Skip to content

Commit ce0a488

Browse files
bnoordhuisShigeki Ohtsu
bnoordhuis
authored and
Shigeki Ohtsu
committed
deps: upgrade to openssl 1.0.1q
Contains fixes for: * CVE-2015-3194 Certificate verify crash with missing PSS parameter * CVE-2015-3195 X509_ATTRIBUTE memory leak fixup! character encoding noise fixup! update opensslconf.h PR-URL: #4132 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
1 parent b68781e commit ce0a488

File tree

140 files changed

+1331
-677
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

140 files changed

+1331
-677
lines changed

‎deps/openssl/asm/arm-elf-gas/bn/armv4-gf2m.S

+11-11
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,13 @@
1111
mul_1x1_neon:
1212
vshl.u64 d2,d16,#8 @ q1-q3 are slided
1313

14-
vmull.p8 q0,d16,d17 @ a·bb
14+
vmull.p8 q0,d16,d17 @ a·bb
1515
vshl.u64 d4,d16,#16
16-
vmull.p8 q1,d2,d17 @ a<<8·bb
16+
vmull.p8 q1,d2,d17 @ a<<8·bb
1717
vshl.u64 d6,d16,#24
18-
vmull.p8 q2,d4,d17 @ a<<16·bb
18+
vmull.p8 q2,d4,d17 @ a<<16·bb
1919
vshr.u64 d2,#8
20-
vmull.p8 q3,d6,d17 @ a<<24·bb
20+
vmull.p8 q3,d6,d17 @ a<<24·bb
2121
vshl.u64 d3,#24
2222
veor d0,d2
2323
vshr.u64 d4,#16
@@ -132,20 +132,20 @@ bn_GF2m_mul_2x2:
132132

133133
vmov d16,d18
134134
vmov d17,d19
135-
bl mul_1x1_neon @ a1·b1
135+
bl mul_1x1_neon @ a1·b1
136136
vmov d22,d0
137137

138138
vmov d16,d20
139139
vmov d17,d21
140-
bl mul_1x1_neon @ a0·b0
140+
bl mul_1x1_neon @ a0·b0
141141
vmov d23,d0
142142

143143
veor d16,d20,d18
144144
veor d17,d21,d19
145145
veor d20,d23,d22
146-
bl mul_1x1_neon @ (a0+a1)·(b0+b1)
146+
bl mul_1x1_neon @ (a0+a1)·(b0+b1)
147147

148-
veor d0,d20 @ (a0+a1)·(b0+b1)-a0·b0-a1·b1
148+
veor d0,d20 @ (a0+a1)·(b0+b1)-a0·b0-a1·b1
149149
vshl.u64 d1,d0,#32
150150
vshr.u64 d0,d0,#32
151151
veor d23,d1
@@ -165,7 +165,7 @@ bn_GF2m_mul_2x2:
165165
mov r12,#7<<2
166166
sub sp,sp,#32 @ allocate tab[8]
167167

168-
bl mul_1x1_ialu @ a1·b1
168+
bl mul_1x1_ialu @ a1·b1
169169
str r5,[r10,#8]
170170
str r4,[r10,#12]
171171

@@ -175,13 +175,13 @@ bn_GF2m_mul_2x2:
175175
eor r2,r2,r1
176176
eor r0,r0,r3
177177
eor r1,r1,r2
178-
bl mul_1x1_ialu @ a0·b0
178+
bl mul_1x1_ialu @ a0·b0
179179
str r5,[r10]
180180
str r4,[r10,#4]
181181

182182
eor r1,r1,r2
183183
eor r0,r0,r3
184-
bl mul_1x1_ialu @ (a1+a0)·(b1+b0)
184+
bl mul_1x1_ialu @ (a1+a0)·(b1+b0)
185185
ldmia r10,{r6-r9}
186186
eor r5,r5,r4
187187
eor r4,r4,r7

‎deps/openssl/asm/arm-elf-gas/modes/ghash-armv4.S

+3-3
Original file line numberDiff line numberDiff line change
@@ -368,8 +368,8 @@ gcm_ghash_neon:
368368
vdup.8 d4,d28[0] @ broadcast lowest byte
369369
.Linner_neon:
370370
subs r1,r1,#1
371-
vmull.p8 q9,d1,d4 @ H.lo·Xi[i]
372-
vmull.p8 q8,d0,d4 @ H.hi·Xi[i]
371+
vmull.p8 q9,d1,d4 @ H.lo·Xi[i]
372+
vmull.p8 q8,d0,d4 @ H.hi·Xi[i]
373373
vext.8 q14,q12,#1 @ IN>>=8
374374

375375
veor q10,q13 @ modulo-scheduled part
@@ -382,7 +382,7 @@ gcm_ghash_neon:
382382
vsli.8 d2,d3,#1 @ compose the "carry" byte
383383
vext.8 q10,q12,#1 @ Z>>=8
384384

385-
vmull.p8 q11,d2,d5 @ "carry"·0xe1
385+
vmull.p8 q11,d2,d5 @ "carry"·0xe1
386386
vshr.u8 d2,d3,#7 @ save Z's bottom bit
387387
vext.8 q13,q9,q12,#1 @ Qlo>>=8
388388
veor q10,q8

‎deps/openssl/config/opensslconf.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@
299299
even newer MIPS CPU's, but at the moment one size fits all for
300300
optimization options. Older Sparc's work better with only UNROLL, but
301301
there's no way to tell at compile time what it is you're running on */
302-
# if defined( sun ) /* Newer Sparc's */
302+
# if defined( __sun ) || defined ( sun ) /* Newer Sparc's */
303303
# define DES_PTR
304304
# define DES_RISC1
305305
# define DES_UNROLL

‎deps/openssl/openssl/apps/Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ update: openssl-vms.cnf local_depend
135135
depend: local_depend
136136
@if [ -z "$(THIS)" ]; then $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; fi
137137
local_depend:
138-
@[ -z "$(THIS)" ] || $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(SRC); \
138+
@[ -z "$(THIS)" ] || $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(SRC)
139139

140140
dclean:
141141
$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new

‎deps/openssl/openssl/apps/apps.c

+5-4
Original file line numberDiff line numberDiff line change
@@ -119,9 +119,6 @@
119119
#include <stdio.h>
120120
#include <stdlib.h>
121121
#include <string.h>
122-
#if !defined(OPENSSL_SYSNAME_WIN32) && !defined(NETWARE_CLIB)
123-
# include <strings.h>
124-
#endif
125122
#include <sys/types.h>
126123
#include <ctype.h>
127124
#include <errno.h>
@@ -1247,7 +1244,11 @@ int set_name_ex(unsigned long *flags, const char *arg)
12471244
{"ca_default", XN_FLAG_MULTILINE, 0xffffffffL},
12481245
{NULL, 0, 0}
12491246
};
1250-
return set_multi_opts(flags, arg, ex_tbl);
1247+
if (set_multi_opts(flags, arg, ex_tbl) == 0)
1248+
return 0;
1249+
if ((*flags & XN_FLAG_SEP_MASK) == 0)
1250+
*flags |= XN_FLAG_SEP_CPLUS_SPC;
1251+
return 1;
12511252
}
12521253

12531254
int set_ext_copy(int *copy_type, const char *arg)

‎deps/openssl/openssl/apps/asn1pars.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -313,9 +313,9 @@ int MAIN(int argc, char **argv)
313313
}
314314
typ = ASN1_TYPE_get(at);
315315
if ((typ == V_ASN1_OBJECT)
316+
|| (typ == V_ASN1_BOOLEAN)
316317
|| (typ == V_ASN1_NULL)) {
317-
BIO_printf(bio_err, "Can't parse %s type\n",
318-
typ == V_ASN1_NULL ? "NULL" : "OBJECT");
318+
BIO_printf(bio_err, "Can't parse %s type\n", ASN1_tag2str(typ));
319319
ERR_print_errors(bio_err);
320320
goto end;
321321
}

‎deps/openssl/openssl/apps/ca.c

+5-9
Original file line numberDiff line numberDiff line change
@@ -99,25 +99,19 @@
9999
#undef PROG
100100
#define PROG ca_main
101101

102-
#define BASE_SECTION "ca"
103-
#define CONFIG_FILE "openssl.cnf"
102+
#define BASE_SECTION "ca"
103+
#define CONFIG_FILE "openssl.cnf"
104104

105105
#define ENV_DEFAULT_CA "default_ca"
106106

107-
#define STRING_MASK "string_mask"
107+
#define STRING_MASK "string_mask"
108108
#define UTF8_IN "utf8"
109109

110-
#define ENV_DIR "dir"
111-
#define ENV_CERTS "certs"
112-
#define ENV_CRL_DIR "crl_dir"
113-
#define ENV_CA_DB "CA_DB"
114110
#define ENV_NEW_CERTS_DIR "new_certs_dir"
115111
#define ENV_CERTIFICATE "certificate"
116112
#define ENV_SERIAL "serial"
117113
#define ENV_CRLNUMBER "crlnumber"
118-
#define ENV_CRL "crl"
119114
#define ENV_PRIVATE_KEY "private_key"
120-
#define ENV_RANDFILE "RANDFILE"
121115
#define ENV_DEFAULT_DAYS "default_days"
122116
#define ENV_DEFAULT_STARTDATE "default_startdate"
123117
#define ENV_DEFAULT_ENDDATE "default_enddate"
@@ -2520,6 +2514,8 @@ static int do_updatedb(CA_DB *db)
25202514
char **rrow, *a_tm_s;
25212515

25222516
a_tm = ASN1_UTCTIME_new();
2517+
if (a_tm == NULL)
2518+
return -1;
25232519

25242520
/* get actual time and make a string */
25252521
a_tm = X509_gmtime_adj(a_tm, 0);

‎deps/openssl/openssl/apps/ecparam.c

+3-4
Original file line numberDiff line numberDiff line change
@@ -413,14 +413,13 @@ int MAIN(int argc, char **argv)
413413
}
414414

415415
if (check) {
416-
if (group == NULL)
417-
BIO_printf(bio_err, "no elliptic curve parameters\n");
418416
BIO_printf(bio_err, "checking elliptic curve parameters: ");
419417
if (!EC_GROUP_check(group, NULL)) {
420418
BIO_printf(bio_err, "failed\n");
421419
ERR_print_errors(bio_err);
422-
} else
423-
BIO_printf(bio_err, "ok\n");
420+
goto end;
421+
}
422+
BIO_printf(bio_err, "ok\n");
424423

425424
}
426425

‎deps/openssl/openssl/apps/engine.c

-5
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,6 @@ static void identity(char *ptr)
9999

100100
static int append_buf(char **buf, const char *s, int *size, int step)
101101
{
102-
int l = strlen(s);
103-
104102
if (*buf == NULL) {
105103
*size = step;
106104
*buf = OPENSSL_malloc(*size);
@@ -109,9 +107,6 @@ static int append_buf(char **buf, const char *s, int *size, int step)
109107
**buf = '\0';
110108
}
111109

112-
if (**buf != '\0')
113-
l += 2; /* ", " */
114-
115110
if (strlen(*buf) + strlen(s) >= (unsigned int)*size) {
116111
*size += step;
117112
*buf = OPENSSL_realloc(*buf, *size);

‎deps/openssl/openssl/apps/md4.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
../crypto/md4/md4.c
1+
openssl-1.0.1q/../crypto/md4/md4.c

‎deps/openssl/openssl/apps/ocsp.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -1220,8 +1220,8 @@ static OCSP_RESPONSE *query_responder(BIO *err, BIO *cbio, char *path,
12201220
return NULL;
12211221
}
12221222

1223-
if (BIO_get_fd(cbio, &fd) <= 0) {
1224-
BIO_puts(err, "Can't get connection fd\n");
1223+
if (BIO_get_fd(cbio, &fd) < 0) {
1224+
BIO_puts(bio_err, "Can't get connection fd\n");
12251225
goto err;
12261226
}
12271227

‎deps/openssl/openssl/apps/pkcs12.c

+7-7
Original file line numberDiff line numberDiff line change
@@ -134,20 +134,20 @@ int MAIN(int argc, char **argv)
134134

135135
apps_startup();
136136

137-
# ifdef OPENSSL_FIPS
138-
if (FIPS_mode())
139-
cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
140-
else
141-
# endif
142-
cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
143-
144137
enc = EVP_des_ede3_cbc();
145138
if (bio_err == NULL)
146139
bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
147140

148141
if (!load_config(bio_err, NULL))
149142
goto end;
150143

144+
# ifdef OPENSSL_FIPS
145+
if (FIPS_mode())
146+
cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
147+
else
148+
# endif
149+
cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
150+
151151
args = argv + 1;
152152

153153
while (*args) {

‎deps/openssl/openssl/apps/s_client.c

+3
Original file line numberDiff line numberDiff line change
@@ -1890,6 +1890,9 @@ int MAIN(int argc, char **argv)
18901890
EVP_PKEY_free(key);
18911891
if (pass)
18921892
OPENSSL_free(pass);
1893+
#ifndef OPENSSL_NO_SRP
1894+
OPENSSL_free(srp_arg.srppassin);
1895+
#endif
18931896
if (vpm)
18941897
X509_VERIFY_PARAM_free(vpm);
18951898
if (cbuf != NULL) {

‎deps/openssl/openssl/apps/s_server.c

+15
Original file line numberDiff line numberDiff line change
@@ -2654,6 +2654,21 @@ static int www_body(char *hostname, int s, unsigned char *context)
26542654
goto err;
26552655
} else {
26562656
BIO_printf(bio_s_out, "read R BLOCK\n");
2657+
#ifndef OPENSSL_NO_SRP
2658+
if (BIO_should_io_special(io)
2659+
&& BIO_get_retry_reason(io) == BIO_RR_SSL_X509_LOOKUP) {
2660+
BIO_printf(bio_s_out, "LOOKUP renego during read\n");
2661+
srp_callback_parm.user =
2662+
SRP_VBASE_get_by_user(srp_callback_parm.vb,
2663+
srp_callback_parm.login);
2664+
if (srp_callback_parm.user)
2665+
BIO_printf(bio_s_out, "LOOKUP done %s\n",
2666+
srp_callback_parm.user->info);
2667+
else
2668+
BIO_printf(bio_s_out, "LOOKUP not successful\n");
2669+
continue;
2670+
}
2671+
#endif
26572672
#if defined(OPENSSL_SYS_NETWARE)
26582673
delay(1000);
26592674
#elif !defined(OPENSSL_SYS_MSDOS) && !defined(__DJGPP__)

‎deps/openssl/openssl/crypto/aes/asm/aes-586.pl

+3-3
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
# the undertaken effort was that it appeared that in tight IA-32
4646
# register window little-endian flavor could achieve slightly higher
4747
# Instruction Level Parallelism, and it indeed resulted in up to 15%
48-
# better performance on most recent µ-archs...
48+
# better performance on most recent µ-archs...
4949
#
5050
# Third version adds AES_cbc_encrypt implementation, which resulted in
5151
# up to 40% performance imrovement of CBC benchmark results. 40% was
@@ -223,7 +223,7 @@
223223
$speed_limit=512; # chunks smaller than $speed_limit are
224224
# processed with compact routine in CBC mode
225225
$small_footprint=1; # $small_footprint=1 code is ~5% slower [on
226-
# recent µ-archs], but ~5 times smaller!
226+
# recent µ-archs], but ~5 times smaller!
227227
# I favor compact code to minimize cache
228228
# contention and in hope to "collect" 5% back
229229
# in real-life applications...
@@ -562,7 +562,7 @@ ()
562562
# Performance is not actually extraordinary in comparison to pure
563563
# x86 code. In particular encrypt performance is virtually the same.
564564
# Decrypt performance on the other hand is 15-20% better on newer
565-
# µ-archs [but we're thankful for *any* improvement here], and ~50%
565+
# µ-archs [but we're thankful for *any* improvement here], and ~50%
566566
# better on PIII:-) And additionally on the pros side this code
567567
# eliminates redundant references to stack and thus relieves/
568568
# minimizes the pressure on the memory bus.

‎deps/openssl/openssl/crypto/aes/asm/aesni-x86.pl

+1-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@
7474
$inout4="xmm6"; $in0="xmm6";
7575
$inout5="xmm7"; $ivec="xmm7";
7676

77-
# AESNI extenstion
77+
# AESNI extension
7878
sub aeskeygenassist
7979
{ my($dst,$src,$imm)=@_;
8080
if ("$dst:$src" =~ /xmm([0-7]):xmm([0-7])/)

‎deps/openssl/openssl/crypto/asn1/asn1_par.c

+10
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,10 @@
6262
#include <openssl/objects.h>
6363
#include <openssl/asn1.h>
6464

65+
#ifndef ASN1_PARSE_MAXDEPTH
66+
#define ASN1_PARSE_MAXDEPTH 128
67+
#endif
68+
6569
static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
6670
int indent);
6771
static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
@@ -128,6 +132,12 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
128132
#else
129133
dump_indent = 6; /* Because we know BIO_dump_indent() */
130134
#endif
135+
136+
if (depth > ASN1_PARSE_MAXDEPTH) {
137+
BIO_puts(bp, "BAD RECURSION DEPTH\n");
138+
return 0;
139+
}
140+
131141
p = *pp;
132142
tot = p + length;
133143
op = p - 1;

0 commit comments

Comments
 (0)