root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity
openssl/crypto
History
Eugene Syromiatnikov 1a97cbcc21 crypto/rand/randfile.c: avoid signed integer overflow in RAND_load_file 
If a file supplied to RAND_load_file is too big (more than INT_MAX bytes),
it is possible to trigger a signer integer overflow during ret calculation.
Avoid it by returning early when we are about to hit it on the next
iteration.

Reported-by: Liu-Ermeng <liuermeng2@huawei.com>
Resolves: https://github.com/openssl/openssl/issues/28375
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28379)

(cherry picked from commit 35db6a15d4)
 		2025-09-09 20:22:44 +02:00
..
aes aes-s390x.pl: Initialize reserved and unused memory 2025-08-29 10:40:06 -04:00
aria
…
asn1 fix asn1_write_micalg() in asn_mime.c on GostR3411 and SHAKE 2025-08-18 18:03:50 +02:00
async
…
bf
…
bio BIO_dgram: Fix BIO_CTRL_DGRAM_QUERY_MTU for IPv4-mapped IPv6 addresses 2025-08-18 18:06:22 +02:00
bn Copyright year updates 2025-07-01 12:04:53 +00:00
buffer
…
camellia
…
cast Copyright year updates 2023-09-07 09:59:15 +01:00
chacha Copyright year updates 2025-07-01 12:04:53 +00:00
cmac Copyright year updates 2023-09-07 09:59:15 +01:00
cmp Copyright year updates 2025-07-01 12:04:53 +00:00
cms Copyright year updates 2025-07-01 12:04:53 +00:00
comp Copyright year updates 2023-09-07 09:59:15 +01:00
conf Copyright year updates 2024-09-03 14:50:21 +02:00
crmf Copyright year updates 2023-09-07 09:59:15 +01:00
ct
…
des Copyright year updates 2023-09-07 09:59:15 +01:00
dh Fix null pointer check in pkey_dh_derive to ensure both keys are set 2025-08-22 11:30:03 -04:00
dsa Fix potential use-after-free in REF_PRINT_COUNT 2024-12-10 14:59:14 +01:00
dso Fix potential use-after-free in REF_PRINT_COUNT 2024-12-10 14:59:14 +01:00
ec Copyright year updates 2025-07-01 12:04:53 +00:00
encode_decode Copyright year updates 2025-07-01 12:04:53 +00:00
engine Copyright year updates 2024-09-03 14:50:21 +02:00
err Copyright year updates 2025-02-11 14:36:52 +00:00
ess Copyright year updates 2024-06-04 14:58:30 +02:00
evp Copyright year updates 2025-07-01 12:04:53 +00:00
ffc DH_check_pub_key() should not fail when setting result code 2023-10-11 16:22:27 +02:00
hmac
…
hpke Copyright year updates 2024-06-04 14:58:30 +02:00
http Copyright year updates 2025-02-11 14:36:52 +00:00
idea
…
kdf
…
lhash Copyright year updates 2023-10-26 14:21:19 +01:00
md2
…
md4
…
md5 Enable BTI feature for md5 on aarch64 2023-12-13 10:45:06 +01:00
mdc2
…
modes fix small footprint builds on arm 2024-09-12 09:11:08 +10:00
objects Fix error handling in OBJ_add_object 2024-08-21 15:54:03 +02:00
ocsp Copyright year updates 2023-09-07 09:59:15 +01:00
pem Fix Edge Cases in Password Callback Handling 2024-09-09 09:02:58 +02:00
perlasm Copyright year updates 2025-07-01 12:04:53 +00:00
pkcs7 Fix memory leak on EVP_CIPHER_param_to_asn1 failure 2025-08-11 16:55:22 +02:00
pkcs12 Copyright year updates 2025-02-11 14:36:52 +00:00
poly1305 Mark OPENSSL_armcap_P .hidden in arm asm 2024-11-22 11:23:20 +01:00
property Copyright year updates 2025-07-01 12:04:53 +00:00
rand crypto/rand/randfile.c: avoid signed integer overflow in RAND_load_file 2025-09-09 20:22:44 +02:00
rc2 Copyright year updates 2023-09-07 09:59:15 +01:00
rc4 Copyright year updates 2023-09-07 09:59:15 +01:00
rc5 Copyright year updates 2023-09-07 09:59:15 +01:00
ripemd
…
rsa Make error checks on RSA_public_decrypt() consistent 2025-08-21 20:05:26 +02:00
seed
…
sha Mark OPENSSL_armcap_P .hidden in arm asm 2024-11-22 11:23:20 +01:00
siphash
…
sm2 sm2: sm2_sign.c: check EC_KEY_get0_private_key() for NULL in sm2_sig_gen() 2025-07-25 12:07:44 +02:00
sm3 Copyright year updates 2025-07-01 12:04:53 +00:00
sm4 Copyright year updates 2025-07-01 12:04:53 +00:00
srp Fix potential double free through SRP_user_pwd_set1_ids() 2024-10-11 14:23:16 +02:00
stack Copyright year updates 2023-09-07 09:59:15 +01:00
store Fix OSSL_STORE to consider cached info in the EOF check. 2025-07-26 11:36:08 +02:00
thread Fix no-thread-pool build on Windows 2024-09-10 16:37:36 +02:00
ts Copyright year updates 2025-07-01 12:04:53 +00:00
txt_db Copyright year updates 2023-09-07 09:59:15 +01:00
ui Copyright year updates 2025-07-01 12:04:53 +00:00
whrlpool Copyright year updates 2023-09-07 09:59:15 +01:00
x509 Add a helper function to delete the extension list 2025-09-09 11:13:48 +02:00
LPdir_nyi.c
…
LPdir_unix.c Copyright year updates 2023-09-07 09:59:15 +01:00
LPdir_vms.c
…
LPdir_win.c
…
LPdir_win32.c
…
LPdir_wince.c
…
README-sparse_array.md
…
alphacpuid.pl
…
arm64cpuid.pl
…
arm_arch.h * Enable extra Arm64 optimization on Windows for GHASH, RAND and AES 2023-10-10 15:37:41 +02:00
armcap.c Copyright year updates 2025-07-01 12:04:53 +00:00
armv4cpuid.pl Mark OPENSSL_armcap_P .hidden in arm asm 2024-11-22 11:23:20 +01:00
asn1_dsa.c
…
bsearch.c
…
build.info Do not include sparse_array.o in libssl 2023-09-22 20:42:48 +02:00
c64xpluscpuid.pl
…
context.c Copyright year updates 2025-02-11 14:36:52 +00:00
core_algorithm.c
…
core_fetch.c Take into account no_store when pushing algorithm 2024-12-20 18:24:23 +01:00
core_namemap.c Copyright year updates 2023-09-07 09:59:15 +01:00
cpt_err.c
…
cpuid.c Copyright year updates 2023-09-28 14:23:29 +01:00
cryptlib.c Copyright year updates 2023-09-07 09:59:15 +01:00
ctype.c Copyright year updates 2023-09-07 09:59:15 +01:00
cversion.c
…
der_writer.c
…
deterministic_nonce.c Copyright year updates 2024-06-04 14:58:30 +02:00
dllmain.c
…
ebcdic.c
…
ex_data.c Fix error handling in CRYPTO_get_ex_new_index 2023-09-21 14:43:08 +02:00
getenv.c
…
ia64cpuid.S
…
info.c Copyright year updates 2023-09-07 09:59:15 +01:00
init.c Copyright year updates 2024-06-04 14:58:30 +02:00
initthread.c Recycle the TLS key that holds thread_event_handler 2024-09-05 17:20:26 +02:00
loongarch64cpuid.pl Copyright year updates 2025-07-01 12:04:53 +00:00
loongarch_arch.h Copyright year updates 2023-09-07 09:59:15 +01:00
loongarchcap.c Copyright year updates 2023-09-07 09:59:15 +01:00
mem.c Windows: use srand() instead of srandom() 2023-10-13 15:04:42 +02:00
mem_clr.c
…
mem_sec.c Add locking to CRYPTO_secure_used 2023-12-01 09:46:11 -05:00
mips_arch.h
…
o_dir.c
…
o_fopen.c
…
o_init.c
…
o_str.c OPENSSL_hexstr2buf_ex(): Handle zero-length input correctly 2024-07-02 20:14:25 +02:00
o_time.c
…
packet.c Copyright year updates 2023-09-07 09:59:15 +01:00
param_build.c ossl-params: check length returned by strlen() 2023-12-12 19:58:25 +01:00
param_build_set.c Copyright year updates 2023-10-26 14:21:19 +01:00
params.c uefi: move variables 2024-05-30 18:38:54 +02:00
params_dup.c Copyright year updates 2025-07-01 12:04:53 +00:00
params_from_text.c Copyright year updates 2024-01-30 13:13:27 +00:00
params_idx.c.in params: provide a faster TRIE based param lookup. 2023-06-02 15:13:20 +10:00
pariscid.pl
…
passphrase.c
…
ppccap.c
…
ppccpuid.pl
…
provider.c Copyright year updates 2023-09-07 09:59:15 +01:00
provider_child.c Copyright year updates 2023-09-07 09:59:15 +01:00
provider_conf.c Copyright year updates 2025-07-01 12:04:53 +00:00
provider_core.c Fix up path generation to use OPENSSL_MODULES 2024-04-18 18:39:59 +02:00
provider_local.h
…
provider_predefined.c
…
punycode.c Copyright year updates 2023-09-07 09:59:15 +01:00
quic_vlint.c
…
riscv32cpuid.pl
…
riscv64cpuid.pl
…
riscvcap.c Avoid undefined behaviour with the <ctype.h> functions. 2024-10-10 20:48:28 +02:00
s390x_arch.h s390x: Don't probe crypto cards for ME/CRT offloading during initialization 2024-10-23 15:07:58 +02:00
s390xcap.c s390x: Don't probe crypto cards for ME/CRT offloading during initialization 2024-10-23 15:07:58 +02:00
s390xcpuid.pl
…
self_test_core.c
…
sleep.c crypto/sleep.c: avoid returning early due to signal 2025-08-21 14:06:04 +02:00
sparccpuid.S
…
sparcv9cap.c
…
sparse_array.c
…
threads_lib.c
…
threads_none.c Copyright year updates 2025-07-01 12:04:53 +00:00
threads_pthread.c Copyright year updates 2025-07-01 12:04:53 +00:00
threads_win.c threads_win: fix improper cast to long * instead of LONG * 2024-09-05 17:12:09 +02:00
time.c Copyright year updates 2023-09-07 09:59:15 +01:00
trace.c TRACE: automatically respect disabled categories 2024-10-23 15:17:08 +02:00
uid.c Copyright year updates 2023-09-07 09:59:15 +01:00
vms_rms.h
…
x86_64cpuid.pl
…
x86cpuid.pl
…