diff options
| author | Bjoern A. Zeeb <bz@FreeBSD.org> | 2012-05-30 12:01:28 +0000 |
|---|---|---|
| committer | Bjoern A. Zeeb <bz@FreeBSD.org> | 2012-05-30 12:01:28 +0000 |
| commit | f9ac304cf1df205f702fc1d3e9d78a1474dfa57c (patch) | |
| tree | 2a1056265e6a627d3adfb9f71ec4d6e1f34d0168 | |
| parent | 09a865e4fb3a349c2b913957ddf000f466439bb4 (diff) | |
| download | src-f9ac304cf1df205f702fc1d3e9d78a1474dfa57c.tar.gz src-f9ac304cf1df205f702fc1d3e9d78a1474dfa57c.zip | |
Notes
| -rw-r--r-- | UPDATING | 6 | ||||
| -rw-r--r-- | crypto/openssl/crypto/buffer/buffer.c | 2 | ||||
| -rw-r--r-- | crypto/openssl/ssl/s3_srvr.c | 15 | ||||
| -rw-r--r-- | secure/lib/libcrypt/crypt-des.c | 2 | ||||
| -rw-r--r-- | sys/conf/newvers.sh | 2 |
5 files changed, 16 insertions, 11 deletions
@@ -9,6 +9,12 @@ handbook. Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before running portupgrade. +20120530: p2 FreeBSD-SA-12:01.openssl (revised), + FreeBSD-SA-12:02.crypt + Update the previous openssl fix. [12:01] + + Fix a bug in crypt(3) ignoring characters of a passphrase. [12:02] + 20120503: p1 FreeBSD-SA-12:01.openssl Fix multiple OpenSSL vulnerabilities. diff --git a/crypto/openssl/crypto/buffer/buffer.c b/crypto/openssl/crypto/buffer/buffer.c index 0335d48f68af..3b4c79f7048c 100644 --- a/crypto/openssl/crypto/buffer/buffer.c +++ b/crypto/openssl/crypto/buffer/buffer.c @@ -166,7 +166,7 @@ int BUF_MEM_grow_clean(BUF_MEM *str, int len) /* This limit is sufficient to ensure (len+3)/3*4 < 2**31 */ if (len > LIMIT_BEFORE_EXPANSION) { - BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE); + BUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE); return 0; } n=(len+3)/3*4; diff --git a/crypto/openssl/ssl/s3_srvr.c b/crypto/openssl/ssl/s3_srvr.c index 24e4991098f5..36d929be230c 100644 --- a/crypto/openssl/ssl/s3_srvr.c +++ b/crypto/openssl/ssl/s3_srvr.c @@ -698,14 +698,6 @@ int ssl3_check_client_hello(SSL *s) int ok; long n; - /* We only allow the client to restart the handshake once per - * negotiation. */ - if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE) - { - SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS); - return -1; - } - /* this function is called when we really expect a Certificate message, * so permit appropriate message length */ n=s->method->ssl_get_message(s, @@ -718,6 +710,13 @@ int ssl3_check_client_hello(SSL *s) s->s3->tmp.reuse_message = 1; if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO) { + /* We only allow the client to restart the handshake once per + * negotiation. */ + if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE) + { + SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS); + return -1; + } /* Throw away what we have done so far in the current handshake, * which will now be aborted. (A full SSL_clear would be too much.) */ #ifndef OPENSSL_NO_DH diff --git a/secure/lib/libcrypt/crypt-des.c b/secure/lib/libcrypt/crypt-des.c index 9adff936f3ad..6bb9bc03c76f 100644 --- a/secure/lib/libcrypt/crypt-des.c +++ b/secure/lib/libcrypt/crypt-des.c @@ -606,7 +606,7 @@ crypt_des(const char *key, const char *setting) q = (u_char *)keybuf; while (q - (u_char *)keybuf - 8) { *q++ = *key << 1; - if (*(q - 1)) + if (*key != '\0') key++; } if (des_setkey((char *)keybuf)) diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index 1e384388f4e8..794c720a6d4f 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="9.0" -BRANCH="RELEASE-p1" +BRANCH="RELEASE-p2" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi |