summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2017-03-06Fix an endless loop in rsa_builtin_keygen.Rich Salz
And add a test case. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2757) (cherry picked from commit 697958313ba48c8ebc832ab8f9f2b845fb7acfd4)
2017-03-03Reset executable bits on files where not needed.Bernd Edlinger
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2838)
2017-03-03Don't use deprecated EVP_CIPHER_CTX_cleanup() internallyRichard Levitte
Use EVP_CIPHER_CTX_reset() instead Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2812) (cherry picked from commit 15d95dd7ea77e68bf9d8450e52230a6017735ec0)
2017-03-02bio/b_addr.c: omit private hstrerror.Andy Polyakov
Private hstrerror was introduced to address linking problem on HP-UX, but truth be told conemporary systems, HP-UX included, wouldn't come to that call, they would use getaddrinfo and gai_strerror, while gethostbyname and h_errno are there to serve legacy systems. Since legacy systems are naturally disappearing breed, we can as well just let user interpret number. GH#2816 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 3e49ee23eab5c3fa57d14dc5f82f50cbea718322)
2017-03-01VMS: compensate for gmtime_r() parameter pointer sizeRichard Levitte
With VMS C, the second parameter takes a 32-bit pointer. When building with 64-bit pointer size default, we must compensate. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2811) (cherry picked from commit 48ce800aa5a2ccee204ad3960a20c4ca14acb3a1)
2017-02-28Don't free in cleanup routineBenjamin Kaduk
Cleanse instead, and free in the free routine. Seems to have been introduced in commit 846ec07d904f9cc81d486db0db14fb84f61ff6e5 when EVP_CIPHER_CTX was made opaque. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2798) (cherry picked from commit 5c6c4c5c333c8ac469e53521cf747ff527b8813a)
2017-02-28Code cleanup: remove the VMS specific reimplementation of gmtimeRichard Levitte
This reimplementation was necessary before VMS C V7.1. Since that's the minimum version we support in this OpenSSL version, the reimplementation is no longer needed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2762) (cherry picked from commit 9d70ac97d9d8720e6ed280609c844da403b80440)
2017-02-24Increase the size of the stack buffer to prevent an overflow.Pauli
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2721) (cherry picked from commit 8fce04ee3540ba3039bb66df34ea3f076a599ab9)
2017-02-23Fix potential memory leak in ASN1_TIME_to_generalizedtime()Todd Short
If ret is allocated, it may be leaked on error. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2666) (cherry picked from commit 4483e23444fa18034344874ffbe67919207e9e47)
2017-02-23Add -Wundef to strict-warningsRich Salz
Avoid a -Wundef warning in o_str.c Avoid a -Wundef warning in testutil.h Include internal/cryptlib.h before openssl/stack.h to avoid use of undefined symbol OPENSSL_API_COMPAT. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2709)
2017-02-22Fix typo, should be && rather than &Richard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2689) (cherry picked from commit 50799f3558981eac0482d3ea77b21c58b56d4871)
2017-02-22Fix typo, missing ||Richard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2707) (cherry picked from commit 6eb837583758506607f538fe2a3dd87925e4e69d)
2017-02-22Iterate over EC_GROUP's poly array in a safe wayRich Salz
Prevent that memory beyond the last element is accessed if every element of group->poly[] is non-zero Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2689) (cherry picked from commit 57f48f939ed5d3119e3c691ea0a8a3ac2f4a1a9e)
2017-02-22Have the directory reader use the Unix API on VMSRichard Levitte
opendir(), readdir() and closedir() have been available on VMS since version 7.0. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2707) (cherry picked from commit d8eaaf15356e1559f0f669b430b0d22b3514f8f0)
2017-02-21Fix memory leak in pkcs12 -exportDmitry Belyavskiy
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2676) (cherry picked from commit 1b8f19379a521ec11ce37e12316dd3edc0acfb82)
2017-02-21Fix a few memleaks in TXT_DB.Bernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2684) (cherry picked from commit 9ad52c562a93c9a57ae3024e54c575430753244c)
2017-02-21Prevent OOB in SRP base64 code.Rich Salz
Change size comparison from > (GT) to >= (GTE) to ensure an additional byte of output buffer, to prevent OOB reads/writes later in the function Reject input strings larger than 2GB Detect invalid output buffer size and return early Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2672) (cherry picked from commit ecca16632a73bb80ee27cdec8a97f6def0a4714d)
2017-02-21Removed ugly size_t less than zero check.Hikar
CLA: trivial. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2674) (cherry picked from commit 5e1f879ab5a2bfdf2d58222f965f93fe1b511ce7)
2017-02-21Ensure minsize >= sizeof(SH_LIST)Pauli
The sh_add_to_list function will overwrite subsequent slots in the free list for small allocations. This causes a segmentation fault if the writes goes off the end of the secure memory. I've not investigated if this problem can overwrite memory without the segmentation fault, but it seems likely. This fix limits the minsize to the sizeof of the SH_LIST structure (which also has a side effect of properly aligning the pointers). The alternative would be to return an error if minsize is too small. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2657) (cherry picked from commit 70e14ffbaf6a67dab56c24cae01f1248cf3f1e77)
2017-02-20Don't call memcpy if len is zero.Rich Salz
Prevent undefined behavior in CRYPTO_cbc128_encrypt: calling this function with the 'len' parameter being 0 would result in a memcpy where the source and destination parameters are the same, which is undefined behavior. Do same for AES_ige_encrypt. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2671) (cherry picked from commit b1498c98f3fb5b8a340acc9ce20b0fd5346294e5)
2017-02-17Fix a slightly confusing if condition in a2i_ASN1_INTEGER.Bernd Edlinger
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2640) (cherry picked from commit aa402e2ba408254c052b5750b14e7f01e48bced1)
2017-02-16Use _WIN32 over WIN32 for preprocessor conditionalBenjamin Kaduk
The intent seems to be that the WIN32 symbol is for things that are a direct byproduct of being a windows-variant configuration and should be used for feature en/disablement on windows systems. Use of the _WIN32 symbol is more widespread, being used to implement platform portability of more generic code. We do define WIN32 in some situations in e_os.h, but that is not included universally. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2642) (cherry picked from commit ac879ed62a19f3c878f7be3020a1b93cc77f4b38)
2017-02-15Properly zero cipher_data for ChaCha20-Poly1305 on cleanupKazuki Yamaguchi
Fix a typo. Probably this has not been found because EVP_CIPHER_CTX is smaller than EVP_CHACHA_AEAD_CTX and heap overflow does not occur. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2294) (cherry picked from commit a8f957686675194d786b41f6e1f7c48bb85723ec)
2017-02-15crypto/armcap.c: short-circuit processor capability probe in iOS builds.Andy Polyakov
Capability probing by catching SIGILL appears to be problematic on iOS. But since Apple universe is "monocultural", it's actually possible to simply set pre-defined processor capability mask. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2617) (cherry picked from commit 8653e78f4319b23d60239f9557d8c1e1d23be1a5)
2017-02-15ARMv4 assembly pack: harmonize Thumb-ification of iOS build.Andy Polyakov
Three modules were left behind in a285992763f3961f69a8d86bf7dfff020a08cef9. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2617) (cherry picked from commit c93f06c12f10c07cea935abd78a07a037e27f155)
2017-02-14Fix a few typosFdaSilvaYY
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2571) (cherry picked from commit 7e12cdb52e3f4beff050caeecf3634870bb9a7c4)
2017-02-14Remove obsolete commentGuido Vranken
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1613) (cherry picked from commit 7c120357e5ef434c8a7d1d1c3ba4f2a33266374e)
2017-02-14Prevent allocations of size 0 in sh_init.Guido Vranken
which are not possible with the default OPENSSL_zalloc, but are possible if the user has installed their own allocator using CRYPTO_set_mem_functions. If the 0-allocations succeeds, the secure heap code will later access (at least) the first byte of that space, which is technically an OOB access. This could lead to problems with some custom allocators that only return a valid pointer for subsequent free()-ing, and do not expect that the pointer is actually dereferenced. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2605) (cherry picked from commit 7f07149d25f8d7e00e9350ff2f064a4d25c1a13d)
2017-02-14mem leak on error path and error propagation fixYuchi
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2559) (cherry picked from commit e0670973d5c0b837eb5a9f1670e47107f466fbc7)
2017-02-13Further improvements to ASYNC_WAIT_CTX_clear_fdAndrea Grandi
Remove call to cleanup function Use only one loop to find previous element Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2581) (cherry picked from commit 219aa86cb04e1bfc9c156fab18da2f767502afb2)
2017-02-13Remove fd from the list when the engine clears the wait context before pauseAndrea Grandi
This fixes the num of fds added/removed returned by ASYNC_WAIT_CTX_get_changed_fds Previously, the numbers were not consistent with the fds actually written in the buffers since the fds that have been both added and removed are explicitly ignored in the loop. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2581) (cherry picked from commit f89dd6738a0ec2b6cfb05a3cc5fa38843dc27d2f)
2017-02-13DES keys are not 7 days long.Darren Tucker
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2604) (cherry picked from commit 4fd7b54dc224930a0ce6dd67b35c598c5072857c)
2017-02-10Restore EVP_CIPH_FLAG_LENGTH_BITS working properlyLukasz Pawelczyk
EVP_CIPH_FLAG_LENGTH_BITS flag for CFB1 has been broken with the introduction of the is_partially_overlapping() check that did not take it into the account (treating number of bits passed as bytes). This remedies that and allows this flag to work as intended. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1942) (cherry picked from commit 64846096b18340b9a39ddd29a7a0e23c56f22959)
2017-02-07Fix a crash in EVP_CIPHER_CTX_cleanup due to cipher_data may be NULLBernd Edlinger
or EVP_CTRL_INIT/EVP_CTRL_COPY was not called or failed. If that happens in EVP_CipherInit_ex/EVP_CIPHER_CTX_copy set cipher = NULL, aes_gcm_cleanup should check that gctx != NULL before calling OPENSSL_cleanse. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2562) (cherry picked from commit 273a0218e65f1737cdbb0ef65a5ddebd601e6bef)
2017-02-05Fix a crash with malformed user notice policy numbersBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2352) (cherry picked from commit fe4075f25962dbd302d856c11ac47adb84edc9ca)
2017-02-05Combined patch against OpenSSL_1_1_0-stable branch for the following issues:Bernd Edlinger
Fixed a memory leak in ASN1_digest and ASN1_item_digest. Reworked error handling in asn1_item_embed_new. Fixed error handling in int_ctx_new and EVP_PKEY_CTX_dup. Fixed a memory leak in CRYPTO_free_ex_data. Reworked error handing in x509_name_ex_d2i, x509_name_encode and x509_name_canon. Check for null pointer in tls_process_cert_verify. Fixes #2103 #2104 #2105 #2109 #2111 #2115 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2163)
2017-02-03Grouped data declarations [skip ci]Dmitry Kostjuchenko
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1981) (cherry picked from commit bc1dba209533f2033a4de0d93380fc0f485e6f7e)
2017-02-03Removed tab spaces.Dmitry Kostjuchenko
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1981) (cherry picked from commit 5d5eed4456ebc035893eedbcc4e32a9d065cecb3)
2017-02-03Corrections according the review comments.Dmitry Kostjuchenko
Updated indentations according project rules, renamed file-local define to the shorter version - USE_RWLOCK, fixed declaration after the if statement in CRYPTO_THREAD_lock_new(). Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1981) (cherry picked from commit ec93a2921f6128ac931466ae171fba92a0eab45d)
2017-02-03Compile fix on platforms with missing pthread_rwlock_t.Dmitry Kostjuchenko
Fix compilation on platforms with missing pthread_rwlock_t implementation by replacing it with pthread_mutex_t. An example of such platform can be Android OS 2.0 - 2.1, API level 5 (Eclair), Android NDK platform - android-5 where pthread_rwlock_t is not implemented and is missing in pthread.h. In case of missing pthread_rwlock_t implementation CRYPTO_RWLOCK will work as exclusive lock in write-only mode of pthread_rwlock_t lock. The implementation based on pthread_mutex_t must be using PTHREAD_MUTEX_RECURSIVE mode to be compatible with recursive behavior of pthread_rwlock_rdlock. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1981) (cherry picked from commit 2accf3f7e013c3d02312afc27cc2edbd1f149db3)
2017-02-01bn: fix occurance of negative zero in BN_rshift1()Richard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 0a2dcb6990dacc94337f746f4f4a6dfac1fbeac4)
2017-02-01bn: fix occurances of negative zeroGeoff Thorpe
The BIGNUM behaviour is supposed to be "consistent" when going into and out of APIs, where "consistent" means 'top' is set minimally and that 'neg' (negative) is not set if the BIGNUM is zero (which is iff 'top' is zero, due to the previous point). The BN_DEBUG testing (make test) caught the cases that this patch corrects. Note, bn_correct_top() could have been used instead, but that is intended for where 'top' is expected to (sometimes) require adjustment after direct word-array manipulation, and so is heavier-weight. Here, we are just catching the negative-zero case, so we test and correct for that explicitly, in-place. Change-Id: Iddefbd3c28a13d935648932beebcc765d5b85ae7 Signed-off-by: Geoff Thorpe <geoff@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1672) (cherry picked from commit 38d1b3cc0271008b8bd130a2c4b442775b028a08)
2017-02-01bn: catch negative zero as an errorGeoff Thorpe
Change-Id: I5ab72ad0aae9069b47d5b7b7b9e25bd1b7afa251 Signed-off-by: Geoff Thorpe <geoff@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1672) (cherry picked from commit 2fc9b36a96ccd77cbd9ecfb3a3cdaa7ad2ca305e)
2017-02-01bn: fix BN_DEBUG + BN_DEBUG_RAND supportGeoff Thorpe
Couple of updates to make this code work properly again; * use OPENSSL_assert() instead of assert() (and #include <assert.h>) * the circular-dependency-avoidance uses RAND_bytes() (not pseudo) Change-Id: Iefb5a9dd73f71fd81c1268495c54a64378955354 Signed-off-by: Geoff Thorpe <geoff@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1672) (cherry picked from commit 0b50ac1a0fe907f4effcf3f2f36dac32523938c5)
2017-01-29Fix faulty freeRichard Levitte
On error, i2o_SCT_signature() and i2o_SCT() free a pointer that may have wandered off from the start of the allocated block (not currently true for i2o_SCT_signature(), but has that potential as the code may change. To avoid this, save away the start of the allocated block and free that instead. Thanks to Guido Vranken for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2323) (cherry picked from commit d85d3c993e322d3e4c3f00be2910faa8c55b40e3)
2017-01-28X509_CRL_digest() - ensure precomputed sha1 hash before returning itRichard Levitte
X509_CRL_digest() didn't check if the precomputed sha1 hash was actually present. This also makes sure there's an appropriate flag to check. Reviewed-by: Kurt Roeckx <kurt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2314) (cherry picked from commit 6195848b2eea627c47f74b63eb2ba3dc3d5b6436)
2017-01-26bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqr8x_internal.Andy Polyakov
CVE-2017-3732 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-01-26Better check of DH parameters in TLS dataRichard Levitte
When the client reads DH parameters from the TLS stream, we only checked that they all are non-zero. This change updates the check to use DH_check_params() DH_check_params() is a new function for light weight checking of the p and g parameters: check that p is odd check that 1 < g < p - 1 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2017-01-26crypto/evp: harden AEAD ciphers.Andy Polyakov
Originally a crash in 32-bit build was reported CHACHA20-POLY1305 cipher. The crash is triggered by truncated packet and is result of excessive hashing to the edge of accessible memory. Since hash operation is read-only it is not considered to be exploitable beyond a DoS condition. Other ciphers were hardened. Thanks to Robert Święcki for report. CVE-2017-3731 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-01-26crypto/evp: harden RC4_MD5 cipher.Andy Polyakov
Originally a crash in 32-bit build was reported CHACHA20-POLY1305 cipher. The crash is triggered by truncated packet and is result of excessive hashing to the edge of accessible memory (or bogus MAC value is produced if x86 MD5 assembly module is involved). Since hash operation is read-only it is not considered to be exploitable beyond a DoS condition. Thanks to Robert Święcki for report. CVE-2017-3731 Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-23 11:23:04 +0000