wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/crypto
History
Viktor Dukhovni 69664d6af0 Future proof build_chain() in x509_vfy.c 
Coverity reports a potential NULL deref when "2 0 0" DANE trust-anchors
from DNS are configured via SSL_dane_tlsa_add() and X509_STORE_CTX_init()
is called with a NULL stack of untrusted certificates.

Since ssl_verify_cert_chain() always provideds a non-NULL stack of
untrusted certs, and no other code path enables DANE, the problem
can only happen in applications that use SSL_CTX_set_cert_verify_callback()
to implement their own wrappers around X509_verify_cert() passing
only the leaf certificate to the latter.

Regardless of the "improbability" of the problem, we do need to
ensure that build_chain() handles this case correctly.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-04-27 14:42:38 -04:00
..
aes s390x assembly pack: cache capability query results. 2016-04-25 11:53:45 +02:00
asn1 Harden ASN.1 BIO handling of large amounts of data. 2016-04-23 00:26:43 +01:00
async Remove --classic build entirely 2016-04-20 16:04:56 +02:00
bf Remove --classic build entirely 2016-04-20 16:04:56 +02:00
bio BIO socket connect failure was not handled correctly. 2016-04-20 21:26:01 +02:00
blake2 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
bn Update copyright; generated files. 2016-04-20 10:33:15 -04:00
buffer Remove --classic build entirely 2016-04-20 16:04:56 +02:00
camellia camellia/build.info: fix typo 2016-04-26 21:30:55 +02:00
cast Remove --classic build entirely 2016-04-20 16:04:56 +02:00
chacha chacha/asm/chacha-ppc.pl: get misalignment corner case right on big-endian. 2016-04-25 11:48:44 +02:00
cmac Remove --classic build entirely 2016-04-20 16:04:56 +02:00
cms Remove --classic build entirely 2016-04-20 16:04:56 +02:00
comp Remove --classic build entirely 2016-04-20 16:04:56 +02:00
conf Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ct Remove --classic build entirely 2016-04-20 16:04:56 +02:00
des Remove --classic build entirely 2016-04-20 16:04:56 +02:00
dh RSA, DSA, DH: Allow some given input to be NULL on already initialised keys 2016-04-27 15:07:53 +02:00
dsa RSA, DSA, DH: Allow some given input to be NULL on already initialised keys 2016-04-27 15:07:53 +02:00
dso Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ec Fix EC_KEY_set_private_key() to call key->group->meth->set_private() 2016-04-23 04:24:27 +01:00
engine Remove --classic build entirely 2016-04-20 16:04:56 +02:00
err Remove --classic build entirely 2016-04-20 16:04:56 +02:00
evp Fix missing IDEA renames (windows build) 2016-04-20 14:48:54 -04:00
hmac Remove --classic build entirely 2016-04-20 16:04:56 +02:00
idea Remove --classic build entirely 2016-04-20 16:04:56 +02:00
include/internal Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
kdf Remove --classic build entirely 2016-04-20 16:04:56 +02:00
lhash Remove --classic build entirely 2016-04-20 16:04:56 +02:00
md2 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
md4 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
md5 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
mdc2 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
modes s390x assembly pack: cache capability query results. 2016-04-25 11:53:45 +02:00
objects Update copyright; generated files. 2016-04-20 10:33:15 -04:00
ocsp Remove dead-code infinite loop 2016-04-26 14:17:41 -04:00
pem Remove --classic build entirely 2016-04-20 16:04:56 +02:00
perlasm Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
pkcs7 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
pkcs12 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
poly1305 SPARCv9 assembly pack: fine-tune run-time switch. 2016-04-26 21:35:05 +02:00
rand Remove --classic build entirely 2016-04-20 16:04:56 +02:00
rc2 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
rc4 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
rc5 Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ripemd Remove --classic build entirely 2016-04-20 16:04:56 +02:00
rsa RSA, DSA, DH: Allow some given input to be NULL on already initialised keys 2016-04-27 15:07:53 +02:00
seed Remove --classic build entirely 2016-04-20 16:04:56 +02:00
sha s390x assembly pack: cache capability query results. 2016-04-25 11:53:45 +02:00
srp Remove --classic build entirely 2016-04-20 16:04:56 +02:00
stack Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ts Remove --classic build entirely 2016-04-20 16:04:56 +02:00
txt_db Remove --classic build entirely 2016-04-20 16:04:56 +02:00
ui Remove --classic build entirely 2016-04-20 16:04:56 +02:00
whrlpool Remove --classic build entirely 2016-04-20 16:04:56 +02:00
x509 Future proof build_chain() in x509_vfy.c 2016-04-27 14:42:38 -04:00
x509v3 Fix a missing return value check in v3_addr 2016-04-21 10:51:57 +01:00
alphacpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
arm64cpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
arm_arch.h Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
armcap.c Add assembly support for 32-bit iOS. 2015-04-20 15:06:22 +02:00
armv4cpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
build.info Break out DllMain from crypto/cryptlib.c and use it in shared libs only 2016-03-30 11:22:42 +02:00
c64xpluscpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
cpt_err.c Make string_to_hex/hex_to_string public 2016-04-18 09:02:11 -04:00
cryptlib.c Break out DllMain from crypto/cryptlib.c and use it in shared libs only 2016-03-30 11:22:42 +02:00
cversion.c Make it possible to get ENGINESDIR info from OpenSSL_versions 2016-02-10 19:36:48 +01:00
dllmain.c Break out DllMain from crypto/cryptlib.c and use it in shared libs only 2016-03-30 11:22:42 +02:00
ebcdic.c Use NON_EMPTY_TRANSLATION_UNIT, consistently. 2016-02-09 20:13:29 -05:00
ex_data.c Fix ex_data locks issue 2016-04-14 22:15:32 +01:00
fips_err.h Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
fips_ers.c Use NON_EMPTY_TRANSLATION_UNIT, consistently. 2016-02-09 20:13:29 -05:00
ia64cpuid.S IA-64 assembler pack: fix typos and make it work on HP-UX. 2011-05-07 20:36:05 +00:00
init.c Ensure all locks are properly cleaned up 2016-04-14 13:19:04 +01:00
LPdir_nyi.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
LPdir_unix.c memset, memcpy, sizeof consistency fixes 2015-05-05 22:18:59 -04:00
LPdir_vms.c memset, memcpy, sizeof consistency fixes 2015-05-05 22:18:59 -04:00
LPdir_win.c memset, memcpy, sizeof consistency fixes 2015-05-05 22:18:59 -04:00
LPdir_win32.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
LPdir_wince.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
mem.c Fix CRYPTO_clear_realloc() bug. 2016-04-21 23:56:44 +01:00
mem_clr.c RT4116: Change cleanse to just memset 2016-02-25 10:04:00 -05:00
mem_dbg.c Fix ex_data locks issue 2016-04-14 22:15:32 +01:00
mem_sec.c Convert mem_dbg and mem_sec to the new Thread API 2016-03-08 21:06:04 +00:00
o_dir.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
o_fips.c Identify and move common internal libcrypto header files 2015-05-14 17:21:40 +02:00
o_init.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
o_str.c Unsigned chars can't be negative 2016-04-18 15:12:58 +01:00
o_time.c Remove Netware and OS/2 2016-03-17 17:06:57 -04:00
pariscid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
ppc_arch.h PPC assebmly pack: initial POWER9 support tidbits. 2016-04-13 12:09:46 +02:00
ppccap.c PPC assebmly pack: initial POWER9 support tidbits. 2016-04-13 12:09:46 +02:00
ppccpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
s390xcap.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
s390xcpuid.S s390x assembly pack: cache capability query results. 2016-04-25 11:53:45 +02:00
sparc_arch.h crypto/sparc_arch.h: reserve more SPARCv9 capability bits. 2016-04-25 11:50:54 +02:00
sparccpuid.S sparcv9cap.c: add Fujitsu SPARC64 X AES capability detection. 2016-04-20 09:57:37 +02:00
sparcv9cap.c SPARCv9 assembly pack: fine-tune run-time switch. 2016-04-26 21:35:05 +02:00
threads_none.c Implement new multi-threading API 2016-02-26 10:00:36 +00:00
threads_pthread.c GH773: Possible leak on CRYPTO_THREAD_lock_new failure 2016-03-03 19:47:01 -05:00
threads_win.c Fix: CRYPTO_THREAD_run_once 2016-04-02 16:56:09 -04:00
uid.c Remove Netware and OS/2 2016-03-17 17:06:57 -04:00
vms_rms.h Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
x86_64cpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00
x86cpuid.pl Copyright consolidation: perl files 2016-04-20 09:45:40 -04:00