Import OpenSSL 1.1.1s - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Jung-uk Kim <jkim@FreeBSD.org>	2022-11-01 22:43:36 +0000
committer	Enji Cooper <ngie@FreeBSD.org>	2023-03-01 03:28:39 +0000
commit	aba33b3659256dde6e895b52bcff90550f77d49f (patch)
tree	ab50b420cdc80f1ba42f9a7f7453a8eb464c2f0c /crypto
parent	f874e59ffcd8b5ecd018ad8311d78e866340f3e9 (diff)

Diffstat (limited to 'crypto')

-rwxr-xr-x

crypto/aes/asm/aesv8-armx.pl

-rw-r--r--

crypto/asn1/charmap.pl

-rw-r--r--

crypto/bn/bn_nist.c

-rw-r--r--

crypto/bn/bn_prime.pl

-rw-r--r--

crypto/conf/keysets.pl

-rw-r--r--

crypto/ec/ec_key.c

-rw-r--r--

crypto/objects/obj_dat.pl

-rw-r--r--

crypto/objects/objects.pl

-rw-r--r--

crypto/objects/objxref.pl

-rw-r--r--

crypto/pem/pem_lib.c

-rw-r--r--

crypto/rand/drbg_lib.c

-rw-r--r--

crypto/rand/rand_lib.c

-rw-r--r--

crypto/x509/x509_req.c

-rw-r--r--

crypto/x509/x509_vfy.c

-rw-r--r--

crypto/x509/x_all.c

-rw-r--r--

crypto/x509v3/v3_addr.c

-rw-r--r--

crypto/x509v3/v3_lib.c

-rw-r--r--

crypto/x509v3/v3_utl.c

18 files changed, 208 insertions, 91 deletions

diff --git a/crypto/aes/asm/aesv8-armx.pl b/crypto/aes/asm/aesv8-armx.pl
index 2b0e982996d1..7edc436a53ca 100755
--- a/crypto/aes/asm/aesv8-armx.pl
+++ b/crypto/aes/asm/aesv8-armx.pl

@@ -1,5 +1,5 @@

#! /usr/bin/env perl

# Licensed under the OpenSSL license (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -740,6 +740,21 @@ $code.=<<___;

#ifndef __ARMEB__

rev $ctr, $ctr

#endif

+___

+$code.=<<___ if ($flavour =~ /64/);

+ vorr $dat1,$dat0,$dat0

+ add $tctr1, $ctr, #1

+ vorr $dat2,$dat0,$dat0

+ add $ctr, $ctr, #2

+ vorr $ivec,$dat0,$dat0

+ rev $tctr1, $tctr1

+ vmov.32 ${dat1}[3],$tctr1

+ b.ls .Lctr32_tail

+ rev $tctr2, $ctr

+ sub $len,$len,#3 // bias

+ vmov.32 ${dat2}[3],$tctr2

+___

+$code.=<<___ if ($flavour !~ /64/);

add $tctr1, $ctr, #1

vorr $ivec,$dat0,$dat0

rev $tctr1, $tctr1

@@ -751,6 +766,8 @@ $code.=<<___;

vmov.32 ${ivec}[3],$tctr2

sub $len,$len,#3 // bias

vorr $dat2,$ivec,$ivec

+___

+$code.=<<___;

b .Loop3x_ctr32

.align 4

@@ -777,11 +794,25 @@ $code.=<<___;

aese $dat1,q8

aesmc $tmp1,$dat1

vld1.8 {$in0},[$inp],#16

+___

+$code.=<<___ if ($flavour =~ /64/);

+ vorr $dat0,$ivec,$ivec

+___

+$code.=<<___ if ($flavour !~ /64/);

add $tctr0,$ctr,#1

+___

+$code.=<<___;

aese $dat2,q8

aesmc $dat2,$dat2

vld1.8 {$in1},[$inp],#16

+___

+$code.=<<___ if ($flavour =~ /64/);

+ vorr $dat1,$ivec,$ivec

+___

+$code.=<<___ if ($flavour !~ /64/);

rev $tctr0,$tctr0

+___

+$code.=<<___;

aese $tmp0,q9

aesmc $tmp0,$tmp0

aese $tmp1,q9

@@ -790,6 +821,12 @@ $code.=<<___;

mov $key_,$key

aese $dat2,q9

aesmc $tmp2,$dat2

+___

+$code.=<<___ if ($flavour =~ /64/);

+ vorr $dat2,$ivec,$ivec

+ add $tctr0,$ctr,#1

+___

+$code.=<<___;

aese $tmp0,q12

aesmc $tmp0,$tmp0

aese $tmp1,q12

@@ -805,22 +842,47 @@ $code.=<<___;

aese $tmp1,q13

aesmc $tmp1,$tmp1

veor $in2,$in2,$rndlast

+___

+$code.=<<___ if ($flavour =~ /64/);

+ rev $tctr0,$tctr0

+ aese $tmp2,q13

+ aesmc $tmp2,$tmp2

+ vmov.32 ${dat0}[3], $tctr0

+___

+$code.=<<___ if ($flavour !~ /64/);

vmov.32 ${ivec}[3], $tctr0

aese $tmp2,q13

aesmc $tmp2,$tmp2

vorr $dat0,$ivec,$ivec

+___

+$code.=<<___;

rev $tctr1,$tctr1

aese $tmp0,q14

aesmc $tmp0,$tmp0

+___

+$code.=<<___ if ($flavour !~ /64/);

vmov.32 ${ivec}[3], $tctr1

rev $tctr2,$ctr

+___

+$code.=<<___;

aese $tmp1,q14

aesmc $tmp1,$tmp1

+___

+$code.=<<___ if ($flavour =~ /64/);

+ vmov.32 ${dat1}[3], $tctr1

+ rev $tctr2,$ctr

+ aese $tmp2,q14

+ aesmc $tmp2,$tmp2

+ vmov.32 ${dat2}[3], $tctr2

+___

+$code.=<<___ if ($flavour !~ /64/);

vorr $dat1,$ivec,$ivec

vmov.32 ${ivec}[3], $tctr2

aese $tmp2,q14

aesmc $tmp2,$tmp2

vorr $dat2,$ivec,$ivec

+___

+$code.=<<___;

subs $len,$len,#3

aese $tmp0,q15

aese $tmp1,q15

diff --git a/crypto/asn1/charmap.pl b/crypto/asn1/charmap.pl
index dadd8df7749d..52fa5a7900ca 100644
--- a/crypto/asn1/charmap.pl
+++ b/crypto/asn1/charmap.pl

@@ -1,5 +1,5 @@

#! /usr/bin/env perl

# Licensed under the OpenSSL license (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -7,6 +7,9 @@

# https://www.openssl.org/source/license.html

use strict;

+use FindBin;

+use lib "$FindBin::Bin/../../util/perl";

+use OpenSSL::copyright;

my ($i, @arr);

@@ -82,8 +85,8 @@ $arr[ord("?")] |= $PSTRING_CHAR;

# Now generate the C code

-# Output year depends on the year of the script.

-my $YEAR = [localtime([stat($0)]->[9])]->[5] + 1900;

+# Year the file was generated.

+my $YEAR = OpenSSL::copyright::year_of($0);

print <<EOF;

* WARNING: do not edit!

diff --git a/crypto/bn/bn_nist.c b/crypto/bn/bn_nist.c
index 325dc228490a..c29e62ed3fef 100644
--- a/crypto/bn/bn_nist.c
+++ b/crypto/bn/bn_nist.c

@@ -1,5 +1,5 @@

* Licensed under the OpenSSL license (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -249,17 +249,28 @@ const BIGNUM *BN_get0_nist_prime_521(void)

return &_bignum_nist_p_521;

}

-static void nist_cp_bn_0(BN_ULONG *dst, const BN_ULONG *src, int top, int max)

- int i;

-#ifdef BN_DEBUG

- (void)ossl_assert(top <= max);

-#endif

- for (i = 0; i < top; i++)

- dst[i] = src[i];

- for (; i < max; i++)

- dst[i] = 0;

+/*

+ * To avoid more recent compilers (specifically clang-14) from treating this

+ * code as a violation of the strict aliasing conditions and omiting it, this

+ * cannot be declared as a function. Moreover, the dst parameter cannot be

+ * cached in a local since this no longer references the union and again falls

+ * foul of the strict aliasing criteria. Refer to #18225 for the initial

+ * diagnostics and llvm/llvm-project#55255 for the later discussions with the

+ * LLVM developers. The problem boils down to if an array in the union is

+ * converted to a pointer or if it is used directly.

+ *

+ * This function was inlined regardless, so there is no space cost to be

+ * paid for making it a macro.

+ */

+#define nist_cp_bn_0(dst, src_in, top, max) \

+{ \

+ int ii; \

+ const BN_ULONG *src = src_in; \

+ \

+ for (ii = 0; ii < top; ii++) \

+ (dst)[ii] = src[ii]; \

+ for (; ii < max; ii++) \

+ (dst)[ii] = 0; \

}

static void nist_cp_bn(BN_ULONG *dst, const BN_ULONG *src, int top)

diff --git a/crypto/bn/bn_prime.pl b/crypto/bn/bn_prime.pl
index b0b16087429b..d2eaac6564f8 100644
--- a/crypto/bn/bn_prime.pl
+++ b/crypto/bn/bn_prime.pl

@@ -1,13 +1,16 @@

#! /usr/bin/env perl

# Licensed under the OpenSSL license (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

# in the file LICENSE in the source distribution or at

# https://www.openssl.org/source/license.html

+use FindBin;

+use lib "$FindBin::Bin/../../util/perl";

+use OpenSSL::copyright;

-# Output year depends on the year of the script.

-my $YEAR = [localtime([stat($0)]->[9])]->[5] + 1900;

+# The year the output file is generated.

+my $YEAR = OpenSSL::copyright::year_of($0);

print <<"EOF";

* WARNING: do not edit!

diff --git a/crypto/conf/keysets.pl b/crypto/conf/keysets.pl
index 27a7214cc519..9c9a00dea8d7 100644
--- a/crypto/conf/keysets.pl
+++ b/crypto/conf/keysets.pl

@@ -1,5 +1,5 @@

#! /usr/bin/env perl

# Licensed under the OpenSSL license (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -8,6 +8,9 @@

use strict;

use warnings;

+use FindBin;

+use lib "$FindBin::Bin/../../util/perl";

+use OpenSSL::copyright;

my $NUMBER = 0x0001;

my $UPPER = 0x0002;

@@ -54,9 +57,8 @@ foreach (0 .. 127) {

push(@V_w32, $v);

}

-# Output year depends on the year of the script.

-my $YEAR = [localtime([stat($0)]->[9])]->[5] + 1900;

+# The year the output file is generated.

+my $YEAR = OpenSSL::copyright::year_of($0);

print <<"EOF";

* WARNING: do not edit!

diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index 3017f0936c0d..63799002bc98 100644
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c

@@ -444,6 +444,16 @@ int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key)

return 0;

+ * Return `0` to comply with legacy behavior for this function, see

+ * https://github.com/openssl/openssl/issues/18744#issuecomment-1195175696

+ */

+ if (priv_key == NULL) {

+ BN_clear_free(key->priv_key);

+ key->priv_key = NULL;

+ return 0; /* intentional for legacy compatibility */

+ }

+ /*

* We should never leak the bit length of the secret scalar in the key,

* so we always set the `BN_FLG_CONSTTIME` flag on the internal `BIGNUM`

* holding the secret scalar.

diff --git a/crypto/objects/obj_dat.pl b/crypto/objects/obj_dat.pl
index e5d38147eccf..e1b4a02f288f 100644
--- a/crypto/objects/obj_dat.pl
+++ b/crypto/objects/obj_dat.pl

@@ -1,5 +1,5 @@

#! /usr/bin/env perl

# Licensed under the OpenSSL license (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -9,6 +9,9 @@

use integer;

use strict;

use warnings;

+use FindBin;

+use lib "$FindBin::Bin/../../util/perl";

+use OpenSSL::copyright;

# Generate the DER encoding for the given OID.

sub der_it

@@ -36,10 +39,8 @@ sub der_it

return $ret;

}

-# Output year depends on the year of the script and the input file.

-my $YEAR = [localtime([stat($0)]->[9])]->[5] + 1900;

-my $iYEAR = [localtime([stat($ARGV[0])]->[9])]->[5] + 1900;

-$YEAR = $iYEAR if $iYEAR > $YEAR;

+# The year the output file is generated.

+my $YEAR = OpenSSL::copyright::latest(($0, $ARGV[0]));

# Read input, parse all #define's into OID name and value.

# Populate %ln and %sn with long and short names (%dupln and %dupsn)

diff --git a/crypto/objects/objects.pl b/crypto/objects/objects.pl
index d7d1962c9999..8b258d4df509 100644
--- a/crypto/objects/objects.pl
+++ b/crypto/objects/objects.pl

@@ -1,5 +1,5 @@

#! /usr/bin/env perl

# Licensed under the OpenSSL license (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -7,16 +7,15 @@

# https://www.openssl.org/source/license.html

use Getopt::Std;

+use FindBin;

+use lib "$FindBin::Bin/../../util/perl";

+use OpenSSL::copyright;

our($opt_n);

getopts('n');

-# Output year depends on the year of the script and the input file.

-my $YEAR = [localtime([stat($0)]->[9])]->[5] + 1900;

-my $iYEAR = [localtime([stat($ARGV[0])]->[9])]->[5] + 1900;

-$YEAR = $iYEAR if $iYEAR > $YEAR;

-$iYEAR = [localtime([stat($ARGV[1])]->[9])]->[5] + 1900;

-$YEAR = $iYEAR if $iYEAR > $YEAR;

+# The year the output file is generated.

+my $YEAR = OpenSSL::copyright::latest(($0, $ARGV[1], $ARGV[0]));

open (NUMIN,"$ARGV[1]") || die "Can't open number file $ARGV[1]";

$max_nid=0;

diff --git a/crypto/objects/objxref.pl b/crypto/objects/objxref.pl
index ce76cadae31c..4d4b9074fc26 100644
--- a/crypto/objects/objxref.pl
+++ b/crypto/objects/objxref.pl

@@ -1,5 +1,5 @@

#! /usr/bin/env perl

# Licensed under the OpenSSL license (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -8,18 +8,17 @@

use strict;

+use FindBin;

+use lib "$FindBin::Bin/../../util/perl";

+use OpenSSL::copyright;

my %xref_tbl;

my %oid_tbl;

my ($mac_file, $xref_file) = @ARGV;

-# Output year depends on the year of the script and the input file.

-my $YEAR = [localtime([stat($0)]->[9])]->[5] + 1900;

-my $iYEAR = [localtime([stat($mac_file)]->[9])]->[5] + 1900;

-$YEAR = $iYEAR if $iYEAR > $YEAR;

-$iYEAR = [localtime([stat($xref_file)]->[9])]->[5] + 1900;

-$YEAR = $iYEAR if $iYEAR > $YEAR;

+# The year the output file is generated.

+my $YEAR = OpenSSL::copyright::latest(($0, $mac_file, $xref_file));

open(IN, $mac_file) || die "Can't open $mac_file, $!\n";

diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index 2de093595d0d..aae42d98d297 100644
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c

@@ -1,5 +1,5 @@

* Licensed under the OpenSSL license (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -621,7 +621,7 @@ int PEM_write_bio(BIO *bp, const char *name, const char *header,

(BIO_write(bp, "-----\n", 6) != 6))

goto err;

- i = strlen(header);

+ i = header != NULL ? strlen(header) : 0;

if (i > 0) {

if ((BIO_write(bp, header, i) != i) || (BIO_write(bp, "\n", 1) != 1))

goto err;

diff --git a/crypto/rand/drbg_lib.c b/crypto/rand/drbg_lib.c
index 8c7c28c9703a..d32fa80cf89d 100644
--- a/crypto/rand/drbg_lib.c
+++ b/crypto/rand/drbg_lib.c

@@ -1,5 +1,5 @@

* Licensed under the OpenSSL license (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -354,13 +354,8 @@ int RAND_DRBG_instantiate(RAND_DRBG *drbg,

drbg->state = DRBG_READY;

drbg->generate_counter = 1;

drbg->reseed_time = time(NULL);

- if (drbg->enable_reseed_propagation) {

- if (drbg->parent == NULL)

- tsan_counter(&drbg->reseed_counter);

- else

- tsan_store(&drbg->reseed_counter,

- tsan_load(&drbg->parent->reseed_counter));

- }

+ if (drbg->enable_reseed_propagation && drbg->parent == NULL)

+ tsan_counter(&drbg->reseed_counter);

end:

if (entropy != NULL && drbg->cleanup_entropy != NULL)

@@ -444,13 +439,8 @@ int RAND_DRBG_reseed(RAND_DRBG *drbg,

drbg->state = DRBG_READY;

drbg->generate_counter = 1;

drbg->reseed_time = time(NULL);

- if (drbg->enable_reseed_propagation) {

- if (drbg->parent == NULL)

- tsan_counter(&drbg->reseed_counter);

- else

- tsan_store(&drbg->reseed_counter,

- tsan_load(&drbg->parent->reseed_counter));

- }

+ if (drbg->enable_reseed_propagation && drbg->parent == NULL)

+ tsan_counter(&drbg->reseed_counter);

end:

if (entropy != NULL && drbg->cleanup_entropy != NULL)

diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c
index 5c72fad8ca26..3fdb56cb0024 100644
--- a/crypto/rand/rand_lib.c
+++ b/crypto/rand/rand_lib.c

@@ -1,5 +1,5 @@

* Licensed under the OpenSSL license (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -172,8 +172,12 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg,

if (RAND_DRBG_generate(drbg->parent,

buffer, bytes_needed,

prediction_resistance,

- (unsigned char *)&drbg, sizeof(drbg)) != 0)

+ (unsigned char *)&drbg, sizeof(drbg)) != 0) {

bytes = bytes_needed;

+ if (drbg->enable_reseed_propagation)

+ tsan_store(&drbg->reseed_counter,

+ tsan_load(&drbg->parent->reseed_counter));

+ }

rand_drbg_unlock(drbg->parent);

rand_pool_add_end(pool, bytes, 8 * bytes);

diff --git a/crypto/x509/x509_req.c b/crypto/x509/x509_req.c
index dd674926ddb5..c2b8cb9f3e2d 100644
--- a/crypto/x509/x509_req.c
+++ b/crypto/x509/x509_req.c

@@ -1,5 +1,5 @@

* Licensed under the OpenSSL license (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -167,7 +167,9 @@ STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)

ext = X509_ATTRIBUTE_get0_type(attr, 0);

break;

}

- if (!ext || (ext->type != V_ASN1_SEQUENCE))

+ if (ext == NULL) /* no extensions is not an error */

+ return sk_X509_EXTENSION_new_null();

+ if (ext->type != V_ASN1_SEQUENCE)

return NULL;

p = ext->value.sequence->data;

return (STACK_OF(X509_EXTENSION) *)

@@ -227,44 +229,52 @@ X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)

X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)

{

- return X509at_delete_attr(req->req_info.attributes, loc);

+ X509_ATTRIBUTE *attr = X509at_delete_attr(req->req_info.attributes, loc);

+ if (attr != NULL)

+ req->req_info.enc.modified = 1;

+ return attr;

}

int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)

{

- if (X509at_add1_attr(&req->req_info.attributes, attr))

- return 1;

- return 0;

+ if (!X509at_add1_attr(&req->req_info.attributes, attr))

+ return 0;

+ req->req_info.enc.modified = 1;

+ return 1;

}

int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,

const ASN1_OBJECT *obj, int type,

const unsigned char *bytes, int len)

{

- if (X509at_add1_attr_by_OBJ(&req->req_info.attributes, obj,

- type, bytes, len))

- return 1;

- return 0;

+ if (!X509at_add1_attr_by_OBJ(&req->req_info.attributes, obj,

+ type, bytes, len))

+ return 0;

+ req->req_info.enc.modified = 1;

+ return 1;

}

int X509_REQ_add1_attr_by_NID(X509_REQ *req,

int nid, int type,

const unsigned char *bytes, int len)

{

- if (X509at_add1_attr_by_NID(&req->req_info.attributes, nid,

- type, bytes, len))

- return 1;

- return 0;

+ if (!X509at_add1_attr_by_NID(&req->req_info.attributes, nid,

+ type, bytes, len))

+ return 0;

+ req->req_info.enc.modified = 1;

+ return 1;

}

int X509_REQ_add1_attr_by_txt(X509_REQ *req,

const char *attrname, int type,

const unsigned char *bytes, int len)

{

- if (X509at_add1_attr_by_txt(&req->req_info.attributes, attrname,

- type, bytes, len))

- return 1;

- return 0;

+ if (!X509at_add1_attr_by_txt(&req->req_info.attributes, attrname,

+ type, bytes, len))

+ return 0;

+ req->req_info.enc.modified = 1;

+ return 1;

}

long X509_REQ_get_version(const X509_REQ *req)

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index b18489f67f6e..925fbb541258 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c

@@ -973,14 +973,14 @@ static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)

time_t *ptime;

int i;

- if (notify)

- ctx->current_crl = crl;

if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)

ptime = &ctx->param->check_time;

else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)

return 1;

else

ptime = NULL;

+ if (notify)

+ ctx->current_crl = crl;

i = X509_cmp_time(X509_CRL_get0_lastUpdate(crl), ptime);

if (i == 0) {

diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c
index a4e9cdaee837..fcf6b5ba3780 100644
--- a/crypto/x509/x_all.c
+++ b/crypto/x509/x_all.c

@@ -1,5 +1,5 @@

* Licensed under the OpenSSL license (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -41,6 +41,13 @@ int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r)

int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)

{

+ /*

+ * Setting the modified flag before signing it. This makes the cached

+ * encoding to be ignored, so even if the certificate fields have changed,

+ * they are signed correctly.

+ * The X509_sign_ctx, X509_REQ_sign{,_ctx}, X509_CRL_sign{,_ctx} functions

+ * which exist below are the same.

+ */

x->cert_info.enc.modified = 1;

return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CINF), &x->cert_info.signature,

&x->sig_alg, &x->signature, &x->cert_info, pkey,

@@ -65,12 +72,14 @@ int X509_http_nbio(OCSP_REQ_CTX *rctx, X509 **pcert)

int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)

{

+ x->req_info.enc.modified = 1;

return (ASN1_item_sign(ASN1_ITEM_rptr(X509_REQ_INFO), &x->sig_alg, NULL,

x->signature, &x->req_info, pkey, md));

}

int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx)

{

+ x->req_info.enc.modified = 1;

return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO),

&x->sig_alg, NULL, x->signature, &x->req_info,

ctx);

diff --git a/crypto/x509v3/v3_addr.c b/crypto/x509v3/v3_addr.c
index ccce34ef2e48..f9c368bea405 100644
--- a/crypto/x509v3/v3_addr.c
+++ b/crypto/x509v3/v3_addr.c

@@ -392,12 +392,14 @@ static int range_should_be_prefix(const unsigned char *min,

* Construct a prefix.

-static int make_addressPrefix(IPAddressOrRange **result,

- unsigned char *addr, const int prefixlen)

+static int make_addressPrefix(IPAddressOrRange **result, unsigned char *addr,

+ const int prefixlen, const int afilen)

{

int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;

IPAddressOrRange *aor = IPAddressOrRange_new();

+ if (prefixlen < 0 || prefixlen > (afilen * 8))

+ return 0;

if (aor == NULL)

return 0;

aor->type = IPAddressOrRange_addressPrefix;

@@ -437,7 +439,7 @@ static int make_addressRange(IPAddressOrRange **result,

return 0;

if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)

- return make_addressPrefix(result, min, prefixlen);

+ return make_addressPrefix(result, min, prefixlen, length);

if ((aor = IPAddressOrRange_new()) == NULL)

return 0;

@@ -599,7 +601,9 @@ int X509v3_addr_add_prefix(IPAddrBlocks *addr,

{

IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);

IPAddressOrRange *aor;

- if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen))

+ if (aors == NULL

+ || !make_addressPrefix(&aor, a, prefixlen, length_from_afi(afi)))

return 0;

if (sk_IPAddressOrRange_push(aors, aor))

return 1;

@@ -996,7 +1000,10 @@ static void *v2i_IPAddrBlocks(const struct v3_ext_method *method,

switch (delim) {

case '/':

prefixlen = (int)strtoul(s + i2, &t, 10);

- if (t == s + i2 || *t != '\0') {

+ if (t == s + i2

+ || *t != '\0'

+ || prefixlen > (length * 8)

+ || prefixlen < 0) {

X509V3err(X509V3_F_V2I_IPADDRBLOCKS,

X509V3_R_EXTENSION_VALUE_ERROR);

X509V3_conf_err(val);

diff --git a/crypto/x509v3/v3_lib.c b/crypto/x509v3/v3_lib.c
index 97c1cbc20fed..ea88ff2acd22 100644
--- a/crypto/x509v3/v3_lib.c
+++ b/crypto/x509v3/v3_lib.c

@@ -1,5 +1,5 @@

* Licensed under the OpenSSL license (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -242,8 +242,10 @@ int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,

}

/* If delete, just delete it */

if (ext_op == X509V3_ADD_DELETE) {

- if (!sk_X509_EXTENSION_delete(*x, extidx))

+ extmp = sk_X509_EXTENSION_delete(*x, extidx);

+ if (extmp == NULL)

return -1;

+ X509_EXTENSION_free(extmp);

return 1;

}

} else {

diff --git a/crypto/x509v3/v3_utl.c b/crypto/x509v3/v3_utl.c
index a7ff4b4fb4d3..eac78259fc82 100644
--- a/crypto/x509v3/v3_utl.c
+++ b/crypto/x509v3/v3_utl.c

@@ -1087,12 +1087,17 @@ int a2i_ipadd(unsigned char *ipout, const char *ipasc)

static int ipv4_from_asc(unsigned char *v4, const char *in)

{

- int a0, a1, a2, a3;

- if (sscanf(in, "%d.%d.%d.%d", &a0, &a1, &a2, &a3) != 4)

+ const char *p;

+ int a0, a1, a2, a3, n;

+ if (sscanf(in, "%d.%d.%d.%d%n", &a0, &a1, &a2, &a3, &n) != 4)

return 0;

if ((a0 < 0) || (a0 > 255) || (a1 < 0) || (a1 > 255)

|| (a2 < 0) || (a2 > 255) || (a3 < 0) || (a3 > 255))

return 0;

+ p = in + n;

+ if (!(*p == '\0' || ossl_isspace(*p)))

+ return 0;

v4[0] = a0;

v4[1] = a1;

v4[2] = a2;