summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2022-05-05Drop ossl_provider_clear_all_operation_bits() and all uses of itRichard Levitte
This is a misused function, as it was called during query cache flush, when the provider operation bits were meant to record if methods for a certain operation has already been added to the method store. Fixes #18150 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18151) (cherry picked from commit 20b6d85ab2b9cfa4cd29d2422d69c3e3f4db0a41)
2022-05-05crmf_lib.c: Make sure Ed signature for POPO is called without digestDr. David von Oheimb
Fixes #18184 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18230) (cherry picked from commit de56f726e163e99128ff93a04d74a8461f5a724b)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-05-03Fix OCSP_basic_verify signer certificate validationMatt Caswell
The function `OCSP_basic_verify` validates the signer certificate on an OCSP response. The internal function, ocsp_verify_signer, is responsible for this and is expected to return a 0 value in the event of a failure to verify. Unfortunately, due to a bug, it actually returns with a postive success response in this case. In the normal course of events OCSP_basic_verify will then continue and will fail anyway in the ocsp_check_issuer function because the supplied "chain" value will be empty in the case that ocsp_verify_signer failed to verify the chain. This will cause OCSP_basic_verify to return with a negative result (fatal error). Normally in the event of a failure to verify it should return with 0. However, in the case of the OCSP_NOCHECKS flag being used, OCSP_basic_verify will return with a positvie result. This could lead to callers trusting an OCSP Basic response when it should not be. CVE-2022-1343 Fixes #18053 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-05-02fix_dh_paramgen_type: Avoid crash with invalid paramgen typeTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18202) (cherry picked from commit 359dad5178285d5471f2a57a5aa99c1f588dffcb)
2022-05-02http_client.c: check expected content type only if HTTP status code is 200 (OK)Dr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/18204) (cherry picked from commit e3477d3e5ccd971da3d8a90a7d5096b47372d288)
2022-04-27siphash: Fail finalization on uninitialized siphash contextTomas Mraz
Fixes #18140 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18142) (cherry picked from commit 650b142c2e4c1d57868bdbbe1f7f4549ee77f8eb)
2022-04-26Ensure we initialized the locale before evp_pkey_name2typeDmitry Belyavskiy
Fixes #18158 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18175)
2022-04-25Use .s extension for ia64 assemblerJon Spillett
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18136) (cherry picked from commit 6009997abd2594d5a7c0606176f404190922b74d)
2022-04-25Fix bug in OPENSSL_LH_flushHugo Landau
Fixes #18139. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18141) (cherry picked from commit e5da68183410c06f7b350a0721bc2bd6057e438e)
2022-04-22Never use `__atomic_*` on macOS 10.7 and 10.8Kirill A. Korinsky
macOS 10.7 and 10.8 had a bit wired clang which is detected as `__GNUC__` which has `__ATOMIC_ACQ_REL` but it excepts one option at `__atomic_is_lock_free` instead of 2. This prevents OpenSSL to be compiled on such systems. Fixes: #18055 Signed-off-by: Kirill A. Korinsky <kirill@korins.ky> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18056) (cherry picked from commit d39de4792dbdb6ab5f78c79d52d0210b44584538)
2022-04-21str[n]casecmp => OPENSSL_strncasecmpDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21Public API functions OPENSSL_str[n]casecmpDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21Clear incorrectly reported errors in cms_io.Daniel Fiala
Fixes openssl#17841. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18109) (cherry picked from commit 45a3c592b94b66cab72e5bffbaf9d810c3fb29c0)
2022-04-14Add error code for unsupported explicit parametersTomas Mraz
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17998) (cherry picked from commit 53137462f42f8673fbd5b0831f8ea051ddea509f)
2022-04-14Import only named params into FIPS moduleTomas Mraz
Fixes #17978 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17998) (cherry picked from commit 638c3a28af45bd81a1c90b81efd8e10449eace1b)
2022-04-13Check the return of EVP_KDF_fetch()tangyiqun
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18096) (cherry picked from commit 02119faee397565525151eb2ce39c424d129d287)
2022-04-12Add return value check of X509V3_add_value() in X509V3_parse_list()Zhou Qingyang
X509V3_add_value() will return 0 on malloc failure, which could lead to err logic in X509V3_parse_list(). Fix this by adding return value check of X509V3_add_value(). Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18077) (cherry picked from commit bcd5645b34c319b8e4d72d6850ead80e85f18921)
2022-04-11Crypto/evp: Fix null pointer dereferenceyuanjungong
Check the return value of EVP_KDF_fetch to avoid a potential null pointer dereference. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18062) (cherry picked from commit 5f1424c6bdca8ddb9d5d88a78a1d738be19c4ea8)
2022-04-07Fix failure to check result of bn_rshift_fixed_topHugo Landau
Fixes #18010. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18034) (cherry picked from commit bc6bac8561ead83d6135f376ffcbbb0b657e64fe)
2022-04-03Fix Coverity 1503096: out-of-bounds accessPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/17898) (cherry picked from commit d1592f21c0d4c2c94a8c6004cf7b5cad2dcb2637)
2022-03-30sparse array: reduces the block sizePauli
This becomes a performance improvement in the ossl_sa_doall_arg function which has started appearing on profile output. The other ossl_sa_ functions don't contribute significantly to profile output. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17973) (cherry picked from commit 514bd51a8cb901a7351ecdc45a680d6aba720b5a)
2022-03-28Remove statistics tracking from LHASHHugo Landau
Fixes #17928. Supercedes #17931. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17935) (cherry picked from commit 77d7b6eebb411fdb2c3d1390ac779300757aa9dc)
2022-03-25s390x: Hide internal cpuid symbol and functionJuergen Christ
The symbol OPENSSL_s390xcap_P and the OPENSSL_cpuid_setup function are not exported by the version script of OpenSSL. However, if someone uses the static library without the version script, these symbols all of a sudden become global symbols and their usage in assembler code does not correctly reflect that for PIC. Since these symbols should never be used outside of OpenSSL, hide them inside the binary. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17946) (cherry picked from commit 37816ef5757e458be9648481e56bf698ee3bfbb1)
2022-03-25Fix Coverity 1498612: integer overflowPauli
The assert added cannot ever fail because (current & 0xFFFF) != 0 from the while loop and the trailing zero bit count therefore cannot be as large as 32. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17892) (cherry picked from commit 81487b65b9eb8148471e729b8c1959521d62c69e)
2022-03-23Fix Coverity 1201763 uninitialised pointer readPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17890) (cherry picked from commit a0238b7ed87998c48b1c92bad7fa82dcbba507f9)
2022-03-21Fix coverity 1498607: uninitialised valuePauli
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17897) (cherry picked from commit 70cd9a51911e9a4e2f24e29ddd84fa9fcb778b63)
2022-03-18eng_dyn: Avoid spurious errors when checking for 1.1.x engineTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17901) (cherry picked from commit bd5c91c82cdc4b6ffe4a2970f9512fc5ec7d2d06)
2022-03-18Fix declaration inconsistency (Camellia)Hugo Landau
Fixes #17911. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17912) (cherry picked from commit a12a71fafbe9b0ce90a51098fbf166d9da62b111)
2022-03-15Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-03-15Fix possible infinite loop in BN_mod_sqrt()Tomas Mraz
The calculation in some cases does not finish for non-prime p. This fixes CVE-2022-0778. Based on patch by David Benjamin <davidben@google.com>. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 9eafb53614bf65797db25f467946e735e1b43dc9)
2022-03-15Fix signed integer overflow in evp_encHugo Landau
Fixes #17869. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17870) (cherry picked from commit 1832bb0f02e519a48f06a10467c7ce5f7f3feeeb)
2022-03-15Fixed typo in inner_evp_generic_fetch() error handlingOliver Roberts
Fixes #17876 CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17877) (cherry picked from commit ef9909f3c6471ba39be1e3d18a366044cbf30a19)
2022-03-15EVP_MD performance fix (refcount cache contention)Hugo Landau
Partial fix for #17064. Avoid excessive writes to the cache line containing the refcount for an EVP_MD object to avoid extreme cache contention when using a single EVP_MD at high frequency on multiple threads. This changes performance in 3.0 from being double that of 1.1 to only slightly higher than that of 1.1. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17857) (cherry picked from commit c0b7dac66edde45b8da80918f5b5b62d1e766a0c)
2022-03-14crypto/pem/pem_lib.c: Add check for BIO_readJiasheng Jiang
As the potential failure of the BIO_read(), it should be better to add the check and return error if fails. Also, in order to decrease the same code, using 'out_free' will be better. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17754) (cherry picked from commit 2823e2e1d39479a7835d176862ec15e47a1bdecd)
2022-03-12OSSL_CMP_CTX_setup_CRM(): Fix handling of defaults from CSR and refcertDr. David von Oheimb
Also update and complete related documentation. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17726) (cherry picked from commit c8c923454b52d64234c941553d81143918e502ea)
2022-03-10check the return of OPENSSL_sk_new_nullxkernel
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/17836) (cherry picked from commit 5266af87379aecb0ae6036dee88c1a0b8083a432)
2022-03-10Avoid potential memory leakDmitry Belyavskiy
Resolves #17827 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17828) (cherry picked from commit 175355923046921a689b500f7a72455f7095708f)
2022-03-10Some platforms don't have pthread_atforkMatt Caswell
We've had a report of a linker failure on some platforms (this one was linux ARM) that apparently did not have pthread_atfork. It's strange that this has not been reported before but the simplest solution is just to remove this from the library since it isn't really used anyway. Currently it is called to set up the fork handlers OPENSSL_fork_prepare, OPENSSL_fork_parent and OPENSSL_fork_child. However all of those functions are no-ops. This is a remnant from earlier code that got removed. We can safely remove it now. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17842) (cherry picked from commit 5979596247a73d1aec7310e4da0b6023ffd79623)
2022-03-08fetch: convert a NULL property query to ""Pauli
Previously, a NULL property query was never cached and this lead to a performance degregation. Now, such a query is converted to an empty string and cached. Fixes #17752 Fixes https://github.openssl.org/openssl/openssl/issues/26 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17769) (cherry picked from commit af788ad6c3624ccc4b49778a9ded2487b9dbeedd)
2022-03-03Fix NULL pointer dereference for BN_mod_exp2_montHugo Landau
This fixes a bug whereby BN_mod_exp2_mont can dereference a NULL pointer if BIGNUM argument m represents zero. Regression test added. Fixes #17648. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17783) (cherry picked from commit 43135a5d2274c24e97f50e16ce492c22eb717ab2)
2022-03-01aarch64: Fix async_fibre_swapcontext() on clang BTI buildsTom Cosgrove
Reverting to using swapcontext() when compiling with clang on BTI-enabled builds fixes the BTI setjmp() failure seen when running asynctest. The issue with setjmp/longjmp is a known clang bug: see https://github.com/llvm/llvm-project/issues/48888 Change-Id: I6eeaaa2e15f402789f1b3e742038f84bef846e29 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17698) (cherry picked from commit d2d2401aed7ff45f4c013201944e1218dce12da7)
2022-02-28crypto/x509/v3_utl.c: Add missing check for OPENSSL_strndupJiasheng Jiang
Since the potential failure of memory allocation, it should be better to check the return value of the OPENSSL_strndup(), like x509v3_add_len_value(). And following the comment of 'if (astrlen < 0)', return -1 if fails. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17737) (cherry picked from commit 366a16263959c0b6599f0b9ec18124d75560c6ef)
2022-02-28Change `strlen' argument name to `strlength' to avoid c++ reserved words.Pauli
Fixes #17753 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17764) (cherry picked from commit 28e141c45d36757e052b72685fb874968f013d43)
2022-02-21x509: handle returns from X509_TRUST_get_by_id() more consistentlyPauli
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17709) (cherry picked from commit 7b3041eba1c6e177eede0d6311d53a6b9ff58051)
2022-02-20rand: Add missing check for rand_get_globalJiasheng Jiang
As the potential failure of the rand_get_global(), for example fail to get lock, 'dgbl' could be NULL pointer and be dereferenced later. Therefore, it should be better to check it and return error if fails, like RAND_get0_primary() and other callers. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/17690) (cherry picked from commit 09dca557332a2187598932388ac7bd7bbf16172b)
2022-02-14Apply the correct Apache v2 licenseTomas Mraz
There were still a few files mentioning the old OpenSSL license. Fixes #17684 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17686) (cherry picked from commit 7585073892af9cffd28b7b5872c2b102b99af807)
2022-02-11Change condition to avoid spurious compiler complaints.Pauli
X509_TRUST_get0() is checking < 0, the code here was checking == -1. Both are equivalent in this situation but gcc-12 has conniptions about a subsequent possible NULL dereference (which isn't possible). Fixes #17665 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17668) (cherry picked from commit b84c6e86dd8ca88444207080808d1d598856041f)
2022-02-08rsa: add check after calling BN_BLINDING_lockJiasheng Jiang
As the potential failure of getting lock, we need to check the return value of the BN_BLINDING_lock() in order to avoid the dirty data. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17642) (cherry picked from commit aefbcde29166caf851cf388361d70fd0dcf17d87)
2022-02-08Check for presence of 1.1.x openssl runtimeBernd Edlinger
if the newly loaded engine contains the symbol EVP_PKEY_base_id, we know it is linked to 1.1.x openssl. Abort loading this engine, as it will definitely crash. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17112) (cherry picked from commit 14db620282bea38dc44479e562cf9bb61a716444)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-10 22:14:27 +0000