Run-checker CI / run-checker (enable-ssl-trace) (push) Has been cancelledDetails
Run-checker CI / run-checker (enable-trace enable-fips) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-cmp) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-cms) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-default-thread-pool) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-dgram) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-dh) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-dtls) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-ec) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-ecx) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-http) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-legacy) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-quic) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-sock) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-stdio) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-thread-pool) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-threads) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-tls) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-tls1_2) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-tls1_3) (push) Has been cancelledDetails
Run-checker CI / run-checker (no-ui) (push) Has been cancelledDetails
Run-checker merge / run-checker (enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function) (push) Has been cancelledDetails
Run-checker merge / run-checker (enable-pie) (push) Has been cancelledDetails
Run-checker merge / run-checker (enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function) (push) Has been cancelledDetails
Run-checker merge / run-checker (enable-weak-ssl-ciphers) (push) Has been cancelledDetails
Run-checker merge / run-checker (enable-zlib) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-ct) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-dso) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-dynamic-engine) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-ec2m enable-fips) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-engine no-shared) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-err) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-filenames) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-integrity-only-ciphers) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-module) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-ocsp) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-pinshared) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-srp) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-srtp) (push) Has been cancelledDetails
Run-checker merge / run-checker (no-ts) (push) Has been cancelledDetails
Run-checker merge / threads_sanitizer_atomic_fallback (push) Has been cancelledDetails
Windows GitHub CI / shared (map[arch:win32 config:--strict-warnings no-fips os:windows-2022]) (push) Has been cancelledDetails
Windows GitHub CI / shared (map[arch:win64 config:enable-fips no-thread-pool no-quic os:windows-2022]) (push) Has been cancelledDetails
Windows GitHub CI / shared (map[arch:win64 config:enable-fips os:windows-2019]) (push) Has been cancelledDetails
Windows GitHub CI / plain (windows-2022) (push) Has been cancelledDetails
Windows GitHub CI / minimal (windows-2019) (push) Has been cancelledDetails
Windows GitHub CI / cygwin (windows-2019, map[arch:win64 config:-DCMAKE_C_COMPILER=gcc --strict-warnings enable-demos no-fips]) (push) Has been cancelledDetails
Windows Compression GitHub CI / zstd (push) Has been cancelledDetails
Windows Compression GitHub CI / brotli (push) Has been cancelledDetails
If PKCS7_add_signed_attribute fails,
seq never escapes out of the callee and will
therefore result in a memory leak.
This is similar to ed3d277127.
CLA: trivial
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27670)
(cherry picked from commit 6543f34dda)
For SHAKE algorithms we now return 0 from EVP_MD_size().
So all the places that check for < 0 needed to change to <= 0
(Otherwise the behaviour will be to digest nothing in most cases).
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25285)
Fixes#18854
Replace and deprecate the functions `TS_VERIFY_CTX_set_data`,
`TS_VERIFY_CTX_set_store`, `TS_VERIFY_CTX_set_certs`, `TS_VERIFY_CTX_set_imprint`
with new versions: `TS_VERIFY_CTX_set0_data`,
`TS_VERIFY_CTX_set0_store`, `TS_VERIFY_CTX_set0_certs` and `TS_VERIFY_CTX_set0_imprint`.
The previous functions had poorly documented memory handling, potentially
leading to memory leaks. The new functions improve memory management and provide
clearer usage.
Also, update existing code to use the new function calls instead of the deprecated
ones.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24701)
Add the check for the return value of EVP_MD_CTX_get_size() to avoid invalid negative numbers.
Fixes: c7235be6e3 ("RFC 3161 compliant time stamp request creation, response generation and response verification.")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23960)
This is used to calculate the TSA's public key certificate identifier.
The default algorithm is changed from sha1 to sha256.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21794)
partially revamped from #16712
- fall thru -> fall through
- time stamp -> timestamp
- host name -> hostname
- ipv6 -> IPv6
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19059)
Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and
at least handle the file name and line number they are called from,
there's no need to report ERR_R_MALLOC_FAILURE where they are called
directly, or when SSLfatal() and RLAYERfatal() is used, the reason
`ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`.
There were a number of places where `ERR_R_MALLOC_FAILURE` was reported
even though it was a function from a different sub-system that was
called. Those places are changed to report ERR_R_{lib}_LIB, where
{lib} is the name of that sub-system.
Some of them are tricky to get right, as we have a lot of functions
that belong in the ASN1 sub-system, and all the `sk_` calls or from
the CRYPTO sub-system.
Some extra adaptation was necessary where there were custom OPENSSL_malloc()
wrappers, and some bugs are fixed alongside these changes.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19301)
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19082)
Including e_os.h with a path from a header file doesn't work well on
certain exotic platform. It simply fails to build.
Since we don't seem to be able to stop ourselves, the better move is
to move e_os.h to an include directory that's part of the inclusion
path given to the compiler.
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17641)
ASN1_STRING_length gets the field 'length' of msg, which
can be manipulated through a crafted input.
Add a check to avoid error execution of OPENSSL_malloc().
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15583)
For functions that exist in 1.1.1 provide a simple aliases via #define.
Fixes#15236
Functions with OSSL_DECODER_, OSSL_ENCODER_, OSSL_STORE_LOADER_,
EVP_KEYEXCH_, EVP_KEM_, EVP_ASYM_CIPHER_, EVP_SIGNATURE_,
EVP_KEYMGMT_, EVP_RAND_, EVP_MAC_, EVP_KDF_, EVP_PKEY_,
EVP_MD_, and EVP_CIPHER_ prefixes are renamed.
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15405)
The new names are ossl_err_load_xxx_strings.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15446)
In function int_ts_RESP_verify_token, if (flags & TS_VFY_DATA) is true, function ts_compute_imprint() will be called at line 299.
In the implementation of ts_compute_imprint, it allocates md_alg at line 406.
But after the allocation, if the execution goto err, then md_alg will be freed in the first time by X509_ALGOR_free at line 439.
After that, ts_compute_imprint returns 0 and the execution goto err branch of int_ts_RESP_verify_token.
In the err branch, md_alg will be freed in the second time at line 320.
Bug reported by @Yunlongs
Fixes#14914
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14921)
The intention is to allow for OIDs for which libcrypto has no
information, but are still fetchable for OSSL_ALGORITHM
implementations that specify an OID amongst their names.
Fixes#14278
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14498)
This is not done absolutely everywhere, as there are places where
the use of ERR_add_error_data() is quite complex, but at least the
simple cases are done.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13318)
This includes error reporting for libcrypto sub-libraries in surprising
places.
This was done using util/err-to-raise
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13318)
DONGGEUN YOO
openssl-machine
widneve
Josh Cooper
Tomas Mraz
slontis
erbsland-dev
Jiasheng Jiang
Matt Caswell
olszomal
FdaSilvaYY
Richard Levitte
Pauli
Dr. David von Oheimb
zhaozg
bonniegong