summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2017-01-26Prepare for 1.0.2l-devMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-01-26Prepare for 1.0.2k releaseOpenSSL_1_0_2kMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-01-26bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqr8x_internal.Andy Polyakov
CVE-2017-3732 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-01-26crypto/evp: harden RC4_MD5 cipher.Andy Polyakov
Originally a crash in 32-bit build was reported CHACHA20-POLY1305 cipher. The crash is triggered by truncated packet and is result of excessive hashing to the edge of accessible memory (or bogus MAC value is produced if x86 MD5 assembly module is involved). Since hash operation is read-only it is not considered to be exploitable beyond a DoS condition. Thanks to Robert Święcki for report. CVE-2017-3731 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-01-24Fix error handling in compute_key, BN_CTX_get can return NULLBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2132) (cherry picked from commit 7928ee4d685b727619555bc1ec0aee805f6fc8c4)
2017-01-20Fix DSA parameter generation control errorRichard Levitte
When setting the digest parameter for DSA parameter generation, the signature MD was set instead of the parameter generation one. Fortunately, that's also the one that was used for parameter generation, but it ultimately meant the parameter generator MD and the signature MD would always be the same. Fixes github issue #2016 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2250) (cherry picked from commit 8a05c4d3b5a1bfb9193ea24e71735e11de7168d2)
2017-01-18Clean one unused variable, plus an useless one.FdaSilvaYY
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1906) (cherry picked from commit 2191dc846a85ce82925cb06b4dd8649da7fc403c)
2017-01-09Fix a memory leak in RSA_padding_add_PKCS1_OAEP_mgf1Bernd Edlinger
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> GH: #2140 (cherry picked from commit c6d215e0d278fcd51ad474a3647b61e1b67290bb)
2016-12-20Reformat M_check_autoarg to match our coding styleRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2121) (cherry picked from commit 2629440d42e4d64cd0cb849c1b19fa87a4fcb90f)
2016-12-20M_check_autoarg: sanity check the keyRichard Levitte
For now, checking that the size is non-zero will suffice. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2120) (cherry picked from commit d7c8f142ea5953bf260b70a58739c1c9b0f038eb)
2016-12-12perlasm/x86_64-xlate.pl: refine sign extension in ea package.Andy Polyakov
$1<<32>>32 worked fine with either 32- or 64-bit perl for a good while, relying on quirk that [pure] 32-bit perl performed it as $1<<0>>0. But this apparently changed in some version past minimally required 5.10, and operation result became 0. Yet, it went unnoticed for another while, because most perl package providers configure their packages with -Duse64bitint option. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 82e089308bd9a7794a45f0fa3973d7659420fbd8)
2016-12-10UI_OpenSSL()'s session opener fails on MacOS XRichard Levitte
If on a non-tty stdin, TTY_get() will fail with errno == ENODEV. We didn't catch that. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2039) (cherry picked from commit c901bccec6f747467e1af31473655c8290e32309)
2016-12-10VMS UI_OpenSSL: if the TT device isn't a tty, flag instead of errorRichard Levitte
On all platforms, if the controlling tty isn't an actual tty, this is flagged by setting is_a_tty to zero... except on VMS, where this was treated as an error. Change this to behave like the other platforms. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2064)
2016-12-10Check input length to pkey_rsa_verify()Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2065) (cherry picked from commit 71bbc79b7d3b1195a7a7dd5f547d52ddce32d6f0) Conflicts: crypto/rsa/rsa_err.c include/openssl/rsa.h
2016-12-08Remove extra bangRichard Levitte
A bang (!) slipped through in the recent UI cleanup Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2051) (cherry picked from commit 949320c567811e714216ea987fe24eea1b56da5e)
2016-12-08UI code style cleanupRichard Levitte
Mostly condition check changes. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2047) (cherry picked from commit 120fb9e43656e1801c75a4fbb7c178ebec9bac18)
2016-11-25modes/ctr128.c: fix false carry in counter increment procedure.Andy Polyakov
GH issue #1916 affects only big-endian platforms. TLS is not affected, because TLS fragment is never big enough. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 76f572ed0469a277d92378848250b7a9705d3071)
2016-11-15Check return value of some BN functions.Rich Salz
Factorise multiple bn_get_top(group->field) calls Add missing checks on some conditional BN_copy return value Add missing checks on some BN_copy return value Add missing checks on a few bn_wexpand return value Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1626) (cherry picked from commit 78e09b53a40729f5e99829ccc733b592bd22fea1)
2016-11-10bn/asm/x86_64-mont.pl: fix for CVE-2016-7055 (Low severity).Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 2fac86d9abeaa643677d1ffd0a139239fdf9406a)
2016-10-25Fix leak of secrecy in ecdh_compute_key()Dr. Matthias St. Pierre
A temporary buffer containing g^xy was not cleared in ecdh_compute_key() before freeing it, so the shared secret was leaked in memory. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-10-22Correctly find all critical CRL extensionsRich Salz
Unhandled critical CRL extensions were not detected if they appeared after the handled ones. (GitHub issue 1757). Thanks to John Chuah for reporting this. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1769)
2016-10-20remove redundant zero assignmentsCristian Stoica
The structure has already been initialized to zero with memset. See also commit 64b25758edca688a30f02c260262150f7ad0bc7d (remove 0 assignments) Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com> CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1463)
2016-10-19Fix no-desRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1748)
2016-10-18Fix strict-warnings buildPatrick Steuer
crypto/evp/e_aes.c: Types of inp and out parameters of AES_xts_en/decrypt functions need to be changed from char to unsigned char to avoid build error due to -Werror=incompatible-pointer-types. crypto/aes/asm/aes-s390x.pl: Comments need to reflect the above change. Signed-off-by: Patrick Steuer <psteuer@mail.de> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> CLA: trivial
2016-10-18Fix strict-warnings buildPatrick Steuer
crypto/s390xcap.c: cryptlib.h needs to be included for OPENSSL_cpuid_setup function prototype is located there to avoid build error due to -Werror=missing-prototypes. Signed-off-by: Patrick Steuer <psteuer@mail.de> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> CLA: trivial
2016-10-15Ensure we handle len == 0 in ERR_err_string_nMatt Caswell
If len == 0 in a call to ERR_error_string_n() then we can read beyond the end of the buffer. Really applications should not be calling this function with len == 0, but we shouldn't be letting it through either! Thanks to Agostino Sarubbo for reporting this issue. Agostino's blog on this issue is available here: https://blogs.gentoo.org/ago/2016/10/14/openssl-libcrypto-stack-based-buffer-overflow-in-err_error_string_n-err-c/ Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit e5c1361580d8de79682958b04a5f0d262e680f8b)
2016-09-26Prepare for 1.0.2k-devMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-26Prepare for 1.0.2j releaseOpenSSL_1_0_2jMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-26Add some sanity checks when checking CRL scoresMatt Caswell
Note: this was accidentally omitted from OpenSSL 1.0.2 branch. Without this fix any attempt to use CRLs will crash. CVE-2016-7052 Thanks to Bruce Stephens and Thomas Jakobi for reporting this issue. Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-22Fix typo introduced by a03f81f4Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-22Prepare for 1.0.2j-devMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-22Prepare for 1.0.2i releaseOpenSSL_1_0_2iMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-21GH1555: Don't bump size on realloc failureRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 6fcace45bda108ad4d3f95261494dd479720d92c)
2016-09-21Fix a missing NULL check in dsa_builtin_paramgenMatt Caswell
We should check the last BN_CTX_get() call to ensure that it isn't NULL before we try and use any of the allocated BIGNUMs. Issue reported by Shi Lei. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 1ff7425d6130380bb00d3e64739633a4b21b11a3)
2016-09-19initialize the RSA struct to 0.Marcus Meissner
This helps with program code linked against static builds accessing a uninitialized ->engine pointer. CLA: none; trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1540)
2016-09-15VMS: only use _realloc32 with /POINTER_SIZE=32Richard Levitte
This fixes the following error when building with no particular pointer size is specified (implied 32 bit): static void *(*realloc_func) (void *, size_t) = realloc; ................................................^ %CC-E-UNDECLARED, In the initializer for realloc_func, "_realloc32" is not declared. at line number 93 in file DEV:[OPENSSL102.crypto]mem.c;1 Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-09-14Add some sanity checks around usage of t_fromb64()Matt Caswell
The internal SRP function t_fromb64() converts from base64 to binary. It does not validate that the size of the destination is sufficiently large - that is up to the callers. In some places there was such a check, but not in others. Add an argument to t_fromb64() to provide the size of the destination buffer and validate that we don't write too much data. Also add some sanity checks to the callers where appropriate. With thanks to Shi Lei for reporting this issue. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 73f0df8331910d6726d45ecaab12bd93cc48b4e2)
2016-09-11Fix memory leak on error.Dr. Stephen Henson
Backport leak fix from master branch. Thanks to Shi Lei for reporting this bug. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-09If errno is ENXIO in BSS_new_file(), set BIO_R_NO_SUCH_FILERichard Levitte
VMS sets that errno when the device part of a file spec is malformed or a logical name that doesn't exist. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit e82e2186e93e9a678dd8c0c5ba084d21d27d4d62)
2016-09-07Avoid EVP_PKEY_cmp() crash on EC keys without public componentDavid Woodhouse
Some hardware devices don't provide the public EC_POINT data. The only way for X509_check_private_key() to validate that the key matches a given certificate is to actually perform a sign operation and then verify it using the public key in the certificate. Maybe that can come later, as discussed in issue 1532. But for now let's at least make it fail gracefully and not crash. GH: 1532 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1547) (cherry picked from commit 92ed7fa575a80955f3bb6efefca9bf576a953586)
2016-09-06Misc BN fixesRich Salz
Never output -0; make "negative zero" an impossibility. Do better checking on BN_rand top/bottom requirements and #bits. Update doc. Ignoring trailing garbage in BN_asc2bn. Port this commit from boringSSL: https://boringssl.googlesource.com/boringssl/+/899b9b19a4cd3fe526aaf5047ab9234cdca19f7d%5E!/ Ensure |BN_div| never gives negative zero in the no_branch code. Have |bn_correct_top| fix |bn->neg| if the input is zero so that we don't have negative zeros lying around. Thanks to Brian Smith for noticing. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 01c09f9fde5793e0b3712d602b02e2aed4908e8d) (Some manual work required)
2016-08-31crypto/bn/*: x86[_64] division instruction doesn't handle constants, change ↵Andy Polyakov
constraint from 'g' to 'r'. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 68b4a6e91f5acd42489bb9d1c580acc5ae457cad)
2016-08-26SRP_create_verifier does not check for NULL before OPENSSL_cleanseMatt Caswell
OPENSSL_cleanse() does not validate its input parameter for NULL so SRP_create_verifier() should do so instead. Otherwise a segfault will result. Alternative solution to GitHub PR#1006 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-26Improve the definition of STITCHED_CALL in e_rc4_hmac_md5.cRichard Levitte
The definition of STITCHED_CALL relies on OPENSSL_NO_ASM. However, when a configuration simply lacks the assembler implementation for RC4 (which is where we have implemented the stitched call), OPENSSL_NO_ASM isn't implemented. Better, then, to rely on specific macros that indicated that RC4 (and MD5) are implemented in assembler. For this to work properly, we must also make sure Configure adds the definition of RC4_ASM among the C flags. (partly cherry picked from commit 216e8d91033d237880cff7da0d02d46d47bae41b) Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-08-26Fix a few leaks in X509_REQ_to_X509.FdaSilvaYY
Fix a possible leak on NETSCAPE_SPKI_verify failure. Backport of 0517538d1a39bc Backport of f6c006ea76304a Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-26ec/asm/ecp_nistz256-x86_64.pl: /cmovb/cmovc/ as nasm doesn't recognize cmovb.Andy Polyakov
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit d3034d31e7c04b334dd245504dd4f56e513ca115)
2016-08-26ec/ecp_nistz256: harmonize is_infinity with ec_GFp_simple_is_at_infinity.Andy Polyakov
RT#4625 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit e3057a57caf4274ea1fb074518e4714059dfcabf)
2016-08-26ec/asm/ecp_nistz256-x86_64.pl: addition to perform stricter reduction.Andy Polyakov
Addition was not preserving inputs' property of being fully reduced. Thanks to Brian Smith for reporting this. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit b62b2454fadfccaf5e055a1810d72174c2633b8f)
2016-08-24Avoid overflow in MDC2_Update()Dr. Stephen Henson
Thanks to Shi Lei for reporting this issue. CVE-2016-6303 Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 55d83bf7c10c7b205fffa23fa7c3977491e56c07)
2016-08-22Don't check for malloc failure twice.David Benjamin
a03f81f4ead24c234dc26e388d86a352685f3948 added a malloc failure check to EVP_PKEY_keygen, but there already was one. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1473
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-15 18:46:43 +0000