length constructed form. PR#2438 (partial). (cherry picked from commit 398e99fe5e06edb11f55a39ce0883d9aa633ffa9)
2014-06-27Tolerate critical AKID in CRLs.Dr. Stephen Henson
PR#3014 (cherry picked from commit 11da66f8b1fbe5777fe08cc6ace9e1f2c1576a50)
2014-06-27Memory leak and NULL derefernce fixes.Dr. Stephen Henson
PR#3403
2014-06-01Set default global mask to UTF8 only.Dr. Stephen Henson
(cherry picked from commit 3009244da47b989c4cc59ba02cf81a4e9d8f8431)
2014-02-14Fix various spelling errorsScott Schaefer
(cherry picked from commit 2b4ffc659eabec29f76821f0ac624a2b8c19e4c7)
2014-01-06make updateDr. Stephen Henson
2013-12-08make updateDr. Stephen Henson
2013-03-18Encode INTEGER correctly.Dr. Stephen Henson
If an ASN1_INTEGER structure is allocated but not explicitly set encode it as zero: don't generate an invalid zero length INTEGER. (cherry picked from commit 1643edc63c3e15b6db5a15a728bc288f2cc2bbc7)
2013-01-29Don't try and verify signatures if key is NULL (CVE-2013-0166)Dr. Stephen Henson
Add additional check to catch this in ASN1_item_verify too.
2012-09-24Fix Valgrind warning.Bodo Möller
Submitted by: Adam Langley
2012-05-11PR: 2813Dr. Stephen Henson
Reported by: Constantine Sapuntzakis <csapuntz@gmail.com> Fix possible deadlock when decoding public keys.
2012-04-19Check for potentially exploitable overflows in asn1_d2i_read_bioDr. Stephen Henson
BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer in CRYPTO_realloc_clean. Thanks to Tavis Ormandy, Google Security Team, for discovering this issue and to Adam Langley <agl@chromium.org> for fixing it. (CVE-2012-2110)
2012-03-29ans1/tasn_prn.c: avoid bool in variable names [from HEAD].Andy Polyakov
PR: 2776
2012-03-12corrected fix to PR#2711 and also cover mime_param_cmpDr. Stephen Henson
2012-02-29PR: 2742Dr. Stephen Henson
Reported by: Dmitry Belyavsky <beldmit@gmail.com> If resigning with detached content in CMS just copy data across.
2012-02-28Fix memory leak cause by race condition when creating public keys.Dr. Stephen Henson
Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for reporting this bug.
2012-02-27PR: 2736Dr. Stephen Henson
Reported by: Remi Gacogne <rgacogne-bugs@coredump.fr> Preserve unused bits value in non-canonicalised ASN1_STRING structures by using ASN1_STRING_copy which preseves flags.
2012-02-27free headers after use in error messageDr. Stephen Henson
2012-02-23PR: 2711Dr. Stephen Henson
Submitted by: Tomas Mraz <tmraz@redhat.com> Tolerate bad MIME headers in parser.
2012-01-15fix warningDr. Stephen Henson
2012-01-12Sanitize usage of <ctype.h> functions. It's important that charactersAndy Polyakov
are passed zero-extended, not sign-extended [from HEAD]. PR: 2682
2012-01-11asn1/t_x509.c: fix serial number print, harmonize with a_int.c [from HEAD].Andy Polyakov
PR: 2675 Submitted by: Annie Yousar
2011-10-19"make update"Bodo Möller
2011-10-11update pkey method initialisation and copyDr. Stephen Henson
2011-10-09Backport PSS signature support from HEAD.Dr. Stephen Henson
2011-10-09Fix memory leak. From HEAD.Dr. Stephen Henson
2011-10-09Backport of password based CMS support from HEAD.Dr. Stephen Henson
2011-09-16make dependDr. Stephen Henson
2011-09-16Improved error checking for DRBG calls.Dr. Stephen Henson
New functionality to allow default DRBG type to be set during compilation or during runtime.
2011-09-05Fix memory leak on bad inputs.Bodo Möller
2011-09-02Don't use *from++ in tolower as this is implemented as a macro on someDr. Stephen Henson
platforms. Thanks to Shayne Murray <Shayne.Murray@Polycom.com> for reporting this issue.
2011-07-14PR: 2556 (partial)Dr. Stephen Henson
Reported by: Daniel Marschall <daniel-marschall@viathinksoft.de> Reviewed by: steve Fix OID routines. Check on encoding leading zero rejection should start at beginning of encoding. Allow for initial digit when testing when to use BIGNUMs which can increase first value by 2 * 40.
2011-06-22correctly encode OIDs near 2^32Dr. Stephen Henson
2011-06-03Backport libcrypto audit: check return values of EVP functions insteadDr. Stephen Henson
of assuming they will always suceed.
2011-06-03New function X509_ALGOR_set_md() to set X509_ALGOR ↵Dr. Stephen Henson
(DigestAlgorithmIdentifier) from a digest algorithm (backport from HEAD).
2011-06-03Backport CMAC support from HEAD.Dr. Stephen Henson
2011-04-30no need to include memory.hDr. Stephen Henson
2011-01-24PR: 2433Dr. Stephen Henson
Submitted by: Chris Wilson <chris@qwirx.com> Reviewed by: steve Constify ASN1_STRING_set_default_mask_asc().
2011-01-13stop warning with no-engineDr. Stephen Henson
2011-01-03Fix escaping code for string printing. If *any* escaping is enabled weDr. Stephen Henson
must escape the escape character itself (backslash).
2010-10-03Add call to ENGINE_register_all_complete() to ENGINE_load_builtin_engines(),Dr. Stephen Henson
this means that some implementations will be used automatically, e.g. aesni, we do this for cryptodev anyway. Setup cpuid in ENGINE_load_builtin_engines() too as some ENGINEs use it.
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-01 14:16:14 +0000