Skip to content

Commit b130feb

Browse files
shigekiMylesBorins
shigeki
authored and
MylesBorins
committed
deps: upgrade openssl sources to 1.0.2m
This replaces all sources of openssl-1.0.2m.tar.gz into deps/openssl/openssl PR-URL: #16691 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rod Vagg <[email protected]> Reviewed-By: Gireesh Punathil <[email protected]> Reviewed-By: James M Snell <[email protected]>
1 parent fbde292 commit b130feb

218 files changed

Lines changed: 1846 additions & 38827 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,44 @@
22
OpenSSL CHANGES
33
_______________
44

5+
This is a high-level summary of the most important changes.
6+
For a full list of changes, see the git commit log; for example,
7+
https://github.com/openssl/openssl/commits/ and pick the appropriate
8+
release branch.
9+
10+
Changes between 1.0.2l and 1.0.2m [2 Nov 2017]
11+
12+
*) bn_sqrx8x_internal carry bug on x86_64
13+
14+
There is a carry propagating bug in the x86_64 Montgomery squaring
15+
procedure. No EC algorithms are affected. Analysis suggests that attacks
16+
against RSA and DSA as a result of this defect would be very difficult to
17+
perform and are not believed likely. Attacks against DH are considered just
18+
feasible (although very difficult) because most of the work necessary to
19+
deduce information about a private key may be performed offline. The amount
20+
of resources required for such an attack would be very significant and
21+
likely only accessible to a limited number of attackers. An attacker would
22+
additionally need online access to an unpatched system using the target
23+
private key in a scenario with persistent DH parameters and a private
24+
key that is shared between multiple clients.
25+
26+
This only affects processors that support the BMI1, BMI2 and ADX extensions
27+
like Intel Broadwell (5th generation) and later or AMD Ryzen.
28+
29+
This issue was reported to OpenSSL by the OSS-Fuzz project.
30+
(CVE-2017-3736)
31+
[Andy Polyakov]
32+
33+
*) Malformed X.509 IPAddressFamily could cause OOB read
34+
35+
If an X.509 certificate has a malformed IPAddressFamily extension,
36+
OpenSSL could do a one-byte buffer overread. The most likely result
37+
would be an erroneous display of the certificate in text format.
38+
39+
This issue was reported to OpenSSL by the OSS-Fuzz project.
40+
(CVE-2017-3735)
41+
[Rich Salz]
42+
543
Changes between 1.0.2k and 1.0.2l [25 May 2017]
644

745
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target

‎deps/openssl/openssl/INSTALL‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -190,10 +190,8 @@
190190
the failure that isn't a problem in OpenSSL itself (like a missing
191191
or malfunctioning bc). If it is a problem with OpenSSL itself,
192192
try removing any compiler optimization flags from the CFLAG line
193-
in Makefile.ssl and run "make clean; make". Please send a bug
194-
report to <[email protected]>, including the output of
195-
"make report" in order to be added to the request tracker at
196-
http://www.openssl.org/support/rt.html.
193+
in Makefile.ssl and run "make clean; make". To report a bug please open an
194+
issue on GitHub, at https://github.com/openssl/openssl/issues.
197195

198196
4. If everything tests ok, install OpenSSL with
199197

‎deps/openssl/openssl/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.2l
7+
VERSION=1.0.2m
88
MAJOR=1
99
MINOR=0.2
1010
SHLIB_VERSION_NUMBER=1.0.0

‎deps/openssl/openssl/Makefile.bak‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.2l
7+
VERSION=1.0.2m
88
MAJOR=1
99
MINOR=0.2
1010
SHLIB_VERSION_NUMBER=1.0.0

‎deps/openssl/openssl/NEWS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.0.2l and OpenSSL 1.0.2m [2 Nov 2017]
9+
10+
o bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
11+
o Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
12+
813
Major changes between OpenSSL 1.0.2k and OpenSSL 1.0.2l [25 May 2017]
914

1015
o config now recognises 64-bit mingw and chooses mingw64 instead of mingw

‎deps/openssl/openssl/README‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.0.2l 25 May 2017
2+
OpenSSL 1.0.2m 2 Nov 2017
33

44
Copyright (c) 1998-2015 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/apps/app_rand.c‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -124,16 +124,7 @@ int app_RAND_load_file(const char *file, BIO *bio_e, int dont_warn)
124124
char buffer[200];
125125

126126
#ifdef OPENSSL_SYS_WINDOWS
127-
/*
128-
* allocate 2 to dont_warn not to use RAND_screen() via
129-
* -no_rand_screen option in s_client
130-
*/
131-
if (dont_warn != 2) {
132-
BIO_printf(bio_e, "Loading 'screen' into random state -");
133-
BIO_flush(bio_e);
134-
RAND_screen();
135-
BIO_printf(bio_e, " done\n");
136-
}
127+
RAND_screen();
137128
#endif
138129

139130
if (file == NULL)

‎deps/openssl/openssl/apps/ca.c‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1985,10 +1985,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
19851985
/* Lets add the extensions, if there are any */
19861986
if (ext_sect) {
19871987
X509V3_CTX ctx;
1988-
if (ci->version == NULL)
1989-
if ((ci->version = ASN1_INTEGER_new()) == NULL)
1990-
goto err;
1991-
ASN1_INTEGER_set(ci->version, 2); /* version 3 certificate */
19921988

19931989
/*
19941990
* Free the current entries if any, there should not be any I believe
@@ -2051,6 +2047,15 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
20512047
goto err;
20522048
}
20532049

2050+
{
2051+
STACK_OF(X509_EXTENSION) *exts = ci->extensions;
2052+
2053+
if (exts != NULL && sk_X509_EXTENSION_num(exts) > 0)
2054+
/* Make it an X509 v3 certificate. */
2055+
if (!X509_set_version(ret, 2))
2056+
goto err;
2057+
}
2058+
20542059
/* Set the right value for the noemailDN option */
20552060
if (email_dn == 0) {
20562061
if (!X509_set_subject_name(ret, dn_subject))

‎deps/openssl/openssl/apps/s_client.c‎

Lines changed: 10 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -180,13 +180,6 @@ typedef unsigned int u_int;
180180
# include <fcntl.h>
181181
#endif
182182

183-
/* Use Windows API with STD_INPUT_HANDLE when checking for input?
184-
Don't look at OPENSSL_SYS_MSDOS for this, since it is always defined if
185-
OPENSSL_SYS_WINDOWS is defined */
186-
#if defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_WINCE) && defined(STD_INPUT_HANDLE)
187-
#define OPENSSL_USE_STD_INPUT_HANDLE
188-
#endif
189-
190183
#undef PROG
191184
#define PROG s_client_main
192185

@@ -236,7 +229,6 @@ static BIO *bio_c_msg = NULL;
236229
static int c_quiet = 0;
237230
static int c_ign_eof = 0;
238231
static int c_brief = 0;
239-
static int c_no_rand_screen = 0;
240232

241233
#ifndef OPENSSL_NO_PSK
242234
/* Default PSK identity and key */
@@ -452,10 +444,6 @@ static void sc_usage(void)
452444
" -keymatexport label - Export keying material using label\n");
453445
BIO_printf(bio_err,
454446
" -keymatexportlen len - Export len bytes of keying material (default 20)\n");
455-
#ifdef OPENSSL_SYS_WINDOWS
456-
BIO_printf(bio_err,
457-
" -no_rand_screen - Do not use RAND_screen() to initialize random state\n");
458-
#endif
459447
}
460448

461449
#ifndef OPENSSL_NO_TLSEXT
@@ -1148,10 +1136,6 @@ int MAIN(int argc, char **argv)
11481136
keymatexportlen = atoi(*(++argv));
11491137
if (keymatexportlen == 0)
11501138
goto bad;
1151-
#ifdef OPENSSL_SYS_WINDOWS
1152-
} else if (strcmp(*argv, "-no_rand_screen") == 0) {
1153-
c_no_rand_screen = 1;
1154-
#endif
11551139
} else {
11561140
BIO_printf(bio_err, "unknown option %s\n", *argv);
11571141
badop = 1;
@@ -1268,7 +1252,7 @@ int MAIN(int argc, char **argv)
12681252
if (!load_excert(&exc, bio_err))
12691253
goto end;
12701254

1271-
if (!app_RAND_load_file(NULL, bio_err, ++c_no_rand_screen) && inrand == NULL
1255+
if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
12721256
&& !RAND_status()) {
12731257
BIO_printf(bio_err,
12741258
"warning, not much extra random data, consider using the -rand option\n");
@@ -1683,6 +1667,8 @@ int MAIN(int argc, char **argv)
16831667
if (strstr(mbuf, "/stream:features>"))
16841668
goto shut;
16851669
seen = BIO_read(sbio, mbuf, BUFSIZZ);
1670+
if (seen <= 0)
1671+
goto shut;
16861672
mbuf[seen] = 0;
16871673
}
16881674
BIO_printf(sbio,
@@ -1806,16 +1792,17 @@ int MAIN(int argc, char **argv)
18061792
tv.tv_usec = 0;
18071793
i = select(width, (void *)&readfds, (void *)&writefds,
18081794
NULL, &tv);
1809-
#if defined(OPENSSL_USE_STD_INPUT_HANDLE)
1795+
# if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
1796+
if (!i && (!_kbhit() || !read_tty))
1797+
continue;
1798+
# else
18101799
if (!i && (!((_kbhit())
18111800
|| (WAIT_OBJECT_0 ==
18121801
WaitForSingleObject(GetStdHandle
18131802
(STD_INPUT_HANDLE),
18141803
0)))
18151804
|| !read_tty))
18161805
continue;
1817-
#else
1818-
if(!i && (!_kbhit() || !read_tty) ) continue;
18191806
# endif
18201807
} else
18211808
i = select(width, (void *)&readfds, (void *)&writefds,
@@ -2017,12 +2004,12 @@ int MAIN(int argc, char **argv)
20172004
}
20182005
}
20192006
#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
2020-
#if defined(OPENSSL_USE_STD_INPUT_HANDLE)
2007+
# if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
2008+
else if (_kbhit())
2009+
# else
20212010
else if ((_kbhit())
20222011
|| (WAIT_OBJECT_0 ==
20232012
WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0)))
2024-
#else
2025-
else if (_kbhit())
20262013
# endif
20272014
#elif defined (OPENSSL_SYS_NETWARE)
20282015
else if (_kbhit())

‎deps/openssl/openssl/apps/s_server.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3017,7 +3017,7 @@ static int www_body(char *hostname, int s, int stype, unsigned char *context)
30173017
PEM_write_bio_X509(io, peer);
30183018
} else
30193019
BIO_puts(io, "no client certificate available\n");
3020-
BIO_puts(io, "</BODY></HTML>\r\n\r\n");
3020+
BIO_puts(io, "</pre></BODY></HTML>\r\n\r\n");
30213021
break;
30223022
} else if ((www == 2 || www == 3)
30233023
&& (strncmp("GET /", buf, 5) == 0)) {

0 commit comments

Comments
 (0)