5710 Commits

Author SHA1 Message Date
Emilia Kasper
e56c77b8ee BUF_strndup: tidy
Fix comment, add another overflow check, tidy style

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit de8883e11befde31d9b6cfbbd1fc017c365e0bbf)
(cherry picked from commit f5afe9ce3f7ab8d2fef460054d1170427db0d02c)
2015-09-22 20:09:42 +02:00
Alessandro Ghedini
6905187488 Make BUF_strndup() read-safe on arbitrary inputs
BUF_strndup was calling strlen through BUF_strlcpy, and ended up reading
past the input if the input was not a C string.

Make it explicitly part of BUF_strndup's contract to never read more
than |siz| input bytes. This augments the standard strndup contract to
be safer.

The commit also adds a check for siz overflow and some brief documentation
for BUF_strndup().

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 110f7b37de9feecfb64950601cc7cec77cf6130b)
(cherry picked from commit f61216ba9d17430fb5eb3e2b202a209960b9d51b)
2015-09-22 20:09:38 +02:00
David Woodhouse
21d8f24485 RT3479: Add UTF8 support to BIO_read_filename()
If we use BIO_new_file(), on Windows it'll jump through hoops to work
around their unusual charset/Unicode handling. it'll convert a UTF-8
filename to UCS-16LE and attempt to use _wfopen().

If you use BIO_read_filename(), it doesn't do this. Shouldn't it be
consistent?

It would certainly be nice if SSL_use_certificate_chain_file() worked.

Also made BIO_C_SET_FILENAME work (rsalz)

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit ff03599a2f518dbdf13bca0bb0208e431b892fe9)
2015-09-21 17:33:06 -04:00
Gunnar Kudrjavets
f9394bd7a0 RT3823: Improve the robustness of event logging
There are a couple of minor fixes here:

1) Handle the case when RegisterEventSource() fails (which it may for
various reasons) and do the work of logging the event only if it succeeds.

2) Handle the case when ReportEvent() fails and do our best in debug builds
to at least attempt somehow indicate that something has gone wrong. The
typical situation would be someone running tools like DbMon, DBWin32,
DebugView or just having the debugger attached. The intent is to make sure
that at least some data will be captured so that we can save hours and days
of debugging time.

3) Minor fix to change the MessageBox() flag to MB_ICONERROR. Though the
value of MB_ICONERROR is the same value as MB_ICONSTOP, the intent is
better conveyed by using MB_ICONERROR.

Testing performed:

1) Clean compilation for debug-VC-WIN32 and VC-WIN32.

2) Good test results (nmake -f ms\ntdll.mak test) for debug-VC-WIN32 and
VC-WIN32.

3) Stepped through relevant changes using WinDBG and exercised the impacted
code paths.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 4cd94416a452c3a3e0df24c297f7d2f0e6d5bb5f)
2015-09-21 14:36:39 -04:00
Matt Caswell
b2a6718819 Fix SRP memory leaks
There were some memory leaks in the creation of an SRP verifier (both on
successful completion and also on some error paths).

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit bf95cde28712cfcad90cb3975cdcb8e5c0f20fde)
2015-09-21 10:26:32 +01:00
Viktor Dukhovni
2ab1e7fde3 Fix indentation
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 4fe1cbdff89768c5d1983988ce1022674a438bbb)
2015-09-19 09:10:38 -04:00
Rich Salz
628c15039f This undoes GH367 for non-master
Was only approved for master, to avoid compatibility issues on
previous releases.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 6be18a22199de4d114b53686c31ba02723fc2c18)
2015-09-18 15:56:45 -04:00
Matt Caswell
a50a8a76dd Make sure OPENSSL_cleanse checks for NULL
In master we have the function OPENSSL_clear_free(x,y), which immediately
returns if x == NULL. In <=1.0.2 this function does not exist so we have to
do:
OPENSSL_cleanse(x, y);
OPENSSL_free(x);

However, previously, OPENSSL_cleanse did not check that if x == NULL, so
the real equivalent check would have to be:
if (x != NULL)
    OPENSSL_cleanse(x, y);
OPENSSL_free(x);

It would be easy to get this wrong during cherry-picking to other branches
and therefore, for safety, it is best to just ensure OPENSSL_cleanse also
checks for NULL.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 020d8fc83fe1a94232db1ee1166309e2458a8a18)
2015-09-17 22:33:31 +01:00
Emilia Kasper
7ac2c47583 base64 decode: check for high bit
Previously, the conversion would silently coerce to ASCII. Now, we error
out.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit b785504a10310cb2872270eb409b70971be5e76e)
(cherry picked from commit cb71f17dc786c72ec74c0ebb983b3ccfde484271)
2015-09-17 21:45:28 +02:00
Emilia Kasper
76067c75fd RT3757: base64 encoding bugs
Rewrite EVP_DecodeUpdate.

In particular: reject extra trailing padding, and padding in the middle
of the content. Don't limit line length. Add tests.

Previously, the behaviour was ill-defined, and depended on the position
of the padding within the input.

In addition, this appears to fix a possible two-byte oob read.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr Stephen Henson <steve@openssl.org>
(cherry picked from commit 3cdd1e94b1d71f2ce3002738f9506da91fe2af45)
(cherry picked from commit 37faf117965de181f4de0b4032eecac2566de5f6)
2015-09-17 20:15:41 +02:00
Rich Salz
12650153ec RT4044: Remove .cvsignore files.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 3be39dc1e3378d79531e385a72051c4dc5c6b34d)
2015-09-15 12:00:18 -04:00
Kurt Roeckx
8f42c34f8f d2i: don't update input pointer on failure
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
MR #1005
(cherry picked from commit a46c9789ce2aecedceef119e9883513c7a49f1ca)
2015-09-15 00:15:03 +02:00
Emilia Kasper
4cb23e12a3 RT3754: check for NULL pointer
Fix both the caller to error out on malloc failure, as well as the
eventual callee to handle a NULL gracefully.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-09-10 17:23:33 +02:00
Tim Zhang
525e13612e Fix the comment for POINT_CONVERSION_UNCOMPRESSED
The |z| value should be 0x04 not 0x02

RT#3838

Signed-off-by: Matt Caswell <matt@openssl.org>

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 91d2728b38b1df930f337e163816a0fc9580b6a6)
2015-09-01 23:55:47 +01:00
Emilia Kasper
bae16c98c1 RT4002: check for NULL cipher in p12_crpt.c
The NULL cipher case can't actually happen because we have no
EVP_PBE_CTL combinations where cipher_nid is -1 and keygen is
PKCS12_PBE_keyivgen. But make the code more obviously correct.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 394f7b6fcc38132b8ccff0a3253b9dd15640cfc0)
2015-09-01 20:06:08 +02:00
Emilia Kasper
9d4798a9e0 RT 3493: fix RSA test
- Pass in the right ciphertext length to ensure we're indeed testing
  ciphertext corruption (and not truncation).
- Only test one mutation per byte to not make the test too slow.
- Add a separate test for truncated ciphertexts.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 25d6b3401ca40c9a2cbe5080449c1c2a37037777)
2015-09-01 20:05:56 +02:00
mrpre
1915a22184 check bn_new return value
Slightly modified from the original PR.
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>

(cherry picked from commit a7e974c7be90e2c9673e2ce6215a70f734eb8ad4)
2015-08-31 16:06:29 -04:00
Ben Kaduk
a6ce498b2a GH367 follow-up, for more clarity
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 36ac7bc8a9c856bcdff6eecdaca128ccc5430a1e)
2015-08-31 13:47:12 -04:00
Emilia Kasper
d46e946d26 BN_mod_exp_mont_consttime: check for zero modulus.
Don't dereference |d| when |top| is zero. Also test that various BIGNUM methods behave correctly on zero/even inputs.

Follow-up to b11980d79a52ec08844f08bea0e66c04b691840b

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-08-31 19:33:42 +02:00
Emilia Kasper
cb5320014d bntest: don't dereference the |d| array for a zero BIGNUM.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 4d04226c2ec7e7f69f6234def63631648e35e828)
(cherry picked from commit 9c989aaa749d88b63bef5d5beeb3046eae62d836)
2015-08-31 16:53:37 +02:00
Ismo Puustinen
9a97446468 GH367: Fix dsa keygen for too-short seed
If the seed value for dsa key generation is too short (< qsize),
return an error. Also update the documentation.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit f00a10b89734e84fe80f98ad9e2e77b557c701ae)
2015-08-28 11:25:44 -04:00
David Brodski
80c25ba676 Fixed problem with multiple load-unload of comp zlib
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 8cbb153357896c4b224e0678550944f7851bc3b2)
2015-08-26 17:36:44 -04:00
Dr. Stephen Henson
50e56c1d8c Return error for unsupported modes.
PR#3974
PR#3975

Reviewed-by: Matt Caswell <matt@openssl.org>

Conflicts:
	crypto/evp/evp_lib.c
2015-08-12 14:29:02 +01:00
Dr. Stephen Henson
2d17250368 Fix memory leak if setup fails.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 891eac4604b5f05413e59602fae1f11136f4719a)

Conflicts:
	crypto/cms/cms_enc.c
2015-08-12 14:24:08 +01:00
Dr. Stephen Henson
aa701624b1 Err isn't always malloc failure.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit a187e08d856690b5c1da3184d0ff560d572f893b)

Conflicts:
	crypto/cms/cms_smime.c
2015-08-12 14:23:48 +01:00
Matt Caswell
b11980d79a Check for 0 modulus in BN_MONT_CTX_set
The function BN_MONT_CTX_set was assuming that the modulus was non-zero
and therefore that |mod->top| > 0. In an error situation that may not be
the case and could cause a seg fault.

This is a follow on from CVE-2015-1794.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-08-11 20:23:00 +01:00
Matt Caswell
507ea77b82 Fix warning when compiling with no-ec2m
EC_KEY_set_public_key_affine_coordinates was using some variables that only
apply if OPENSSL_NO_EC2M is not defined.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(cherry picked from commit 8d11b7c7ee84ad0aa243476088285d15b22c5470)
2015-08-04 10:52:09 +01:00
Loganaden Velvindron
1a9a506cfb Clear BN-mont values when free'ing it.
From a CloudFlare patch.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 1a586b3942de1c0bd64203d09385d5e74f499d8d)
2015-07-31 13:38:48 -04:00
Dr. Stephen Henson
5030cc69ff use X9.31 keygen by default in FIPS mode
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit d0c9a90640c8902fef3eb74e8ef05227f8e7dcb7)
2015-07-30 14:35:42 +01:00
Martin Vejnar
721cbae7e6 RT3774: double-free in DSA
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit fa4629b6a2518d202fd051f228c3d8770682b3be)
2015-07-29 21:21:47 -04:00
Richard Levitte
a027bba22a Conversion to UTF-8 where needed
This leaves behind files with names ending with '.iso-8859-1'.  These
should be safe to remove.  If something went wrong when re-encoding,
there will be some files with names ending with '.utf8' left behind.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-07-14 01:18:57 +02:00
Matt Caswell
7c17c20a56 Prepare for 1.0.1q-dev
Reviewed-by: Stephen Henson <steve@openssl.org>
2015-07-09 13:29:59 +01:00
Matt Caswell
5ab53da9fb Prepare for 1.0.1p release
Reviewed-by: Stephen Henson <steve@openssl.org>
2015-07-09 13:22:23 +01:00
Matt Caswell
cb22d2ae5a Fix alt chains bug
This is a follow up to the alternate chains certificate forgery issue
(CVE-2015-1793). That issue is exacerbated in 1.0.1 by a related bug which
means that we *always* check for an alternative chain, even if we have
already found a chain. The code is supposed to stop as soon as it has found
one (and does do in master and 1.0.2).

Reviewed-by: Stephen Henson <steve@openssl.org>
2015-07-07 22:57:36 +01:00
Matt Caswell
b3b1eb5735 Reject calls to X509_verify_cert that have not been reinitialised
The function X509_verify_cert checks the value of |ctx->chain| at the
beginning, and if it is NULL then it initialises it, along with the value
of ctx->untrusted. The normal way to use X509_verify_cert() is to first
call X509_STORE_CTX_init(); then set up various parameters etc; then call
X509_verify_cert(); then check the results; and finally call
X509_STORE_CTX_cleanup(). The initial call to X509_STORE_CTX_init() sets
|ctx->chain| to NULL. The only place in the OpenSSL codebase  where
|ctx->chain| is set to anything other than a non NULL value is in
X509_verify_cert itself. Therefore the only ways that |ctx->chain| could be
non NULL on entry to X509_verify_cert is if one of the following occurs:
1) An application calls X509_verify_cert() twice without re-initialising
in between.
2) An application reaches inside the X509_STORE_CTX structure and changes
the value of |ctx->chain| directly.

With regards to the second of these, we should discount this - it should
not be supported to allow this.

With regards to the first of these, the documentation is not exactly
crystal clear, but the implication is that you must call
X509_STORE_CTX_init() before each call to X509_verify_cert(). If you fail
to do this then, at best, the results would be undefined.

Calling X509_verify_cert() with |ctx->chain| set to a non NULL value is
likely to have unexpected results, and could be dangerous. This commit
changes the behaviour of X509_verify_cert() so that it causes an error if
|ctx->chain| is anything other than NULL (because this indicates that we
have not been initialised properly). It also clarifies the associated
documentation. This is a follow up commit to CVE-2015-1793.

Reviewed-by: Stephen Henson <steve@openssl.org>
2015-07-07 22:52:36 +01:00
Matt Caswell
d42d100433 Add test for CVE-2015-1793
This adds a test for CVE-2015-1793. This adds a new test file
verify_extra_test.c, which could form the basis for additional
verification tests.

Reviewed-by: Stephen Henson <steve@openssl.org>

Conflicts:
	test/Makefile
2015-07-07 22:52:31 +01:00
Matt Caswell
9a0db453ba Fix alternate chains certificate forgery issue
During certificate verfification, OpenSSL will attempt to find an
alternative certificate chain if the first attempt to build such a chain
fails. An error in the implementation of this logic can mean that an
attacker could cause certain checks on untrusted certificates to be
bypassed, such as the CA flag, enabling them to use a valid leaf
certificate to act as a CA and "issue" an invalid certificate.

This occurs where at least one cert is added to the first chain from the
trust store, but that chain still ends up being untrusted. In that case
ctx->last_untrusted is decremented in error.

Patch provided by the BoringSSL project.

CVE-2015-1793

Reviewed-by: Stephen Henson <steve@openssl.org>
2015-07-07 22:50:04 +01:00
Dr. Stephen Henson
cb6e0ed17a Relax CCM tag check.
In CCM mode don't require a tag before initialising decrypt: this allows
the tag length to be set without requiring the tag.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 9cca7be11d62298b2af0722f94345012c86eaed4)
2015-07-06 18:36:10 +01:00
Dr. Stephen Henson
0d25eb7800 Don't output bogus errors in PKCS12_parse
PR#3923

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit ffbf304d4832bd51bb0618f8ca5b7c26647ee664)
2015-06-25 04:55:56 +01:00
Richard Levitte
f4961dc2af Cleanup mttest.c : because we no longer use stdio here, don't include it
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 8ca96efd24b73f917837fdd45b1c22d7b8ff8cbd)
2015-06-21 22:13:28 +02:00
Richard Levitte
40ced6c187 Add -ldl to the build of mttest.c
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit d62c98c81c7b47b7b1878fd7e91e5fd33818faf0)
2015-06-21 22:13:28 +02:00
Richard Levitte
f1817dd4d0 Cleanup mttest.c : do not try to output reference counts when threads are done
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 964626957f79e07ed97756527cdc7e84007c60c9)
2015-06-21 22:13:28 +02:00
Richard Levitte
5891dae67c Cleanup mttest.c : better error reporting when certs are missing
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 7a1789d254c561bd3024c971b5cfeeedd12d63f3)
2015-06-21 22:13:28 +02:00
Richard Levitte
1d6d4efea5 Cleanup mttest.c : make ssl_method a pointer to const
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit f4c73bfe0ab7a0e8f82fe2947c0f77fe3d98acab)

Conflicts:
	crypto/threads/mttest.c
2015-06-21 22:13:28 +02:00
Richard Levitte
0fee334404 Cleanup mttest.c : more output changes
More fprintf()s and printf()s to turn into BIO calls.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-06-21 22:13:28 +02:00
Richard Levitte
141f7d263b Cleanup mttest.c : modernise output
Construct bio_err and bio_stdout from file handles instead of FILE
pointers, since the latter might not be implemented (when OPENSSL_NO_STDIO
is defined).
Convert all output to use BIO_printf.
Change lh_foo to lh_SSL_SESSION_foo.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit bb8abd6735e198de36c1eb9098a7f1516d156220)

Conflicts:
	crypto/threads/mttest.c
2015-06-21 22:13:28 +02:00
Richard Levitte
ae3254a52d Cleanup mttest.c : modernise the threads setup
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 5c78e1835285ce4acdc7cc4f4c06aa7d6661c9b4)

Conflicts:
	crypto/threads/mttest.c
2015-06-21 22:13:28 +02:00
Richard Levitte
9720dd4314 Cleanup mttest.c : remove MS_CALLBACK
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit a3f9286556d6d78c1800caae97a9328afb2557e6)
2015-06-21 22:13:28 +02:00
Richard Levitte
347fc5d8cd Make preprocessor error into real preprocessor error
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit b4f0d1a4a89b964dba80036a6348ca0a1913c526)
2015-06-16 13:14:09 +02:00
Richard Levitte
a5d8c1c291 Remove one extraneous parenthesis
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 30cf91784bfde82622f79d87d17d20ce73329532)
2015-06-16 13:14:09 +02:00