wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/apps
History
Peter Wu 6d047e06e6 SSL_get_shared_sigalgs: handle negative idx parameter 
When idx is negative (as is the case with do_print_sigalgs in
apps/s_cb.c), AddressSanitizer complains about a buffer overflow (read).
Even if the pointer is not dereferenced, this is undefined behavior.

Change the user not to use "-1" as index since the function is
documented to return 0 on out-of-range values.

Tested with `openssl s_server` and `curl -k https://localhost:4433`.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2349)
2017-02-09 09:48:46 +00:00
..
demoCA Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
demoSRP Missing SRP files. 2011-03-16 11:50:33 +00:00
app_rand.c cherry pick pr-512 changes 2016-05-29 13:36:59 -04:00
apps.c Enable apps to get a UI_METHOD for the default prompter 2017-01-11 18:27:27 +01:00
apps.h Fix some extra or missing whitespaces... 2017-01-25 09:06:34 +00:00
asn1pars.c Constify command options 2016-10-14 18:25:50 +02:00
build.info Simplify INCLUDE statements in build.info files 2016-07-01 18:36:08 +02:00
ca-cert.srl Update test server certificate in apps/server.pem (it was expired). 2000-10-16 22:56:10 +00:00
ca-key.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
ca-req.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
ca.c Fix some style and indent issue 2017-01-25 09:06:34 +00:00
CA.pl.in Allow CA.pl script user to pass extra arguments to openssl command 2016-11-14 13:08:23 -05:00
cert.pem Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
ciphers.c Add the SSL_METHOD for TLSv1.3 and all other base changes required 2016-11-02 13:08:21 +00:00
client.pem Replace expired test server and client certificates with new ones. 2011-12-08 14:44:05 +00:00
cms.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
crl.c Constify command options 2016-10-14 18:25:50 +02:00
crl2p7.c Constify command options 2016-10-14 18:25:50 +02:00
ct_log_list.cnf GH1536: Install empty CT log list 2016-09-14 18:22:33 -04:00
dgst.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
dh1024.pem Update Diffie-Hellman parameters to IANA standards 2016-05-03 10:32:01 -04:00
dh2048.pem Update Diffie-Hellman parameters to IANA standards 2016-05-03 10:32:01 -04:00
dh4096.pem Update Diffie-Hellman parameters to IANA standards 2016-05-03 10:32:01 -04:00
dhparam.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
dsa-ca.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
dsa-pca.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
dsa.c Support MSBLOB format if RC4 is disabled 2016-11-17 18:45:42 +00:00
dsa512.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
dsa1024.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
dsap.pem Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
dsaparam.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
ec.c Fix some extra or missing whitespaces... 2017-01-25 09:06:34 +00:00
ecparam.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
enc.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
engine.c Constify command options 2016-10-14 18:25:50 +02:00
errstr.c Constify command options 2016-10-14 18:25:50 +02:00
gendsa.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
genpkey.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
genrsa.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
nseq.c Constify command options 2016-10-14 18:25:50 +02:00
ocsp.c Constify command options 2016-10-14 18:25:50 +02:00
openssl-vms.cnf RT3809: basicConstraints is critical 2016-06-13 09:18:22 -04:00
openssl.c Remove unused variable 2017-02-07 10:25:51 -05:00
openssl.cnf RT3809: basicConstraints is critical 2016-06-13 09:18:22 -04:00
opt.c Allow proxy certs to be present when verifying a chain 2016-06-20 21:34:37 +02:00
passwd.c 'openssl passwd' command can now compute AIX MD5-based passwords hashes. 2017-01-21 10:44:23 -05:00
pca-cert.srl Update test server certificate in apps/server.pem (it was expired). 2000-10-16 22:56:10 +00:00
pca-key.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
pca-req.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
pkcs7.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
pkcs8.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
pkcs12.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
pkey.c print errors in pkey utility 2017-01-08 01:42:50 +00:00
pkeyparam.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
pkeyutl.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
prime.c Fix some extra or missing whitespaces... 2017-01-25 09:06:34 +00:00
privkey.pem PR: 1644 2009-09-06 15:49:46 +00:00
progs.h Fix style issue 2016-10-14 18:25:50 +02:00
progs.pl Fix style issue 2016-10-14 18:25:50 +02:00
rand.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
rehash.c Constify command options 2016-10-14 18:25:50 +02:00
req.c Fix parsing of serial# in req 2017-02-06 09:48:21 -05:00
req.pem Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
rsa.c Support MSBLOB format if RC4 is disabled 2016-11-17 18:45:42 +00:00
rsa8192.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
rsautl.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
s512-key.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
s512-req.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
s1024key.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
s1024req.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
s_apps.h apps: Add support for writing a keylog file 2017-02-07 19:20:56 +01:00
s_cb.c SSL_get_shared_sigalgs: handle negative idx parameter 2017-02-09 09:48:46 +00:00
s_client.c apps: Add support for writing a keylog file 2017-02-07 19:20:56 +01:00
s_server.c apps: Add support for writing a keylog file 2017-02-07 19:20:56 +01:00
s_socket.c Copyright consolidation 01/10 2016-05-17 14:19:19 -04:00
s_time.c Constify command options 2016-10-14 18:25:50 +02:00
server.pem Replace expired test server and client certificates with new ones. 2011-12-08 14:44:05 +00:00
server.srl Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
server2.pem Replace expired test server and client certificates with new ones. 2011-12-08 14:44:05 +00:00
sess_id.c Constify command options 2016-10-14 18:25:50 +02:00
smime.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
speed.c Cleanup EVP_CIPH/EP_CTRL duplicate defines 2017-01-24 18:47:10 +01:00
spkac.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
srp.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
testCA.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
testdsa.h Copyright consolidation 01/10 2016-05-17 14:19:19 -04:00
testrsa.h Copyright consolidation 01/10 2016-05-17 14:19:19 -04:00
timeouts.h Copyright consolidation 01/10 2016-05-17 14:19:19 -04:00
ts.c Constify command options 2016-10-14 18:25:50 +02:00
tsget.in perl: Separate compile-time environment from runtime environment 2016-07-04 15:40:31 +02:00
verify.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00
version.c Constify command options 2016-10-14 18:25:50 +02:00
vms_decc_init.c Copyright consolidation 01/10 2016-05-17 14:19:19 -04:00
vms_term_sock.c Reformat to fit OpenSSL source code standards 2016-09-15 23:24:06 +02:00
vms_term_sock.h Reformat to fit OpenSSL source code standards 2016-09-15 23:24:06 +02:00
win32_init.c Fix not-c code 2016-10-19 00:56:48 +02:00
x509.c If an engine comes up explicitely, it must also come down explicitely 2016-10-19 17:44:08 +02:00