← Back to branch summary

~ubuntu-branches/ubuntu/maverick/openssl/maverick

« back to all changes in this revision

Viewing changes to diffs.sec7

  • Committer: Bazaar Package Importer
  • Author(s): Christoph Martin
  • Date: 2004-12-16 18:41:29 UTC
  • mto: (11.1.1 lenny)
  • mto: This revision was merged to the branch mainline in revision 3.
  • Revision ID: james.westby@ubuntu.com-20041216184129-z7xjkul57mh1jiha
Tags: upstream-0.9.7e
Import upstream version 0.9.7e

Show diffs side-by-side

added added

removed removed

Lines of Context:
diffs.sec7
 
1
diff -cr openssl7/CHANGES ossl7/CHANGES
 
2
*** openssl7/CHANGES    Thu Sep  4 12:52:10 2003
 
3
--- ossl7/CHANGES       Mon Sep 29 21:26:37 2003
 
4
***************
 
5
*** 4,9 ****
 
6
--- 4,21 ----
 
7
  
 
8
   Changes between 0.9.7b and 0.9.7c  [xx XXX 2003]
 
9
  
 
10
+   *) Fix various bugs revealed by running the NISCC test suite:
 
11
+ 
 
12
+      Stop out of bounds reads in the ASN1 code when presented with
 
13
+      invalid tags (CAN-2003-0543 and CAN-2003-0544).
 
14
+      
 
15
+      Free up ASN1_TYPE correctly if ANY type is invalid (CAN-2003-0545).
 
16
+ 
 
17
+      If verify callback ignores invalid public key errors don't try to check
 
18
+      certificate signature with the NULL public key.
 
19
+ 
 
20
+      [Steve Henson]
 
21
+ 
 
22
    *) New -ignore_err option in ocsp application to stop the server
 
23
       exiting on the first error in a request.
 
24
       [Steve Henson]
 
25
***************
 
26
*** 1982,1987 ****
 
27
--- 1994,2009 ----
 
28
  
 
29
   Changes between 0.9.6j and 0.9.6k  [xx XXX 2003]
 
30
  
 
31
+   *) Fix various bugs revealed by running the NISCC test suite:
 
32
+ 
 
33
+      Stop out of bounds reads in the ASN1 code when presented with
 
34
+      invalid tags (CAN-2003-0543 and CAN-2003-0544).
 
35
+      
 
36
+      If verify callback ignores invalid public key errors don't try to check
 
37
+      certificate signature with the NULL public key.
 
38
+ 
 
39
+      [Steve Henson]
 
40
+ 
 
41
    *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
 
42
       if the server requested one: as stated in TLS 1.0 and SSL 3.0
 
43
       specifications.
 
44
diff -cr openssl7/crypto/asn1/asn1_lib.c ossl7/crypto/asn1/asn1_lib.c
 
45
*** openssl7/crypto/asn1/asn1_lib.c     Fri Aug  2 19:03:41 2002
 
46
--- ossl7/crypto/asn1/asn1_lib.c        Mon Sep 29 21:26:37 2003
 
47
***************
 
48
*** 104,113 ****
 
49
--- 104,115 ----
 
50
                        l<<=7L;
 
51
                        l|= *(p++)&0x7f;
 
52
                        if (--max == 0) goto err;
 
53
+                       if (l > (INT_MAX >> 7L)) goto err;
 
54
                        }
 
55
                l<<=7L;
 
56
                l|= *(p++)&0x7f;
 
57
                tag=(int)l;
 
58
+               if (--max == 0) goto err;
 
59
                }
 
60
        else
 
61
                { 
 
62
diff -cr openssl7/crypto/asn1/tasn_dec.c ossl7/crypto/asn1/tasn_dec.c
 
63
*** openssl7/crypto/asn1/tasn_dec.c     Tue Nov 12 13:21:26 2002
 
64
--- ossl7/crypto/asn1/tasn_dec.c        Mon Sep 29 21:26:37 2003
 
65
***************
 
66
*** 691,696 ****
 
67
--- 691,697 ----
 
68
  
 
69
  int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it)
 
70
  {
 
71
+       ASN1_VALUE **opval = NULL;
 
72
        ASN1_STRING *stmp;
 
73
        ASN1_TYPE *typ = NULL;
 
74
        int ret = 0;
 
75
***************
 
76
*** 705,710 ****
 
77
--- 706,712 ----
 
78
                        *pval = (ASN1_VALUE *)typ;
 
79
                } else typ = (ASN1_TYPE *)*pval;
 
80
                if(utype != typ->type) ASN1_TYPE_set(typ, utype, NULL);
 
81
+               opval = pval;
 
82
                pval = (ASN1_VALUE **)&typ->value.ptr;
 
83
        }
 
84
        switch(utype) {
 
85
***************
 
86
*** 796,802 ****
 
87
  
 
88
        ret = 1;
 
89
        err:
 
90
!       if(!ret) ASN1_TYPE_free(typ);
 
91
        return ret;
 
92
  }
 
93
  
 
94
--- 798,809 ----
 
95
  
 
96
        ret = 1;
 
97
        err:
 
98
!       if(!ret)
 
99
!               {
 
100
!               ASN1_TYPE_free(typ);
 
101
!               if (opval)
 
102
!                       *opval = NULL;
 
103
!               }
 
104
        return ret;
 
105
  }
 
106
  
 
107
diff -cr openssl7/crypto/x509/x509_vfy.c ossl7/crypto/x509/x509_vfy.c
 
108
*** openssl7/crypto/x509/x509_vfy.c     Wed Jun  4 00:40:47 2003
 
109
--- ossl7/crypto/x509/x509_vfy.c        Mon Sep 29 21:26:37 2003
 
110
***************
 
111
*** 674,680 ****
 
112
                                ok=(*cb)(0,ctx);
 
113
                                if (!ok) goto end;
 
114
                                }
 
115
!                       if (X509_verify(xs,pkey) <= 0)
 
116
                                /* XXX  For the final trusted self-signed cert,
 
117
                                 * this is a waste of time.  That check should
 
118
                                 * optional so that e.g. 'openssl x509' can be
 
119
--- 674,680 ----
 
120
                                ok=(*cb)(0,ctx);
 
121
                                if (!ok) goto end;
 
122
                                }
 
123
!                       else if (X509_verify(xs,pkey) <= 0)
 
124
                                /* XXX  For the final trusted self-signed cert,
 
125
                                 * this is a waste of time.  That check should
 
126
                                 * optional so that e.g. 'openssl x509' can be