{"push_id":1101576117,"size":475,"distinct_size":8,"ref":"refs/heads/OpenSSL_1_0_2-stable","head":"133138569f37d149ed1d7641fe8c75a93fded445","before":"ff864ffef33b4b09bb31ca3b0e17e1c85b65c2c8","commits":[{"sha":"ae50d8270026edf5b3c7f8aaa0c6677462b33d97","author":{"email":"6521fc25e7624eef7c3a0d89b71de7e612d27d37@openssl.org","name":"Emilia Kasper"},"message":"Harden SSLv2-supporting servers against Bleichenbacher's attack.\n\nThere is no indication that the timing differences are exploitable in\nOpenSSL, and indeed there is some indication (Usenix '14) that they\nare too small to be exploitable. Nevertheless, be careful and apply\nthe same countermeasures as in s3_srvr.c\n\nThanks to Nimrod Aviram, Sebastian Schinzel and Yuval Shavitt for\nreporting this issue.\n\nReviewed-by: Richard Levitte <levitte@openssl.org>","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/ae50d8270026edf5b3c7f8aaa0c6677462b33d97"},{"sha":"d21cbd7d5e8be3f21ffec0491b7627d02fad57ea","author":{"email":"5fb523282dd7956571c80524edc2dccfa0bd8234@openssl.org","name":"Richard Levitte"},"message":"Appease clang -Wempty-translation-unit\n\nebcdic.c:284:7: warning: ISO C requires a translation unit to contain at least one\n      declaration [-Wempty-translation-unit]\n      ^\n1 warning generated.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit c25dea53e9db2b4956c315f85dae3f1c2854fd2b)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/d21cbd7d5e8be3f21ffec0491b7627d02fad57ea"},{"sha":"a4ba7163338f30675d7c58ed274d127ad7ac04e9","author":{"email":"5fb523282dd7956571c80524edc2dccfa0bd8234@openssl.org","name":"Richard Levitte"},"message":"Appease clang -Wgnu-statement-expression\n\nWe use GNU statement expressions in crypto/md32_common.h, surrounded\nby checks that GNU C is indeed used to compile.  It seems that clang,\nat least on Linux, pretends to be GNU C, therefore finds the statement\nexpressions and then warns about them.\n\nThe solution is to have clang be quiet about it.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 04958e84d8079fa57a782db70f003c38b5b156fd)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/a4ba7163338f30675d7c58ed274d127ad7ac04e9"},{"sha":"700c0eb8d9f155e526fab1310f6b5073327bf6a7","author":{"email":"5fb523282dd7956571c80524edc2dccfa0bd8234@openssl.org","name":"Richard Levitte"},"message":"Appease clang -Wshadow\n\nThe macros BSWAP4 and BSWAP8 have statetemnt expressions\nimplementations that use local variable names that shadow variables\noutside the macro call, generating warnings like this\n\ne_aes_cbc_hmac_sha1.c:263:14: warning: declaration shadows a local variable\n      [-Wshadow]\n    seqnum = BSWAP8(blocks[0].q[0]);\n             ^\n../modes/modes_lcl.h:41:29: note: expanded from macro 'BSWAP8'\n                            ^\ne_aes_cbc_hmac_sha1.c:223:12: note: previous declaration is here\n    size_t ret = 0;\n           ^\n\nHave clang be quiet by modifying the macro variable names slightly\n(suffixing them with an underscore).\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 2da2a4349c1598ad0648405fe175e7846d893c45)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/700c0eb8d9f155e526fab1310f6b5073327bf6a7"},{"sha":"9e63eeaf76fed44bcbac16df24f06bc87d8b5de4","author":{"email":"5fb523282dd7956571c80524edc2dccfa0bd8234@openssl.org","name":"Richard Levitte"},"message":"Ignore the non-dll windows specific build directories\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 37d92b1b2bb6e6e04d62d6f7774a2d8190a99174)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/9e63eeaf76fed44bcbac16df24f06bc87d8b5de4"},{"sha":"42802a94be61c9378ead72bb40f02c8b33f1f6e6","author":{"email":"5fb523282dd7956571c80524edc2dccfa0bd8234@openssl.org","name":"Richard Levitte"},"message":"Have mkerr.pl treat already existing multiline string defs properly\n\nSince source reformat, we ended up with some error reason string\ndefinitions that spanned two lines.  That in itself is fine, but we\nsometimes edited them to provide better strings than what could be\nautomatically determined from the reason macro, for example:\n\n    {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER),\n     \"Peer haven't sent GOST certificate, required for selected ciphersuite\"},\n\nHowever, mkerr.pl didn't treat those two-line definitions right, and\nthey ended up being retranslated to whatever the macro name would\nindicate, for example:\n\n    {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER),\n     \"No gost certificate sent by peer\"},\n\nClearly not what we wanted.  This change fixes this problem.\n\nReviewed-by: Matt Caswell <matt@openssl.org>\n(cherry picked from commit 2cfdfe0918f03f8323c9523a2beb2b363ae86ca7)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/42802a94be61c9378ead72bb40f02c8b33f1f6e6"},{"sha":"784f155e0d39cff1fd6e76e75c07f56ae25ebced","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"Fix ECDH detection, add ECDH keyid test.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 9fdbc9df76a68a30df349c53f1ceeb915f82948c)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/784f155e0d39cff1fd6e76e75c07f56ae25ebced"},{"sha":"07395b7a6dfdbe263677e58519f1d11d51d31da5","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"Fix ECDH key identifier support.\n\nPR#3789\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 7a317fa07cf3d9952c574e7d214d371798fee42a)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/07395b7a6dfdbe263677e58519f1d11d51d31da5"},{"sha":"6df777ed508ca785b31d6e92e73961ac282ab3ea","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"Don't set *pval to NULL in ASN1_item_ex_new.\n\nWhile *pval is usually a pointer in rare circumstances it can be a long\nvalue. One some platforms (e.g. WIN64) where\nsizeof(long) < sizeof(ASN1_VALUE *) this will write past the field.\n\n*pval is initialised correctly in the rest of ASN1_item_ex_new so setting it\nto NULL is unecessary anyway.\n\nThanks to Julien Kauffmann for reporting this issue.\n\nReviewed-by: Richard Levitte <levitte@openssl.org>\n(cherry picked from commit f617b4969a9261b9d7d381670aefbe2cf766a2cb)\n\nConflicts:\n\tcrypto/asn1/tasn_new.c","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/6df777ed508ca785b31d6e92e73961ac282ab3ea"},{"sha":"f6cddcccc89bd27c09c2c659c0bdbf40647f6ead","author":{"email":"bb87b47479d83cec3c76132206933257ded727b2@roeckx.be","name":"Kurt Roeckx"},"message":"X509_VERIFY_PARAM_free: Check param for NULL\n\nReviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>\n(cherry picked from commit f49baeff50d0be9c8d86aed6fb4a08841aa3da41)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/f6cddcccc89bd27c09c2c659c0bdbf40647f6ead"},{"sha":"ea9de25f2f577db69d67c39e5cf60be7da17c931","author":{"email":"bb87b47479d83cec3c76132206933257ded727b2@roeckx.be","name":"Kurt Roeckx"},"message":"do_dirname: Don't change gen on failures\n\nIt would set gen->d.dirn to a freed pointer in case X509V3_NAME_from_section\nfailed.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 8ec5c5dd361343d9017eff8547b19e86e4944ebc)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/ea9de25f2f577db69d67c39e5cf60be7da17c931"},{"sha":"35bac9167644d167aee57c26df206ed5f2b2a877","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Check for ClientHello message overruns\n\nThe ClientHello processing is insufficiently rigorous in its checks to make\nsure that we don't read past the end of the message. This does not have\nsecurity implications due to the size of the underlying buffer - but still\nneeds to be fixed.\n\nWith thanks to Qinghao Tang for reporting this issue.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit c9642eb1ff79a30e2c7632ef8267cc34cc2b0d79)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/35bac9167644d167aee57c26df206ed5f2b2a877"},{"sha":"5101c35c9173e40051acb23e45aae128fb84806e","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Fix ssl_get_prev_session overrun\n\nIf OpenSSL is configured with no-tlsext then ssl_get_prev_session can read\npast the end of the ClientHello message if the session_id length in the\nClientHello is invalid. This should not cause any security issues since the\nunderlying buffer is 16k in size. It should never be possible to overrun by\nthat many bytes.\n\nThis is probably made redundant by the previous commit - but you can never be\ntoo careful.\n\nWith thanks to Qinghao Tang for reporting this issue.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 5e0a80c1c9b2b06c2d203ad89778ce1b98e0b5ad)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/5101c35c9173e40051acb23e45aae128fb84806e"},{"sha":"a696708ae6bbe42f409748b3e31bb2f3034edbf3","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"Reject empty generation strings.\n\nReported by Hanno Böck <hanno@hboeck.de>\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 111b60bea01d234b5873488c19ff2b9c5d4d58e9)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/a696708ae6bbe42f409748b3e31bb2f3034edbf3"},{"sha":"bf5b8ff17dd7039b15cbc6468cd865cbc219581d","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"Limit depth of nested sequences when generating ASN.1\n\nReported by Hanno Böck <hanno@hboeck.de>\nPR#3800\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit c4137b5e828d8fab0b244defb79257619dad8fc7)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/bf5b8ff17dd7039b15cbc6468cd865cbc219581d"},{"sha":"3b38646d1345b5ec4ff7fd13c8b8bd8d46105b7e","author":{"email":"390481576fb1f818e2982a64321a2afc7309fb14@dukhovni.org","name":"Viktor Dukhovni"},"message":"Code style: space after 'if'\n\nReviewed-by: Matt Caswell <gitlab@openssl.org>","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/3b38646d1345b5ec4ff7fd13c8b8bd8d46105b7e"},{"sha":"5613feaacc1334dce9809d60bc23f3081e6d35e6","author":{"email":"6521fc25e7624eef7c3a0d89b71de7e612d27d37@openssl.org","name":"Emilia Kasper"},"message":"Use -Wall -Wextra with clang\n\nThe disabled set of -Weverything is hard to maintain across versions.\nUse -Wall -Wextra but also document other useful warnings that currently trigger.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/5613feaacc1334dce9809d60bc23f3081e6d35e6"},{"sha":"e697a4c3d7d2267e9d82d88dbfa5084475794cb3","author":{"email":"6521fc25e7624eef7c3a0d89b71de7e612d27d37@openssl.org","name":"Emilia Kasper"},"message":"Error out immediately on empty ciphers list.\n\nA 0-length ciphers list is never permitted. The old code only used to\nreject an empty ciphers list for connections with a session ID. It\nwould later error out on a NULL structure, so this change just moves\nthe alert closer to the problem source.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit 3ae91cfb327c9ed689b9aaf7bca01a3f5a0657cb)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/e697a4c3d7d2267e9d82d88dbfa5084475794cb3"},{"sha":"3661bb4e7934668bd99ca777ea8b30eedfafa871","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"Fix encoding bug in i2c_ASN1_INTEGER\n\nFix bug where i2c_ASN1_INTEGER mishandles zero if it is marked as\nnegative.\n\nThanks to Huzaifa Sidhpurwala <huzaifas@redhat.com> and\nHanno Böck <hanno@hboeck.de> for reporting this issue.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(cherry picked from commit a0eed48d37a4b7beea0c966caf09ad46f4a92a44)","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/3661bb4e7934668bd99ca777ea8b30eedfafa871"},{"sha":"6281abc79623419eae6a64768c478272d5d3a426","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"In certain situations the server provided certificate chain may no longer be\nvalid. However the issuer of the leaf, or some intermediate cert is in fact\nin the trust store.\n\nWhen building a trust chain if the first attempt fails, then try to see if\nalternate chains could be constructed that are trusted.\n\nRT3637\nRT3621\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":false,"url":"https://api.github.com/repos/Adallom/openssl/commits/6281abc79623419eae6a64768c478272d5d3a426"}]}