summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2024-01-12Fix partial block encryption in cfb and ofb for s390x (legacy)Holger Dengler
Use the number of processed bytes information (num) from the generic cipher context for the partial block handling in cfb and ofb also in s390x-legacy code. For more details see 4df92c1a14 ("Fix partial block encryption in cfb and ofb for s390x"). Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23201) (cherry picked from commit f9ccd209c3d121668c51a992613c698f2a774cb3)
2024-01-11Disable build of HWAES on PPC MacsTomas Mraz
Fixes #22818 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22860) (cherry picked from commit 493ad484e9312b54d177d85e2f4aa0b636e708f0)
2024-01-11evp_fetch.c: Check meth_id instead of name_idsashan
Fixes #23226 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23238) (cherry picked from commit da840c3775f52fc9766c654b5ad6ee031ffc9fd9)
2024-01-10Fix a similar memory leak in SXNET_add_id_INTEGERBernd Edlinger
Even in the good case there was memory leak here. Add a simple test case to have at least some test coverage. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23234) (cherry picked from commit 398011848468c7e8e481b295f7904afc30934217)
2024-01-10Fix a possible memory leak in sxnet_v2iBernd Edlinger
When a subsequent call to SXNET_add_id_asc fails e.g. because user is a string larger than 64 char or the zone is a duplicate zone id, or the zone is not an integer, a memory leak may be the result. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23234) (cherry picked from commit 0151e772195fc03cce0f12e5e266e51dc15243a0)
2024-01-09Check appropriate OSSL_PARAM_get_* functions for NULLNeil Horman
The base type OSSL_PARAM getters will NULL deref if they are initalized as null. Add NULL checks for those parameters that have no expectation of returning null (int32/64/uint32/64/BN). Other types can be left as allowing NULL, as a NULL setting may be meaningful (string, utf8str, octet string, etc). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23083) (cherry picked from commit 806bbafe2df5b699feac6ef26e50c14e701950cf)
2024-01-09poly1305-ppc.pl: Fix vector register clobberingRohan McLure
Fixes CVE-2023-6129 The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs saves the the contents of vector registers in different order than they are restored. Thus the contents of some of these vector registers is corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23200) (cherry picked from commit 8d847a3ffd4f0b17ee33962cf69c36224925b34f)
2024-01-08Avoid memory leak if SXNET_add_id_INTEGER() failsTomas Mraz
Fixes Coverity 1560046 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23211) (cherry picked from commit 7054fc1ca3945342777f588fba43b77f669509ad)
2024-01-05Validate config options during x509 extension creationNeil Horman
There are several points during x509 extension creation which rely on configuration options which may have been incorrectly parsed due to invalid settings. Preform a value check for null in those locations to avoid various crashes/undefined behaviors Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23183) (cherry picked from commit bac7e687d71b124b09ad6ad3e15be9b38c08a1ba)
2024-01-03Add missing documentation for X509_ATTRIBUTE related functions.slontis
Partial fix for #8026 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22656) (cherry picked from commit f1f0731ddf6cb31d62a2c0f406b009ae9817ed7f)
2024-01-03Allow duplicate CMS attributesTomas Mraz
Fixes regression introduced with https://github.com/openssl/openssl/pull/21505 Fixes #22266 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23029) (cherry picked from commit d7e707cb4983a35b1a265c6042da410d829f3b19)
2024-01-01gate calling of evp_method_id on having a non-zero name idNeil Horman
If a name is passed to EVP_<OBJ>_fetch of the form: name1:name2:name3 The names are parsed on the separator ':' and added to the store, but during the lookup in inner_evp_generic_fetch, the subsequent search of the store uses the full name1:name2:name3 string, which fails lookup, and causes subsequent assertion failures in evp_method_id. instead catch the failure in inner_evp_generic_fetch and return an error code if the name_id against a colon separated list of names fails. This provides a graceful error return path without asserts, and leaves room for a future feature in which such formatted names can be parsed and searched for iteratively Add a simple test to verify that providing a colon separated name results in an error indicating an invalid lookup. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/23110) (cherry picked from commit 94be985cbcc1f0a5cf4f172d4a8d06c5c623122b)
2023-12-29Limit RSA-OAEP related functions to RSA keys onlyslontis
Make EVP_PKEY_CTX_set_rsa_oaep_md() and EVP_PKEY_CTX_get_rsa_oaep_md_name() only work for RSA keys. Since these calls use "digest" as a OSSL_PARAM, they should not work for other key types. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20319) (cherry picked from commit 0c3eb31b55d3c1544e4e044c2e3c939655bac93d)
2023-12-29Fix memleak in rsa_cms_decryptslontis
If a call to EVP_PKEY_CTX_set_rsa_mgf1_md() fails then the caller needs to free the label. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20319) (cherry picked from commit d32dd65053431ee744d213b336b9a03a035807e6)
2023-12-29Fix error handling in ASN1_mbstring_ncopyBernd Edlinger
Sometimes the error handling returns an ASN1_STRING object in *out although that was not passed in by the caller, and sometimes the error handling deletes the ASN1_STRING but forgets to clear the *out parameter. Therefore the caller has no chance to know, if the leaked object in *out shall be deleted or not. This may cause a use-after-free error e.g. in asn1_str2type: ==63312==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000073280 at pc 0x7f2652e93b08 bp 0x7ffe0e1951c0 sp 0x7ffe0e1951b0 READ of size 8 at 0x603000073280 thread T0 #0 0x7f2652e93b07 in asn1_string_embed_free crypto/asn1/asn1_lib.c:354 #1 0x7f2652eb521a in asn1_primitive_free crypto/asn1/tasn_fre.c:204 #2 0x7f2652eb50a9 in asn1_primitive_free crypto/asn1/tasn_fre.c:199 #3 0x7f2652eb5b67 in ASN1_item_free crypto/asn1/tasn_fre.c:20 #4 0x7f2652e8e13b in asn1_str2type crypto/asn1/asn1_gen.c:740 #5 0x7f2652e8e13b in generate_v3 crypto/asn1/asn1_gen.c:137 #6 0x7f2652e9166c in ASN1_generate_v3 crypto/asn1/asn1_gen.c:92 #7 0x7f2653307b9b in do_othername crypto/x509v3/v3_alt.c:577 #8 0x7f2653307b9b in a2i_GENERAL_NAME crypto/x509v3/v3_alt.c:492 #9 0x7f26533087c2 in v2i_subject_alt crypto/x509v3/v3_alt.c:327 #10 0x7f26533107fc in do_ext_nconf crypto/x509v3/v3_conf.c:100 #11 0x7f2653310f33 in X509V3_EXT_nconf crypto/x509v3/v3_conf.c:45 #12 0x7f2653311426 in X509V3_EXT_add_nconf_sk crypto/x509v3/v3_conf.c:312 #13 0x7f265331170c in X509V3_EXT_REQ_add_nconf crypto/x509v3/v3_conf.c:360 #14 0x564ed19d5f25 in req_main apps/req.c:806 #15 0x564ed19b8de0 in do_cmd apps/openssl.c:564 #16 0x564ed1985165 in main apps/openssl.c:183 #17 0x7f2651c4a082 in __libc_start_main ../csu/libc-start.c:308 #18 0x564ed1985acd in _start (/home/ed/OPCToolboxV5/Source/Core/OpenSSL/openssl/apps/openssl+0x139acd) 0x603000073280 is located 16 bytes inside of 24-byte region [0x603000073270,0x603000073288) freed by thread T0 here: #0 0x7f265413440f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 #1 0x7f265315a429 in CRYPTO_free crypto/mem.c:311 #2 0x7f265315a429 in CRYPTO_free crypto/mem.c:300 #3 0x7f2652e757b9 in ASN1_mbstring_ncopy crypto/asn1/a_mbstr.c:191 #4 0x7f2652e75ec5 in ASN1_mbstring_copy crypto/asn1/a_mbstr.c:38 #5 0x7f2652e8e227 in asn1_str2type crypto/asn1/asn1_gen.c:681 #6 0x7f2652e8e227 in generate_v3 crypto/asn1/asn1_gen.c:137 #7 0x7f2652e9166c in ASN1_generate_v3 crypto/asn1/asn1_gen.c:92 #8 0x7f2653307b9b in do_othername crypto/x509v3/v3_alt.c:577 #9 0x7f2653307b9b in a2i_GENERAL_NAME crypto/x509v3/v3_alt.c:492 #10 0x7f26533087c2 in v2i_subject_alt crypto/x509v3/v3_alt.c:327 #11 0x7f26533107fc in do_ext_nconf crypto/x509v3/v3_conf.c:100 #12 0x7f2653310f33 in X509V3_EXT_nconf crypto/x509v3/v3_conf.c:45 #13 0x7f2653311426 in X509V3_EXT_add_nconf_sk crypto/x509v3/v3_conf.c:312 #14 0x7f265331170c in X509V3_EXT_REQ_add_nconf crypto/x509v3/v3_conf.c:360 #15 0x564ed19d5f25 in req_main apps/req.c:806 #16 0x564ed19b8de0 in do_cmd apps/openssl.c:564 #17 0x564ed1985165 in main apps/openssl.c:183 #18 0x7f2651c4a082 in __libc_start_main ../csu/libc-start.c:308 previously allocated by thread T0 here: #0 0x7f2654134808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0x7f265315a4fd in CRYPTO_malloc crypto/mem.c:221 #2 0x7f265315a4fd in CRYPTO_malloc crypto/mem.c:198 #3 0x7f265315a945 in CRYPTO_zalloc crypto/mem.c:236 #4 0x7f2652e939a4 in ASN1_STRING_type_new crypto/asn1/asn1_lib.c:341 #5 0x7f2652e74e51 in ASN1_mbstring_ncopy crypto/asn1/a_mbstr.c:150 #6 0x7f2652e75ec5 in ASN1_mbstring_copy crypto/asn1/a_mbstr.c:38 #7 0x7f2652e8e227 in asn1_str2type crypto/asn1/asn1_gen.c:681 #8 0x7f2652e8e227 in generate_v3 crypto/asn1/asn1_gen.c:137 #9 0x7f2652e9166c in ASN1_generate_v3 crypto/asn1/asn1_gen.c:92 #10 0x7f2653307b9b in do_othername crypto/x509v3/v3_alt.c:577 #11 0x7f2653307b9b in a2i_GENERAL_NAME crypto/x509v3/v3_alt.c:492 #12 0x7f26533087c2 in v2i_subject_alt crypto/x509v3/v3_alt.c:327 #13 0x7f26533107fc in do_ext_nconf crypto/x509v3/v3_conf.c:100 #14 0x7f2653310f33 in X509V3_EXT_nconf crypto/x509v3/v3_conf.c:45 #15 0x7f2653311426 in X509V3_EXT_add_nconf_sk crypto/x509v3/v3_conf.c:312 #16 0x7f265331170c in X509V3_EXT_REQ_add_nconf crypto/x509v3/v3_conf.c:360 #17 0x564ed19d5f25 in req_main apps/req.c:806 #18 0x564ed19b8de0 in do_cmd apps/openssl.c:564 #19 0x564ed1985165 in main apps/openssl.c:183 #20 0x7f2651c4a082 in __libc_start_main ../csu/libc-start.c:308 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23138) (cherry picked from commit 73ebaac827180bb51ccf807673758d7d06d5db21)
2023-12-22Detect and prevent recursive config parsingNeil Horman
If a malformed config file is provided such as the following: openssl_conf = openssl_init [openssl_init] providers = provider_sect [provider_sect] = provider_sect The config parsing library will crash overflowing the stack, as it recursively parses the same provider_sect ad nauseum. Prevent this by maintaing a list of visited nodes as we recurse through referenced sections, and erroring out in the event we visit any given section node more than once. Note, adding the test for this revealed that our diagnostic code inadvertently pops recorded errors off the error stack because provider_conf_load returns success even in the event that a configuration parse failed. The call path to provider_conf_load has been updated in this commit to address that shortcoming, allowing recorded errors to be visibile to calling applications. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22898) (cherry picked from commit 682fd21afb5428b5716e62eaefb09a7419f9cfd7)
2023-12-19LoongArch64 assembly pack: Fix ChaCha20 ABI breakageXi Ruoyao
The [LP64D ABI][1] requires the floating-point registers f24-f31 (aka fs0-fs7) callee-saved. The low 64 bits of a LSX/LASX vector register aliases with the corresponding FPR, so we must save and restore the callee-saved FPR when we writes into the corresponding vector register. This ABI breakage can be easily demonstrated by injecting the use of a saved FPR into the test in bio_enc_test.c: static int test_bio_enc_chacha20(int idx) { register double fs7 asm("f31") = 114.514; asm("#optimize barrier":"+f"(fs7)); return do_test_bio_cipher(EVP_chacha20(), idx) && fs7 == 114.514; } So fix it. To make the logic simpler, jump into the scalar implementation earlier when LSX and LASX are not enumerated in AT_HWCAP, or the input is too short. [1]: https://github.com/loongson/la-abi-specs/blob/v2.20/lapcs.adoc#floating-point-registers Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22817) (cherry picked from commit b46de72c260e7c4d9bfefa35b02295ba32ad2ac6)
2023-12-19Fix declspec align syntaxKai Pastor
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23072) (cherry picked from commit dfd986b6f5402e5646e42425d14f098ed6bc4544)
2023-12-19Fix comment syntaxKai Pastor
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23072) (cherry picked from commit 1fda942e8cd425263433094bf8714a80c05bcb2c)
2023-12-13Harden asn1 oid loader to invalid inputsNeil Horman
In the event that a config file contains this sequence: ======= openssl_conf = openssl_init config_diagnostics = 1 [openssl_init] oid_section = oids [oids] testoid1 = 1.2.3.4.1 testoid2 = A Very Long OID Name, 1.2.3.4.2 testoid3 = ,1.2.3.4.3 ====== The leading comma in testoid3 can cause a heap buffer overflow, as the parsing code will move the string pointer back 1 character, thereby pointing to an invalid memory space correct the parser to detect this condition and handle it by treating it as if the comma doesn't exist (i.e. an empty long oid name) Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22957) (cherry picked from commit a552c23c6502592c1b3c67d93dd7e5ffbe958aa4)
2023-12-13Enable BTI feature for md5 on aarch64fangming.fang
Fixes: #22959 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22971) (cherry picked from commit ad347c9ff0fd93bdd2fa2085611c65b88e94829f)
2023-12-12ossl-params: check length returned by strlen()James Muir
In param_build.c, the functions OSSL_PARAM_BLD_push_utf8_string() and OSSL_PARAM_BLD_push_utf8_ptr() use strlen() to compute the length of the string when bsize is zero. However, the size_t returned by strlen() might be too large (it is stored in an intermediate "int"), so check for that. There are analogous functions in params.c, but they do not use an intermediate "int" to store the size_t returned by strlen(). So there is some inconsistency between the implementations. Credit to Viktor D and Tomas M for spotting these missing checks. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22967) (cherry picked from commit d4d6694aa710c9970410a6836070daa6486a0ac0)
2023-12-12Fix some invalid use of sscanfMatt Caswell
sscanf can return -1 on an empty input string. We need to appropriately handle such an invalid case. The instance in OSSL_HTTP_parse_url could cause an uninitialised read of sizeof(unsigned int) bytes (typically 4). In many cases this uninit read will immediately fail on the following check (i.e. if the read value >65535). If the top 2 bytes of a 4 byte unsigned int are zero then the value will be <=65535 and the uninitialised value will be returned to the caller and could represent arbitrary data on the application stack. The OpenSSL security team has assessed this issue and consider it to be a bug only (i.e. not a CVE). Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/22961) (cherry picked from commit 322517d817ecb5c1a3a8b0e7e038fa146857b4d4)
2023-12-12Avoid an infinite loop in BN_GF2m_mod_invMatt Caswell
If p is set to 1 when calling BN_GF2m_mod_inv then an infinite loop will result. Calling this function set 1 when applications call this directly is a non-sensical value - so this would be considered a bug in the caller. It does not seem possible to cause OpenSSL internal callers of BN_GF2m_mod_inv to call it with a value of 1. So, for the above reasons, this is not considered a security issue. Reported by Bing Shi. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22960) (cherry picked from commit 9c1b8f17ce2471ca37ee3936d07aed29aab10975)
2023-12-12Deprecate SPT threading support on NonStop.Randall S. Becker
This fix removes explicit support for the SPT threading model in configurations. This also reverts commit f63e1b48ac893dd6110452e70ed08f191547cd89 that were required for SPT but broke other models. Fixes: #22798 Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22807) (cherry picked from commit 5cd17920167a8b4f7a81722a1ed3b514115702de)
2023-12-12Fix a possible memory leak in do_othernameBernd Edlinger
Since the gen->type will not be set in a2i_GENERAL_NAME the gen->d.otherName will not be automatically cleaned up by GENERAL_NAME_free. Also fixed a similar leak in a2i_GENERAL_NAME, where ASN1_STRING_set may fail but gen->d.ia5 will not be automatically cleaned up. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22996) (cherry picked from commit 1c078212f1548d7f647a1f0f12ed6df257c85cc3)
2023-12-07Add overflow checks to parse_number/parse_hex/parse_octNeil Horman
Test the next arithmetic operation to safely determine if adding the next digit in the passed property string will overflow Also, noted a bug in the parse_hex code. When parsing non-digit characters (i.e. a-f and A-F), we do a tolower conversion (which is fine), and then subtract 'a' to get the hex value from the ascii (which is definately wrong). We should subtract 'W' to convert tolower converted hex digits in the range a-f to their hex value counterparts Add tests to test_property_parse_error to ensure overflow checks work Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22874) (cherry picked from commit 986c48c4eb26861f25bc68ea252d8f2aad592735)
2023-12-06ossl_decoder_cache_flush(): Do not raise an error if there is no cacheTomas Mraz
This function can be called during OPENSSL_cleanup() when the cache was already flushed and deallocated. Fixes #22939 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22941) (cherry picked from commit 0541fa7802cf0c3a9b28d126066c909736fc5ec8)
2023-12-04After initializing a provider, check if its output dispatch table is NULLRichard Levitte
If the provider's output dispatch table is NULL, trying to parse it causes a crash. Let's not do that. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22866) (cherry picked from commit 8fa65a6648554087a67102372e5e6c8b0fae0158)
2023-12-04Fix loading more than one certificate in PEM format in X509_load_cert_file_ex()olszomal
Fixes #22895 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22885) (cherry picked from commit 20c680de9c435534be48fa85b2a975067a4e7c9d)
2023-12-01Add locking to CRYPTO_secure_usedNeil Horman
Coverity issue 1551719 noted CRYPTO_secure_used referenced a shared variable without taking the appropriate read lock. Add that. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22802) (cherry picked from commit 7eae6ee0e503b0961d4f2e75baac981f2766b892)
2023-12-01Fix a possible use after free in X509v3_asid_add_id_or_rangeBernd Edlinger
And clean up partially created choice objects, which have still the default type = -1 from ASIdentifierChoice_new(). Fixes #22700 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22745) (cherry picked from commit 49e9436af3d85963fd6156b7d6f33e0734bf5ba9)
2023-11-30bn_nist: Fix strict-aliasing violations in little-endian optimizationsXi Ruoyao
The little-endian optimization is doing some type-punning in a way violating the C standard aliasing rule by loading or storing through a lvalue with type "unsigned int" but the memory location has effective type "unsigned long" or "unsigned long long" (BN_ULONG). Convert these accesses to use memcpy instead, as memcpy is defined as-is "accessing through the lvalues with type char" and char is aliasing with all types. GCC does a good job to optimize away the temporary copies introduced with the change. Ideally copying to a temporary unsigned int array, doing the calculation, and then copying back to `r_d` will make the code look better, but unfortunately GCC would fail to optimize away this temporary array then. I've not touched the LE optimization in BN_nist_mod_224 because it's guarded by BN_BITS2!=64, then BN_BITS2 must be 32 and BN_ULONG must be unsigned int, thus there is no aliasing issue in BN_nist_mod_224. Fixes #12247. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22816) (cherry picked from commit 990d9ff508070757912c000f0c4132dbb5a0bb0a)
2023-11-24x86_64-xlate.pl: Fix build with icx and nvc compilersTomas Mraz
Fixes #22594 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22714) (cherry picked from commit 1da7c09f7987a227701b6324e56003a89e9febf2)
2023-11-23Copyright year updatesRichard Levitte
Reviewed-by: Hugo Landau <hlandau@openssl.org> Release: yes
2023-11-22Fix possible memleak in PKCS7_add0_attrib_signing_timeBernd Edlinger
When PKCS7_add_signed_attribute fails, the ASN1_TIME object may be leaked when it was not passed in as input parameter. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22772) (cherry picked from commit 7d52539f00144cb410c4e9d8da0b9574c0badb19)
2023-11-22Fix a possible memleak in CMS_sign_receiptBernd Edlinger
When an error happens after cms_encode_Receipt the ASN1_OCTET_STRING object "os" may be leaked. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22758) (cherry picked from commit 3e3aadd51cae1fbfb512cf4a0999d16c6a2888bd)
2023-11-22Fix a possible memleak in PKCS7_add_attrib_smimecapBernd Edlinger
When PKCS7_add_signed_attribute fails, the ASN1_STRING object may be leaked. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22744) (cherry picked from commit ed3d2771278cfa1c355b40c681f5acc8404156c6)
2023-11-14Force Nonstop to use fcntl(F_GETFL) in BIO_sock_nbioNeil Horman
In tracking down a hang, we found that nonstop platforms were falling into the if #ifdef FIONBIO clause in the implementation of BIO_sock_nbio. While the platform defines this macro, sockets set with this continued to operate in blocking mode. Given that the platform also support O_NONBLOCK, adjust the ifdef to have the nonstop platform use that method to ensure that sockets enter blocking mode Related-To #22588 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22696) (cherry picked from commit f63e1b48ac893dd6110452e70ed08f191547cd89)
2023-11-06Make DH_check_pub_key() and DH_generate_key() safer yetRichard Levitte
We already check for an excessively large P in DH_generate_key(), but not in DH_check_pub_key(), and none of them check for an excessively large Q. This change adds all the missing excessive size checks of P and Q. It's to be noted that behaviours surrounding excessively sized P and Q differ. DH_check() raises an error on the excessively sized P, but only sets a flag for the excessively sized Q. This behaviour is mimicked in DH_check_pub_key(). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22453) (cherry picked from commit ec061bf8ff2add8050599058557178c03295bcc0)
2023-11-03rand uniform: fix likely usagePauli
@mspncp noted that the condition should have been likely not unlikely. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22593) (cherry picked from commit b90662b4b0a6c7b6979a96581388ace7c217b470)
2023-11-03Add additional internal HPKE hardening checks resulting from code audit.Stephen Farrell
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22493) (cherry picked from commit a1c0306895bf6cf28056aaf9cd22cb3b65d4bb0a)
2023-11-01rand uniform: add comments outlining the algorithmPauli
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22499) (cherry picked from commit dfb26e03c26b9234d04cb9fcaf6391d6bfb44dc4)
2023-11-01rand: implement an unbiased random integer from a rangePauli
Refer: https://github.com/apple/swift/pull/39143 for a description of the algorithm. It is optimal in the sense of having: * no divisions * minimal number of blocks of random bits from the generator Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22499) (cherry picked from commit 55755fbf42ec073e86651065c5cce6f64662c9e6)
2023-10-30free oaep label-octet-string on errorJames Muir
When successful, ossl_X509_ALGOR_from_nid() returns a pointer to an X509_ALGOR object. Inside ossl_X509_ALGOR_from_nid(), X509_ALGOR_set0() is called, and this passes ownership of the ASN1 object "los" (label octet string) to the X509_ALGOR object. When ossl_X509_ALGOR_from_nid() fails, ownership has not been passed on and we need to free "los". Change the scope of "los" and ensure it is freed on failure (on success, set it to NULL so it is not freed inside the function). Fixes #22336 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22495) (cherry picked from commit 83efd7170bfa48a3263fcf8c771a6029646e8ad2)
2023-10-26EVP_PKEY_get_{bits,security_bits,size}(): add missing error queue entry on ↵Dr. David von Oheimb
failure Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22459) (cherry picked from commit ae643b32f91affe61dd411a58b76c8a44cbd7f50)
2023-10-26CMS and PKCS7: fix handlling of EVP_PKEY_get_size() failureDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22459) (cherry picked from commit d7ad09da778bcc0090a7cdfd87edb56eea22382b)
2023-10-26x509_print_ex: Remove unused setting when XN_FLAG_COMPAT is setDamian Hobson-Garcia
Calling X509_NAME_print_ex with XN_FLAG_COMPAT falls back to calling X509_NAME_print(). The obase parameter to X509_NAME_print() is not used, so setting it to a different value has no effect. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/19963) (cherry picked from commit 2126ca3dba3907f49b232442c06db1cae8bee0c3)
2023-10-26Fix X509_REQ_print_ex bugDamian Hobson-Garcia
Similar to the bug fixed in 02db7354fe7 (Fix bug in X509_print_ex). The error return value from X509_NAME_print_ex() is different depending on whether the flags are XN_FLAG_COMPAT or not. Apply a similar fix to what was done for X509_print_ex here as well. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/19963) (cherry picked from commit 2b5e028a2f70de216458a5140bcf4ec3d9236eeb)
2023-10-26x509_print_ex:Use correct constant for nmflag comparisonDamian Hobson-Garcia
The X509_FLAG_COMPAT constant is defined as a value of the X509_print_ex() cflags argument, and so it should not be used to compare against values for use with X509_NAME_print flags. Use XN_FLAG_COMPAT, which has the same value, instead. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/19963) (cherry picked from commit da2dd3b51ddd69aae0fd840c0d23afa954c24ded)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-02 03:29:42 +0000