openssl: Vendor import of OpenSSL-3.0.9 - src

diff options


context:
space:
mode:

author	Pierre Pronchery <pierre@freebsdfoundation.org>	2023-08-02 16:26:43 +0000
committer	Ed Maste <emaste@FreeBSD.org>	2023-08-03 01:09:39 +0000
commit	cf2fc1b0f5ce501f5a29d307294e5637e0f5aba6 (patch)
tree	a2a5a488a727724dbe0c40f964fd21be2bf2d2c6 /crypto
parent	b84c4564effd02dfdc047dd6cbeaf910bbb1a888 (diff)

vendor/openssl/3.0.10

Diffstat (limited to 'crypto')

-rw-r--r--

crypto/LPdir_unix.c

-rw-r--r--

crypto/asn1/asn_mime.c

-rw-r--r--

-rw-r--r--

-rw-r--r--

-rw-r--r--

-rw-r--r--

crypto/conf/conf_mod.c

-rw-r--r--

crypto/conf/conf_sap.c

-rw-r--r--

crypto/core_namemap.c

-rw-r--r--

crypto/dh/dh_check.c

-rw-r--r--

crypto/err/openssl.txt

-rw-r--r--

crypto/evp/ctrl_params_translate.c

-rw-r--r--

crypto/evp/p5_crpt2.c

-rw-r--r--

crypto/evp/p_lib.c

-rw-r--r--

crypto/http/http_lib.c

-rw-r--r--

crypto/params.c

-rw-r--r--

crypto/pkcs12/p12_mutl.c

-rw-r--r--

crypto/rand/rand_lib.c

-rw-r--r--

crypto/rc4/build.info

-rw-r--r--

crypto/rsa/rsa_ameth.c

-rw-r--r--

crypto/rsa/rsa_pmeth.c

-rwxr-xr-x

crypto/sha/asm/keccak1600-avx2.pl

-rwxr-xr-x

crypto/sha/asm/keccak1600-avx512.pl

-rwxr-xr-x

crypto/sha/asm/keccak1600-avx512vl.pl

-rw-r--r--

crypto/store/store_result.c

-rw-r--r--

crypto/x509/by_dir.c

-rw-r--r--

crypto/x509/v3_ist.c

-rw-r--r--

crypto/x509/v3_purp.c

-rw-r--r--

crypto/x509/x509_att.c

-rw-r--r--

crypto/x509/x509_cmp.c

-rw-r--r--

crypto/x509/x509_err.c

-rw-r--r--

crypto/x509/x509_vpm.c

32 files changed, 223 insertions, 79 deletions

diff --git a/crypto/LPdir_unix.c b/crypto/LPdir_unix.c
index bc0e924e46a7..b6dda7bce2ec 100644
--- a/crypto/LPdir_unix.c
+++ b/crypto/LPdir_unix.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -137,7 +137,7 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)

if ((*ctx)->expect_file_generations) {

char *p = (*ctx)->entry_name + strlen((*ctx)->entry_name);

- while(p > (*ctx)->entry_name && isdigit(p[-1]))

+ while (p > (*ctx)->entry_name && isdigit((unsigned char)p[-1]))

p--;

if (p > (*ctx)->entry_name && p[-1] == ';')

p[-1] = '\0';

diff --git a/crypto/asn1/asn_mime.c b/crypto/asn1/asn_mime.c
index b44b0f36858b..9fc52d047626 100644
--- a/crypto/asn1/asn_mime.c
+++ b/crypto/asn1/asn_mime.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -516,6 +516,12 @@ int SMIME_crlf_copy(BIO *in, BIO *out, int flags)

int len;

char linebuf[MAX_SMLEN];

int ret;

+ if (in == NULL || out == NULL) {

+ ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_NULL_PARAMETER);

+ return 0;

+ }

* Buffer output so we don't write one line at a time. This is useful

* when streaming as we don't end up with one OCTET STRING per line.

diff --git a/crypto/bn/bn_recp.c b/crypto/bn/bn_recp.c
index 96a6b19ab0da..3a2c812ac666 100644
--- a/crypto/bn/bn_recp.c
+++ b/crypto/bn/bn_recp.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -44,7 +44,7 @@ void BN_RECP_CTX_free(BN_RECP_CTX *recp)

int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)

{

- if (!BN_copy(&(recp->N), d))

+ if (BN_is_zero(d) || !BN_copy(&(recp->N), d))

return 0;

BN_zero(&(recp->Nr));

recp->num_bits = BN_num_bits(d);

diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c
index 3105d37726a5..bd1f3e7345d4 100644
--- a/crypto/cms/cms_env.c
+++ b/crypto/cms/cms_env.c

@@ -142,10 +142,12 @@ CMS_EncryptedContentInfo *ossl_cms_get0_env_enc_content(const CMS_ContentInfo *c

{

switch (cms_get_enveloped_type(cms)) {

case CMS_ENVELOPED_STANDARD:

- return cms->d.envelopedData->encryptedContentInfo;

+ return cms->d.envelopedData == NULL ? NULL

+ : cms->d.envelopedData->encryptedContentInfo;

case CMS_ENVELOPED_AUTH:

- return cms->d.authEnvelopedData->authEncryptedContentInfo;

+ return cms->d.authEnvelopedData == NULL ? NULL

+ : cms->d.authEnvelopedData->authEncryptedContentInfo;

default:

return NULL;

diff --git a/crypto/cms/cms_lib.c b/crypto/cms/cms_lib.c
index 0738da3da280..1d2c5bc42288 100644
--- a/crypto/cms/cms_lib.c
+++ b/crypto/cms/cms_lib.c

@@ -76,6 +76,10 @@ CMS_ContentInfo *CMS_ContentInfo_new(void)

void CMS_ContentInfo_free(CMS_ContentInfo *cms)

{

if (cms != NULL) {

+ CMS_EncryptedContentInfo *ec = ossl_cms_get0_env_enc_content(cms);

+ if (ec != NULL)

+ OPENSSL_clear_free(ec->key, ec->keylen);

OPENSSL_free(cms->ctx.propq);

ASN1_item_free((ASN1_VALUE *)cms, ASN1_ITEM_rptr(CMS_ContentInfo));

}

diff --git a/crypto/cms/cms_rsa.c b/crypto/cms/cms_rsa.c
index 997567fdbfac..61fd43fb54d0 100644
--- a/crypto/cms/cms_rsa.c
+++ b/crypto/cms/cms_rsa.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -13,6 +13,7 @@

#include <openssl/core_names.h>

#include "crypto/asn1.h"

#include "crypto/rsa.h"

+#include "crypto/evp.h"

#include "cms_local.h"

static RSA_OAEP_PARAMS *rsa_oaep_decode(const X509_ALGOR *alg)

@@ -210,6 +211,16 @@ static int rsa_cms_sign(CMS_SignerInfo *si)

if (pad_mode != RSA_PKCS1_PSS_PADDING)

return 0;

+ if (evp_pkey_ctx_is_legacy(pkctx)) {

+ /* No provider -> we cannot query it for algorithm ID. */

+ ASN1_STRING *os = NULL;

+ os = ossl_rsa_ctx_to_pss_string(pkctx);

+ if (os == NULL)

+ return 0;

+ return X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_PKEY_RSA_PSS), V_ASN1_SEQUENCE, os);

+ }

params[0] = OSSL_PARAM_construct_octet_string(

OSSL_SIGNATURE_PARAM_ALGORITHM_ID, aid, sizeof(aid));

params[1] = OSSL_PARAM_construct_end();

diff --git a/crypto/conf/conf_mod.c b/crypto/conf/conf_mod.c
index 17bbbf7a2747..1ea32648e9f9 100644
--- a/crypto/conf/conf_mod.c
+++ b/crypto/conf/conf_mod.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -184,15 +184,21 @@ int CONF_modules_load_file_ex(OSSL_LIB_CTX *libctx, const char *filename,

CONF *conf = NULL;

int ret = 0, diagnostics = 0;

+ ERR_set_mark();

if (filename == NULL) {

file = CONF_get1_default_config_file();

if (file == NULL)

goto err;

+ if (*file == '\0') {

+ /* Do not try to load an empty file name but do not error out */

+ ret = 1;

+ goto err;

+ }

} else {

file = (char *)filename;

}

- ERR_set_mark();

conf = NCONF_new_ex(libctx, NULL);

if (conf == NULL)

goto err;

diff --git a/crypto/conf/conf_sap.c b/crypto/conf/conf_sap.c
index 39efcdbf90fa..513f8bfc1fb9 100644
--- a/crypto/conf/conf_sap.c
+++ b/crypto/conf/conf_sap.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -66,6 +66,8 @@ int ossl_config_int(const OPENSSL_INIT_SETTINGS *settings)

#ifndef OPENSSL_SYS_UEFI

ret = CONF_modules_load_file(filename, appname, flags);

+#else

+ ret = 1;

#endif

openssl_configured = 1;

return ret;

diff --git a/crypto/core_namemap.c b/crypto/core_namemap.c
index 7e11ab1c8845..ebf7ed5eb165 100644
--- a/crypto/core_namemap.c
+++ b/crypto/core_namemap.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -142,6 +142,9 @@ int ossl_namemap_doall_names(const OSSL_NAMEMAP *namemap, int number,

cbdata.number = number;

cbdata.found = 0;

+ if (namemap == NULL)

+ return 0;

* We collect all the names first under a read lock. Subsequently we call

* the user function, so that we're not holding the read lock when in user

diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c
index 0b391910d6b3..f4173e21371e 100644
--- a/crypto/dh/dh_check.c
+++ b/crypto/dh/dh_check.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -143,7 +143,7 @@ int DH_check(const DH *dh, int *ret)

#ifdef FIPS_MODULE

return DH_check_params(dh, ret);

#else

- int ok = 0, r;

+ int ok = 0, r, q_good = 0;

BN_CTX *ctx = NULL;

BIGNUM *t1 = NULL, *t2 = NULL;

int nid = DH_get_nid((DH *)dh);

@@ -152,6 +152,13 @@ int DH_check(const DH *dh, int *ret)

if (nid != NID_undef)

return 1;

+ /* Don't do any checks at all with an excessively large modulus */

+ if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) {

+ ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE);

+ *ret = DH_MODULUS_TOO_LARGE | DH_CHECK_P_NOT_PRIME;

+ return 0;

+ }

if (!DH_check_params(dh, ret))

return 0;

@@ -165,6 +172,13 @@ int DH_check(const DH *dh, int *ret)

goto err;

if (dh->params.q != NULL) {

+ if (BN_ucmp(dh->params.p, dh->params.q) > 0)

+ q_good = 1;

+ else

+ *ret |= DH_CHECK_INVALID_Q_VALUE;

+ }

+ if (q_good) {

if (BN_cmp(dh->params.g, BN_value_one()) <= 0)

*ret |= DH_NOT_SUITABLE_GENERATOR;

else if (BN_cmp(dh->params.g, dh->params.p) >= 0)

diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index 0cd8c4633aae..a6f61ca3b02f 100644
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt

@@ -1675,6 +1675,7 @@ X509_R_CERTIFICATE_VERIFICATION_FAILED:139:certificate verification failed

X509_R_CERT_ALREADY_IN_HASH_TABLE:101:cert already in hash table

X509_R_CRL_ALREADY_DELTA:127:crl already delta

X509_R_CRL_VERIFY_FAILURE:131:crl verify failure

+X509_R_DUPLICATE_ATTRIBUTE:140:duplicate attribute

X509_R_ERROR_GETTING_MD_BY_NID:141:error getting md by nid

X509_R_ERROR_USING_SIGINF_SET:142:error using siginf set

X509_R_IDP_MISMATCH:128:idp mismatch

diff --git a/crypto/evp/ctrl_params_translate.c b/crypto/evp/ctrl_params_translate.c
index ccafdfddd58f..b28875037c72 100644
--- a/crypto/evp/ctrl_params_translate.c
+++ b/crypto/evp/ctrl_params_translate.c

@@ -636,8 +636,8 @@ static int default_fixup_args(enum state state,

ctx->p2, ctx->sz);

case OSSL_PARAM_OCTET_STRING:

return OSSL_PARAM_get_octet_string(ctx->params,

- ctx->p2, ctx->sz,

- &ctx->sz);

+ &ctx->p2, ctx->sz,

+ (size_t *)&ctx->p1);

case OSSL_PARAM_OCTET_PTR:

return OSSL_PARAM_get_octet_ptr(ctx->params,

ctx->p2, &ctx->sz);

@@ -685,7 +685,7 @@ static int default_fixup_args(enum state state,

return OSSL_PARAM_set_octet_string(ctx->params, ctx->p2,

size);

case OSSL_PARAM_OCTET_PTR:

- return OSSL_PARAM_set_octet_ptr(ctx->params, ctx->p2,

+ return OSSL_PARAM_set_octet_ptr(ctx->params, *(void **)ctx->p2,

size);

default:

ERR_raise_data(ERR_LIB_EVP, ERR_R_UNSUPPORTED,

@@ -695,6 +695,9 @@ static int default_fixup_args(enum state state,

translation->param_data_type);

return 0;

}

+ } else if (state == PRE_PARAMS_TO_CTRL && ctx->action_type == GET) {

+ if (translation->param_data_type == OSSL_PARAM_OCTET_PTR)

+ ctx->p2 = &ctx->bufp;

}

/* Any other combination is simply pass-through */

@@ -2254,7 +2257,7 @@ static const struct translation_st evp_pkey_ctx_translations[] = {

OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL, OSSL_PARAM_OCTET_STRING, NULL },

{ GET, EVP_PKEY_RSA, 0, EVP_PKEY_OP_TYPE_CRYPT,

EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL, NULL, NULL,

- OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL, OSSL_PARAM_OCTET_STRING, NULL },

+ OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL, OSSL_PARAM_OCTET_PTR, NULL },

{ SET, EVP_PKEY_RSA_PSS, 0, EVP_PKEY_OP_TYPE_GEN,

EVP_PKEY_CTRL_MD, "rsa_pss_keygen_md", NULL,

diff --git a/crypto/evp/p5_crpt2.c b/crypto/evp/p5_crpt2.c
index b7455be1cf0a..356173902334 100644
--- a/crypto/evp/p5_crpt2.c
+++ b/crypto/evp/p5_crpt2.c

@@ -231,13 +231,16 @@ int PKCS5_v2_PBKDF2_keyivgen_ex(EVP_CIPHER_CTX *ctx, const char *pass,

goto err;

}

+ (void)ERR_set_mark();

prfmd = prfmd_fetch = EVP_MD_fetch(libctx, OBJ_nid2sn(hmac_md_nid), propq);

if (prfmd == NULL)

prfmd = EVP_get_digestbynid(hmac_md_nid);

if (prfmd == NULL) {

+ (void)ERR_clear_last_mark();

ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_PRF);

goto err;

}

+ (void)ERR_pop_to_mark();

if (kdf->salt->type != V_ASN1_OCTET_STRING) {

ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_SALT_TYPE);

diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c
index f6acb5b47eff..aa6ec31dab6e 100644
--- a/crypto/evp/p_lib.c
+++ b/crypto/evp/p_lib.c

@@ -722,6 +722,7 @@ static void detect_foreign_key(EVP_PKEY *pkey)

break;

# ifndef OPENSSL_NO_EC

case EVP_PKEY_SM2:

+ break;

case EVP_PKEY_EC:

pkey->foreign = pkey->pkey.ec != NULL

&& ossl_ec_key_is_foreign(pkey->pkey.ec);

diff --git a/crypto/http/http_lib.c b/crypto/http/http_lib.c
index ec24e0dc488e..e45f60b72287 100644
--- a/crypto/http/http_lib.c
+++ b/crypto/http/http_lib.c

@@ -22,6 +22,13 @@ static void init_pstring(char **pstr)

}

+static void init_pint(int *pint)

+ if (pint != NULL) {

+ *pint = 0;

+ }

static int copy_substring(char **dest, const char *start, const char *end)

{

return dest == NULL

@@ -54,6 +61,7 @@ int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost,

init_pstring(puser);

init_pstring(phost);

init_pstring(pport);

+ init_pint(pport_num);

init_pstring(ppath);

init_pstring(pfrag);

init_pstring(pquery);

diff --git a/crypto/params.c b/crypto/params.c
index 5fd1e0028da9..4d85b5943c71 100644
--- a/crypto/params.c
+++ b/crypto/params.c

@@ -14,6 +14,7 @@

#include "internal/numbers.h"

#include "internal/endian.h"

+#ifndef OPENSSL_SYS_UEFI

* Return the number of bits in the mantissa of a double. This is used to

* shift a larger integral value to determine if it will exactly fit into a

@@ -23,6 +24,7 @@ static unsigned int real_shift(void)

{

return sizeof(double) == 4 ? 24 : 53;

}

+#endif

OSSL_PARAM *OSSL_PARAM_locate(OSSL_PARAM *p, const char *key)

{

@@ -342,8 +344,6 @@ OSSL_PARAM OSSL_PARAM_construct_ulong(const char *key, unsigned long int *buf)

int OSSL_PARAM_get_int32(const OSSL_PARAM *p, int32_t *val)

{

- double d;

if (val == NULL || p == NULL )

return 0;

@@ -391,6 +391,9 @@ int OSSL_PARAM_get_int32(const OSSL_PARAM *p, int32_t *val)

return general_get_int(p, val, sizeof(*val));

} else if (p->data_type == OSSL_PARAM_REAL) {

+#ifndef OPENSSL_SYS_UEFI

+ double d;

switch (p->data_size) {

case sizeof(double):

d = *(const double *)p->data;

@@ -400,6 +403,7 @@ int OSSL_PARAM_get_int32(const OSSL_PARAM *p, int32_t *val)

}

break;

}

+#endif

}

return 0;

}

@@ -442,6 +446,7 @@ int OSSL_PARAM_set_int32(OSSL_PARAM *p, int32_t val)

#endif

return general_set_int(p, &val, sizeof(val));

} else if (p->data_type == OSSL_PARAM_REAL) {

+#ifndef OPENSSL_SYS_UEFI

p->return_size = sizeof(double);

if (p->data == NULL)

return 1;

@@ -450,6 +455,7 @@ int OSSL_PARAM_set_int32(OSSL_PARAM *p, int32_t val)

*(double *)p->data = (double)val;

return 1;

}

+#endif

}

return 0;

}

@@ -462,8 +468,6 @@ OSSL_PARAM OSSL_PARAM_construct_int32(const char *key, int32_t *buf)

int OSSL_PARAM_get_uint32(const OSSL_PARAM *p, uint32_t *val)

{

- double d;

if (val == NULL || p == NULL)

return 0;

@@ -509,6 +513,9 @@ int OSSL_PARAM_get_uint32(const OSSL_PARAM *p, uint32_t *val)

#endif

return general_get_uint(p, val, sizeof(*val));

} else if (p->data_type == OSSL_PARAM_REAL) {

+#ifndef OPENSSL_SYS_UEFI

+ double d;

switch (p->data_size) {

case sizeof(double):

d = *(const double *)p->data;

@@ -518,6 +525,7 @@ int OSSL_PARAM_get_uint32(const OSSL_PARAM *p, uint32_t *val)

}

break;

}

+#endif

}

return 0;

}

@@ -564,6 +572,7 @@ int OSSL_PARAM_set_uint32(OSSL_PARAM *p, uint32_t val)

#endif

return general_set_uint(p, &val, sizeof(val));

} else if (p->data_type == OSSL_PARAM_REAL) {

+#ifndef OPENSSL_SYS_UEFI

p->return_size = sizeof(double);

if (p->data == NULL)

return 1;

@@ -572,6 +581,7 @@ int OSSL_PARAM_set_uint32(OSSL_PARAM *p, uint32_t val)

*(double *)p->data = (double)val;

return 1;

}

+#endif

}

return 0;

}

@@ -584,8 +594,6 @@ OSSL_PARAM OSSL_PARAM_construct_uint32(const char *key, uint32_t *buf)

int OSSL_PARAM_get_int64(const OSSL_PARAM *p, int64_t *val)

{

- double d;

if (val == NULL || p == NULL )

return 0;

@@ -620,6 +628,9 @@ int OSSL_PARAM_get_int64(const OSSL_PARAM *p, int64_t *val)

#endif

return general_get_int(p, val, sizeof(*val));

} else if (p->data_type == OSSL_PARAM_REAL) {

+#ifndef OPENSSL_SYS_UEFI

+ double d;

switch (p->data_size) {

case sizeof(double):

d = *(const double *)p->data;

@@ -636,14 +647,13 @@ int OSSL_PARAM_get_int64(const OSSL_PARAM *p, int64_t *val)

}

break;

}

+#endif

}

return 0;

}

int OSSL_PARAM_set_int64(OSSL_PARAM *p, int64_t val)

{

- uint64_t u64;

if (p == NULL)

return 0;

p->return_size = 0;

@@ -686,6 +696,9 @@ int OSSL_PARAM_set_int64(OSSL_PARAM *p, int64_t val)

#endif

return general_set_int(p, &val, sizeof(val));

} else if (p->data_type == OSSL_PARAM_REAL) {

+#ifndef OPENSSL_SYS_UEFI

+ uint64_t u64;

p->return_size = sizeof(double);

if (p->data == NULL)

return 1;

@@ -698,6 +711,7 @@ int OSSL_PARAM_set_int64(OSSL_PARAM *p, int64_t val)

}

break;

}

+#endif

}

return 0;

}

@@ -709,8 +723,6 @@ OSSL_PARAM OSSL_PARAM_construct_int64(const char *key, int64_t *buf)

int OSSL_PARAM_get_uint64(const OSSL_PARAM *p, uint64_t *val)

{

- double d;

if (val == NULL || p == NULL)

return 0;

@@ -750,6 +762,9 @@ int OSSL_PARAM_get_uint64(const OSSL_PARAM *p, uint64_t *val)

#endif

return general_get_uint(p, val, sizeof(*val));

} else if (p->data_type == OSSL_PARAM_REAL) {

+#ifndef OPENSSL_SYS_UEFI

+ double d;

switch (p->data_size) {

case sizeof(double):

d = *(const double *)p->data;

@@ -766,6 +781,7 @@ int OSSL_PARAM_get_uint64(const OSSL_PARAM *p, uint64_t *val)

}

break;

}

+#endif

}

return 0;

}

@@ -818,6 +834,7 @@ int OSSL_PARAM_set_uint64(OSSL_PARAM *p, uint64_t val)

#endif

return general_set_uint(p, &val, sizeof(val));

} else if (p->data_type == OSSL_PARAM_REAL) {

+#ifndef OPENSSL_SYS_UEFI

p->return_size = sizeof(double);

switch (p->data_size) {

case sizeof(double):

@@ -827,6 +844,7 @@ int OSSL_PARAM_set_uint64(OSSL_PARAM *p, uint64_t val)

}

break;

}

+#endif

}

return 0;

}

@@ -953,6 +971,7 @@ OSSL_PARAM OSSL_PARAM_construct_BN(const char *key, unsigned char *buf,

buf, bsize);

}

+#ifndef OPENSSL_SYS_UEFI

int OSSL_PARAM_get_double(const OSSL_PARAM *p, double *val)

{

int64_t i64;

@@ -1073,6 +1092,7 @@ OSSL_PARAM OSSL_PARAM_construct_double(const char *key, double *buf)

{

return ossl_param_construct(key, OSSL_PARAM_REAL, buf, sizeof(double));

}

+#endif

static int get_string_internal(const OSSL_PARAM *p, void **val,

size_t *max_len, size_t *used_len,

diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
index afdb8d688ba3..67a885a45f89 100644
--- a/crypto/pkcs12/p12_mutl.c
+++ b/crypto/pkcs12/p12_mutl.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -108,15 +108,20 @@ static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen,

X509_ALGOR_get0(&macoid, NULL, NULL, macalg);

if (OBJ_obj2txt(md_name, sizeof(md_name), macoid, 0) < 0)

return 0;

+ (void)ERR_set_mark();

md = md_fetch = EVP_MD_fetch(p12->authsafes->ctx.libctx, md_name,

p12->authsafes->ctx.propq);

if (md == NULL)

md = EVP_get_digestbynid(OBJ_obj2nid(macoid));

if (md == NULL) {

+ (void)ERR_clear_last_mark();

ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);

return 0;

}

+ (void)ERR_pop_to_mark();

md_size = EVP_MD_get_size(md);

md_nid = EVP_MD_get_type(md);

if (md_size < 0)

diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c
index 0fcf4fe3bc1e..5fde214448f3 100644
--- a/crypto/rand/rand_lib.c
+++ b/crypto/rand/rand_lib.c

@@ -120,6 +120,8 @@ void RAND_keep_random_devices_open(int keep)

int RAND_poll(void)

{

+ static const char salt[] = "polling";

# ifndef OPENSSL_NO_DEPRECATED_3_0

const RAND_METHOD *meth = RAND_get_rand_method();

int ret = meth == RAND_OpenSSL();

@@ -148,14 +150,12 @@ int RAND_poll(void)

ret = 1;

err:

ossl_rand_pool_free(pool);

+ return ret;

}

- return ret;

-# else

- static const char salt[] = "polling";

+# endif

RAND_seed(salt, sizeof(salt));

return 1;

-# endif

}

# ifndef OPENSSL_NO_DEPRECATED_3_0

diff --git a/crypto/rc4/build.info b/crypto/rc4/build.info
index 68b3c73f55b0..c9c81f87dabf 100644
--- a/crypto/rc4/build.info
+++ b/crypto/rc4/build.info

@@ -21,10 +21,15 @@ SOURCE[../../libcrypto]=$RC4ASM

# When all deprecated symbols are removed, libcrypto doesn't export the

# rc4 functions, so we must include them directly in liblegacy.a

-IF[{- $disabled{'deprecated-3.0'} && !$disabled{module} && !$disabled{shared} -}]

+IF[{- !$disabled{module} && !$disabled{shared} -}]

SOURCE[../../providers/liblegacy.a]=$RC4ASM

ENDIF

+# Implementations are now spread across several libraries, so the defines

+# need to be applied to all affected libraries and modules.

+DEFINE[../../libcrypto]=$RC4DEF

+DEFINE[../../providers/liblegacy.a]=$RC4DEF

GENERATE[rc4-586.S]=asm/rc4-586.pl

DEPEND[rc4-586.S]=../perlasm/x86asm.pl

diff --git a/crypto/rsa/rsa_ameth.c b/crypto/rsa/rsa_ameth.c
index 61ec53d4244c..e819780e7d94 100644
--- a/crypto/rsa/rsa_ameth.c
+++ b/crypto/rsa/rsa_ameth.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -641,6 +641,36 @@ static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, const void *asn,

size_t aid_len = 0;

OSSL_PARAM params[2];

+ if (evp_pkey_ctx_is_legacy(pkctx)) {

+ /* No provider -> we cannot query it for algorithm ID. */

+ ASN1_STRING *os1 = NULL;

+ os1 = ossl_rsa_ctx_to_pss_string(pkctx);

+ if (os1 == NULL)

+ return 0;

+ /* Duplicate parameters if we have to */

+ if (alg2 != NULL) {

+ ASN1_STRING *os2 = ASN1_STRING_dup(os1);

+ if (os2 == NULL) {

+ ASN1_STRING_free(os1);

+ return 0;

+ }

+ if (!X509_ALGOR_set0(alg2, OBJ_nid2obj(EVP_PKEY_RSA_PSS),

+ V_ASN1_SEQUENCE, os2)) {

+ ASN1_STRING_free(os1);

+ ASN1_STRING_free(os2);

+ return 0;

+ }

+ if (!X509_ALGOR_set0(alg1, OBJ_nid2obj(EVP_PKEY_RSA_PSS),

+ V_ASN1_SEQUENCE, os1)) {

+ ASN1_STRING_free(os1);

+ return 0;

+ }

+ return 3;

+ }

params[0] = OSSL_PARAM_construct_octet_string(

OSSL_SIGNATURE_PARAM_ALGORITHM_ID, aid, sizeof(aid));

params[1] = OSSL_PARAM_construct_end();

@@ -652,11 +682,13 @@ static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, const void *asn,

if (alg1 != NULL) {

const unsigned char *pp = aid;

if (d2i_X509_ALGOR(&alg1, &pp, aid_len) == NULL)

return 0;

}

if (alg2 != NULL) {

const unsigned char *pp = aid;

if (d2i_X509_ALGOR(&alg2, &pp, aid_len) == NULL)

return 0;

}

diff --git a/crypto/rsa/rsa_pmeth.c b/crypto/rsa/rsa_pmeth.c
index 44c819a5c3ce..0bf5ac098ac0 100644
--- a/crypto/rsa/rsa_pmeth.c
+++ b/crypto/rsa/rsa_pmeth.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -584,6 +584,10 @@ static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)

ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_PADDING_MODE);

return -2;

}

+ if (p2 == NULL) {

+ ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);

+ return 0;

+ }

*(unsigned char **)p2 = rctx->oaep_label;

return rctx->oaep_labellen;

diff --git a/crypto/sha/asm/keccak1600-avx2.pl b/crypto/sha/asm/keccak1600-avx2.pl
index 84682289bf7a..864066533445 100755
--- a/crypto/sha/asm/keccak1600-avx2.pl
+++ b/crypto/sha/asm/keccak1600-avx2.pl

@@ -1,5 +1,5 @@

#!/usr/bin/env perl

# Licensed under the Apache License 2.0 (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -432,6 +432,7 @@ $code.=<<___;

ret

.size SHA3_squeeze,.-SHA3_squeeze

+.section .rodata

.align 64

rhotates_left:

.quad 3, 18, 36, 41 # [2][0] [4][0] [1][0] [3][0]

diff --git a/crypto/sha/asm/keccak1600-avx512.pl b/crypto/sha/asm/keccak1600-avx512.pl
index 85d6e7ffe424..efc32545c356 100755
--- a/crypto/sha/asm/keccak1600-avx512.pl
+++ b/crypto/sha/asm/keccak1600-avx512.pl

@@ -1,5 +1,5 @@

#!/usr/bin/env perl

# Licensed under the Apache License 2.0 (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -486,6 +486,7 @@ SHA3_squeeze:

ret

.size SHA3_squeeze,.-SHA3_squeeze

+.section .rodata

.align 64

theta_perm:

.quad 0, 1, 2, 3, 4, 5, 6, 7 # [not used]

diff --git a/crypto/sha/asm/keccak1600-avx512vl.pl b/crypto/sha/asm/keccak1600-avx512vl.pl
index 73e75f363f20..f941556b42a8 100755
--- a/crypto/sha/asm/keccak1600-avx512vl.pl
+++ b/crypto/sha/asm/keccak1600-avx512vl.pl

@@ -1,5 +1,5 @@

#!/usr/bin/env perl

# Licensed under the Apache License 2.0 (the "License"). You may not use

# this file except in compliance with the License. You can obtain a copy

@@ -349,6 +349,7 @@ $code.=<<___;

ret

.size SHA3_squeeze,.-SHA3_squeeze

+.section .rodata

.align 64

rhotates_left:

.quad 3, 18, 36, 41 # [2][0] [4][0] [1][0] [3][0]

diff --git a/crypto/store/store_result.c b/crypto/store/store_result.c
index 96d31199074d..bbc8f6fef265 100644
--- a/crypto/store/store_result.c
+++ b/crypto/store/store_result.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -553,8 +553,10 @@ static int try_pkcs12(struct extracted_param_data_st *data, OSSL_STORE_INFO **v,

ok = 0; /* Assume decryption or parse error */

- if (PKCS12_verify_mac(p12, "", 0)

+ if (!PKCS12_mac_present(p12)

|| PKCS12_verify_mac(p12, NULL, 0)) {

+ pass = NULL;

+ } else if (PKCS12_verify_mac(p12, "", 0)) {

pass = "";

} else {

static char prompt_info[] = "PKCS12 import pass phrase";

diff --git a/crypto/x509/by_dir.c b/crypto/x509/by_dir.c
index cb40c7737f72..ad871966aa6e 100644
--- a/crypto/x509/by_dir.c
+++ b/crypto/x509/by_dir.c

@@ -348,7 +348,8 @@ static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,

* we have added it to the cache so now pull it out again

- X509_STORE_lock(xl->store_ctx);

+ if (!X509_STORE_lock(xl->store_ctx))

+ goto finish;

j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);

tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);

X509_STORE_unlock(xl->store_ctx);

diff --git a/crypto/x509/v3_ist.c b/crypto/x509/v3_ist.c
index 0de281f66871..e6fef0153c8e 100644
--- a/crypto/x509/v3_ist.c
+++ b/crypto/x509/v3_ist.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -50,43 +50,38 @@ static ISSUER_SIGN_TOOL *v2i_issuer_sign_tool(X509V3_EXT_METHOD *method, X509V3_

}

if (strcmp(cnf->name, "signTool") == 0) {

ist->signTool = ASN1_UTF8STRING_new();

- if (ist->signTool == NULL) {

- ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);

- ISSUER_SIGN_TOOL_free(ist);

- return NULL;

+ if (ist->signTool == NULL || !ASN1_STRING_set(ist->signTool, cnf->value, strlen(cnf->value))) {

+ ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);

+ goto err;

}

- ASN1_STRING_set(ist->signTool, cnf->value, strlen(cnf->value));

} else if (strcmp(cnf->name, "cATool") == 0) {

ist->cATool = ASN1_UTF8STRING_new();

- if (ist->cATool == NULL) {

- ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);

- ISSUER_SIGN_TOOL_free(ist);

- return NULL;

+ if (ist->cATool == NULL || !ASN1_STRING_set(ist->cATool, cnf->value, strlen(cnf->value))) {

+ ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);

+ goto err;

}

- ASN1_STRING_set(ist->cATool, cnf->value, strlen(cnf->value));

} else if (strcmp(cnf->name, "signToolCert") == 0) {

ist->signToolCert = ASN1_UTF8STRING_new();

- if (ist->signToolCert == NULL) {

- ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);

- ISSUER_SIGN_TOOL_free(ist);

- return NULL;

+ if (ist->signToolCert == NULL || !ASN1_STRING_set(ist->signToolCert, cnf->value, strlen(cnf->value))) {

+ ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);

+ goto err;

}

- ASN1_STRING_set(ist->signToolCert, cnf->value, strlen(cnf->value));

} else if (strcmp(cnf->name, "cAToolCert") == 0) {

ist->cAToolCert = ASN1_UTF8STRING_new();

- if (ist->cAToolCert == NULL) {

- ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);

- ISSUER_SIGN_TOOL_free(ist);

- return NULL;

+ if (ist->cAToolCert == NULL || !ASN1_STRING_set(ist->cAToolCert, cnf->value, strlen(cnf->value))) {

+ ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);

+ goto err;

}

- ASN1_STRING_set(ist->cAToolCert, cnf->value, strlen(cnf->value));

} else {

ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_INVALID_ARGUMENT);

- ISSUER_SIGN_TOOL_free(ist);

- return NULL;

+ goto err;

}

return ist;

+err:

+ ISSUER_SIGN_TOOL_free(ist);

+ return NULL;

}

static int i2r_issuer_sign_tool(X509V3_EXT_METHOD *method,

diff --git a/crypto/x509/v3_purp.c b/crypto/x509/v3_purp.c
index a6ebbd5f94f6..6461189179f4 100644
--- a/crypto/x509/v3_purp.c
+++ b/crypto/x509/v3_purp.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -438,7 +438,7 @@ int ossl_x509v3_cache_extensions(X509 *x)

* in case ctx->param->flags & X509_V_FLAG_X509_STRICT

if (bs->pathlen->type == V_ASN1_NEG_INTEGER) {

- ERR_raise(ERR_LIB_X509, X509V3_R_NEGATIVE_PATHLEN);

+ ERR_raise(ERR_LIB_X509V3, X509V3_R_NEGATIVE_PATHLEN);

x->ex_flags |= EXFLAG_INVALID;

} else {

x->ex_pathlen = ASN1_INTEGER_get(bs->pathlen);

@@ -479,7 +479,7 @@ int ossl_x509v3_cache_extensions(X509 *x)

ASN1_BIT_STRING_free(usage);

/* Check for empty key usage according to RFC 5280 section 4.2.1.3 */

if (x->ex_kusage == 0) {

- ERR_raise(ERR_LIB_X509, X509V3_R_EMPTY_KEY_USAGE);

+ ERR_raise(ERR_LIB_X509V3, X509V3_R_EMPTY_KEY_USAGE);

x->ex_flags |= EXFLAG_INVALID;

}

} else if (i != -1) {

@@ -632,7 +632,7 @@ int ossl_x509v3_cache_extensions(X509 *x)

return 1;

}

if ((x->ex_flags & EXFLAG_INVALID) != 0)

- ERR_raise(ERR_LIB_X509, X509V3_R_INVALID_CERTIFICATE);

+ ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_CERTIFICATE);

/* If computing sha1_hash failed the error queue already reflects this. */

err:

diff --git a/crypto/x509/x509_att.c b/crypto/x509/x509_att.c
index 73ac59454d1f..d9fe7a3791d1 100644
--- a/crypto/x509/x509_att.c
+++ b/crypto/x509/x509_att.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -82,6 +82,11 @@ STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,

return NULL;

}

+ if (*x != NULL && X509at_get_attr_by_OBJ(*x, attr->object, -1) != -1) {

+ ERR_raise(ERR_LIB_X509, X509_R_DUPLICATE_ATTRIBUTE);

+ return NULL;

+ }

if (*x == NULL) {

if ((sk = sk_X509_ATTRIBUTE_new_null()) == NULL)

goto err;

diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c
index 5c9d91f4073d..1027bed82e69 100644
--- a/crypto/x509/x509_cmp.c
+++ b/crypto/x509/x509_cmp.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -277,11 +277,11 @@ int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)

if (ret == 0 && a->canon_enclen == 0)

return 0;

- if (a->canon_enc == NULL || b->canon_enc == NULL)

- return -2;

- if (ret == 0)

+ if (ret == 0) {

+ if (a->canon_enc == NULL || b->canon_enc == NULL)

+ return -2;

ret = memcmp(a->canon_enc, b->canon_enc, a->canon_enclen);

+ }

return ret < 0 ? -1 : ret > 0;

}

diff --git a/crypto/x509/x509_err.c b/crypto/x509/x509_err.c
index a933aeef351f..37467935c997 100644
--- a/crypto/x509/x509_err.c
+++ b/crypto/x509/x509_err.c

@@ -1,6 +1,6 @@

* Generated by util/mkerr.pl DO NOT EDIT

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -28,6 +28,8 @@ static const ERR_STRING_DATA X509_str_reasons[] = {

{ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_ALREADY_DELTA), "crl already delta"},

{ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_VERIFY_FAILURE),

"crl verify failure"},

+ {ERR_PACK(ERR_LIB_X509, 0, X509_R_DUPLICATE_ATTRIBUTE),

+ "duplicate attribute"},

{ERR_PACK(ERR_LIB_X509, 0, X509_R_ERROR_GETTING_MD_BY_NID),

"error getting md by nid"},

{ERR_PACK(ERR_LIB_X509, 0, X509_R_ERROR_USING_SIGINF_SET),

diff --git a/crypto/x509/x509_vpm.c b/crypto/x509/x509_vpm.c
index b4f4c45998be..998ce8ac1ba1 100644
--- a/crypto/x509/x509_vpm.c
+++ b/crypto/x509/x509_vpm.c

@@ -1,5 +1,5 @@

* Licensed under the Apache License 2.0 (the "License"). You may not use

* this file except in compliance with the License. You can obtain a copy

@@ -337,7 +337,10 @@ int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,

if (param->policies == NULL)

return 0;

}

- return sk_ASN1_OBJECT_push(param->policies, policy);

+ if (sk_ASN1_OBJECT_push(param->policies, policy) <= 0)

+ return 0;

+ return 1;

}

int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,

@@ -592,7 +595,10 @@ int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)

X509_VERIFY_PARAM_free(ptmp);

}

- return sk_X509_VERIFY_PARAM_push(param_table, param);

+ if (sk_X509_VERIFY_PARAM_push(param_table, param) <= 0)

+ return 0;

+ return 1;

}

int X509_VERIFY_PARAM_get_count(void)