generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix null-pointer assignment in do_change_cipher_spec() revealed

Browse Source 
by using the Codenomicon TLS Test Tool (CAN-2004-0079)

Prepare for 0.9.6m release

Submitted by: Steven Henson
Reviewed by: Joe Orton
Approved by: Mark Cox
This commit is contained in:
Mark J. Cox
2004-03-17 11:45:35 +00:00
parent c08c1f76bc
commit 36800c36d6
9 changed files with 26 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES
View File

@@ -2,9 +2,11 @@
OpenSSL CHANGES OpenSSL CHANGES
_______________ _______________
Changes between 0.9.6l and 0.9.6m [xx XXX xxxx] Changes between 0.9.6l and 0.9.6m [17 Mar 2004]
*) *) Fix null-pointer assignment in do_change_cipher_spec() revealed
by using the Codenomicon TLS Test Tool (CAN-2004-0079)
[Joe Orton, Steve Henson]
Changes between 0.9.6k and 0.9.6l [04 Nov 2003] Changes between 0.9.6k and 0.9.6l [04 Nov 2003]

2
FAQ
View File

@@ -63,7 +63,7 @@ OpenSSL - Frequently Asked Questions
* Which is the current version of OpenSSL? * Which is the current version of OpenSSL?
The current version is available from <URL: http://www.openssl.org>. The current version is available from <URL: http://www.openssl.org>.
OpenSSL 0.9.7c was released on September 30, 2003. OpenSSL 0.9.7d was released on March 17, 2004.
In addition to the current stable release, you can also access daily In addition to the current stable release, you can also access daily
snapshots of the OpenSSL development version at <URL: snapshots of the OpenSSL development version at <URL:

2
LICENSE
View File

@@ -12,7 +12,7 @@
--------------- ---------------
/* ==================================================================== /* ====================================================================
* Copyright (c) 1998-2003 The OpenSSL Project. All rights reserved. * Copyright (c) 1998-2004 The OpenSSL Project. All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions

4
NEWS
View File

@@ -5,6 +5,10 @@
This file gives a brief overview of the major changes between each OpenSSL This file gives a brief overview of the major changes between each OpenSSL
release. For more details please read the CHANGES file. release. For more details please read the CHANGES file.
Major changes between OpenSSL 0.9.6l and OpenSSL 0.9.6m:
o Security: fix null-pointer bug leading to crash
Major changes between OpenSSL 0.9.6k and OpenSSL 0.9.6l: Major changes between OpenSSL 0.9.6k and OpenSSL 0.9.6l:
o Security: fix ASN1 bug leading to large recursion o Security: fix ASN1 bug leading to large recursion

4
README
View File

@@ -1,7 +1,7 @@
OpenSSL 0.9.6l [engine] 04 Nov 2003 OpenSSL 0.9.6m [engine] 17 Mar 2004
Copyright (c) 1998-2003 The OpenSSL Project Copyright (c) 1998-2004 The OpenSSL Project
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
All rights reserved. All rights reserved.

4
STATUS
View File

@@ -1,14 +1,16 @@
OpenSSL STATUS Last modified at OpenSSL STATUS Last modified at
______________ $Date: 2003/11/04 11:33:10 $ ______________ $Date: 2004/03/17 11:45:33 $
DEVELOPMENT STATE DEVELOPMENT STATE
o OpenSSL 0.9.8: Under development... o OpenSSL 0.9.8: Under development...
o OpenSSL 0.9.7d: Released on March 17th, 2004
o OpenSSL 0.9.7c: Released on September 30th, 2003 o OpenSSL 0.9.7c: Released on September 30th, 2003
o OpenSSL 0.9.7b: Released on April 10th, 2003 o OpenSSL 0.9.7b: Released on April 10th, 2003
o OpenSSL 0.9.7a: Released on February 19th, 2003 o OpenSSL 0.9.7a: Released on February 19th, 2003
o OpenSSL 0.9.7: Released on December 31st, 2002 o OpenSSL 0.9.7: Released on December 31st, 2002
o OpenSSL 0.9.6m: Released on March 17th, 2004
o OpenSSL 0.9.6l: Released on November 4th, 2003 o OpenSSL 0.9.6l: Released on November 4th, 2003
o OpenSSL 0.9.6k: Released on September 30th, 2003 o OpenSSL 0.9.6k: Released on September 30th, 2003
o OpenSSL 0.9.6j: Released on April 10th, 2003 o OpenSSL 0.9.6j: Released on April 10th, 2003

4
crypto/opensslv.h
View File

@@ -25,8 +25,8 @@
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
* major minor fix final patch/beta) * major minor fix final patch/beta)
*/ */
#define OPENSSL_VERSION_NUMBER 0x009060d0L #define OPENSSL_VERSION_NUMBER 0x009060dfL
#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.6m-dev [engine] xx XXX xxxx" #define OPENSSL_VERSION_TEXT "OpenSSL 0.9.6m [engine] 17 Mar 2004"
#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT #define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT

2
openssl.spec
View File

@@ -1,7 +1,7 @@
%define libmaj 0 %define libmaj 0
%define libmin 9 %define libmin 9
%define librel 6 %define librel 6
%define librev l %define librev m
Release: 1 Release: 1
%define openssldir /var/ssl %define openssldir /var/ssl

8
ssl/s3_pkt.c
View File

@@ -1079,6 +1079,14 @@ start:
goto err; goto err;
} }
/* Check we have a cipher to change to */
if (s->s3->tmp.new_cipher == NULL)
{
i=SSL_AD_UNEXPECTED_MESSAGE;
SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
goto err;
}
rr->length=0; rr->length=0;
s->s3->change_cipher_spec=1; s->s3->change_cipher_spec=1;
if (!do_change_cipher_spec(s)) if (!do_change_cipher_spec(s))