mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-21 01:15:20 +08:00
Code Issues Packages Projects Releases Wiki Activity
69664d6af0
openssl/crypto
History
Viktor Dukhovni 69664d6af0 Future proof build_chain() in x509_vfy.c 
Coverity reports a potential NULL deref when "2 0 0" DANE trust-anchors
from DNS are configured via SSL_dane_tlsa_add() and X509_STORE_CTX_init()
is called with a NULL stack of untrusted certificates.

Since ssl_verify_cert_chain() always provideds a non-NULL stack of
untrusted certs, and no other code path enables DANE, the problem
can only happen in applications that use SSL_CTX_set_cert_verify_callback()
to implement their own wrappers around X509_verify_cert() passing
only the leaf certificate to the latter.

Regardless of the "improbability" of the problem, we do need to
ensure that build_chain() handles this case correctly.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-04-27 14:42:38 -04:00
..
aes s390x assembly pack: cache capability query results. 2016-04-25 11:53:45 +02:00
asn1 Harden ASN.1 BIO handling of large amounts of data. 2016-04-23 00:26:43 +01:00
async Remove --classic build entirely 2016-04-20 16:04:56 +02:00
bf Remove --classic build entirely 2016-04-20 16:04:56 +02:00
bio BIO socket connect failure was not handled correctly. 2016-04-20 21:26:01 +02:00
blake2 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
bn Update copyright; generated files. 2016-04-20 10:33:15 -04:00
buffer Remove --classic build entirely 2016-04-20 16:04:56 +02:00
camellia camellia/build.info: fix typo 2016-04-26 21:30:55 +02:00
cast Remove --classic build entirely 2016-04-20 16:04:56 +02:00
chacha chacha/asm/chacha-ppc.pl: get misalignment corner case right on big-endian. 2016-04-25 11:48:44 +02:00
cmac Remove --classic build entirely 2016-04-20 16:04:56 +02:00
cms Remove --classic build entirely 2016-04-20 16:04:56 +02:00
comp Remove --classic build entirely 2016-04-20 16:04:56 +02:00
conf Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ct Remove --classic build entirely 2016-04-20 16:04:56 +02:00
des Remove --classic build entirely 2016-04-20 16:04:56 +02:00
dh RSA, DSA, DH: Allow some given input to be NULL on already initialised keys 2016-04-27 15:07:53 +02:00
dsa RSA, DSA, DH: Allow some given input to be NULL on already initialised keys 2016-04-27 15:07:53 +02:00
dso Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ec Fix EC_KEY_set_private_key() to call key->group->meth->set_private() 2016-04-23 04:24:27 +01:00
engine Remove --classic build entirely 2016-04-20 16:04:56 +02:00
err Remove --classic build entirely 2016-04-20 16:04:56 +02:00
evp Fix missing IDEA renames (windows build) 2016-04-20 14:48:54 -04:00
hmac Remove --classic build entirely 2016-04-20 16:04:56 +02:00
idea Remove --classic build entirely 2016-04-20 16:04:56 +02:00
include/internal Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
kdf Remove --classic build entirely 2016-04-20 16:04:56 +02:00
lhash Remove --classic build entirely 2016-04-20 16:04:56 +02:00
md2 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
md4 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
md5 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
mdc2 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
modes s390x assembly pack: cache capability query results. 2016-04-25 11:53:45 +02:00
objects Update copyright; generated files. 2016-04-20 10:33:15 -04:00
ocsp Remove dead-code infinite loop 2016-04-26 14:17:41 -04:00
pem Remove --classic build entirely 2016-04-20 16:04:56 +02:00
perlasm Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
pkcs7 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
pkcs12 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
poly1305 SPARCv9 assembly pack: fine-tune run-time switch. 2016-04-26 21:35:05 +02:00
rand Remove --classic build entirely 2016-04-20 16:04:56 +02:00
rc2 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
rc4 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
rc5 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ripemd Remove --classic build entirely 2016-04-20 16:04:56 +02:00
rsa RSA, DSA, DH: Allow some given input to be NULL on already initialised keys 2016-04-27 15:07:53 +02:00
seed Remove --classic build entirely 2016-04-20 16:04:56 +02:00
sha s390x assembly pack: cache capability query results. 2016-04-25 11:53:45 +02:00
srp Remove --classic build entirely 2016-04-20 16:04:56 +02:00
stack Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ts Remove --classic build entirely 2016-04-20 16:04:56 +02:00
txt_db Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ui Remove --classic build entirely 2016-04-20 16:04:56 +02:00
whrlpool Remove --classic build entirely 2016-04-20 16:04:56 +02:00
x509 Future proof build_chain() in x509_vfy.c 2016-04-27 14:42:38 -04:00
x509v3 Fix a missing return value check in v3_addr 2016-04-21 10:51:57 +01:00
alphacpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
arm64cpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
arm_arch.h
armcap.c
armv4cpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
build.info
c64xpluscpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
cpt_err.c Make string_to_hex/hex_to_string public 2016-04-18 09:02:11 -04:00
cryptlib.c
cversion.c
dllmain.c
ebcdic.c
ex_data.c Fix ex_data locks issue 2016-04-14 22:15:32 +01:00
fips_err.h
fips_ers.c
ia64cpuid.S
init.c Ensure all locks are properly cleaned up 2016-04-14 13:19:04 +01:00
LPdir_nyi.c
LPdir_unix.c
LPdir_vms.c
LPdir_win32.c
LPdir_win.c
LPdir_wince.c
mem_clr.c
mem_dbg.c Fix ex_data locks issue 2016-04-14 22:15:32 +01:00
mem_sec.c
mem.c Fix CRYPTO_clear_realloc() bug. 2016-04-21 23:56:44 +01:00
o_dir.c
o_fips.c
o_init.c
o_str.c Unsigned chars can't be negative 2016-04-18 15:12:58 +01:00
o_time.c
pariscid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
ppc_arch.h PPC assebmly pack: initial POWER9 support tidbits. 2016-04-13 12:09:46 +02:00
ppccap.c PPC assebmly pack: initial POWER9 support tidbits. 2016-04-13 12:09:46 +02:00
ppccpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
s390xcap.c
s390xcpuid.S s390x assembly pack: cache capability query results. 2016-04-25 11:53:45 +02:00
sparc_arch.h crypto/sparc_arch.h: reserve more SPARCv9 capability bits. 2016-04-25 11:50:54 +02:00
sparccpuid.S sparcv9cap.c: add Fujitsu SPARC64 X AES capability detection. 2016-04-20 09:57:37 +02:00
sparcv9cap.c SPARCv9 assembly pack: fine-tune run-time switch. 2016-04-26 21:35:05 +02:00
threads_none.c
threads_pthread.c
threads_win.c
uid.c
vms_rms.h
x86_64cpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
x86cpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00