openssl, branch OpenSSL_1_0_0s

Prepare for 1.0.0s release

2015-06-11T14:13:36Z

Reviewed-by: Stephen Henson

Update CHANGES and NEWS

2015-06-11T14:10:48Z

Updates to CHANGES and NEWS to take account of the latest security fixes. Reviewed-by: Rich Salz

PKCS#7: Fix NULL dereference with missing EncryptedContent.

2015-06-11T14:10:48Z

CVE-2015-1790 Reviewed-by: Rich Salz

Fix length checks in X509_cmp_time to avoid out-of-bounds reads.

2015-06-11T14:10:48Z

Also tighten X509_cmp_time to reject more than three fractional seconds in the time; and to reject trailing garbage after the offset. CVE-2015-1789 Reviewed-by: Viktor Dukhovni Reviewed-by: Richard Levitte

Fix infinite loop in CMS

2015-06-11T14:10:48Z

Fix loop in do_free_upto if cmsbio is NULL: this will happen when attempting to verify and a digest is not recognised. Reported by Johannes Bauer. CVE-2015-1792 Reviewed-by: Matt Caswell

Correction of make depend merge error

2015-06-11T13:53:32Z

$(PROGS) was mistakenly removed, adding it back. Reviewed-by: Matt Caswell (cherry picked from commit 5ef5b9ffa91ad6061c42291564a1dc786300ebdd)

More ssl_session_dup fixes

2015-06-11T09:13:02Z

Fix error handling in ssl_session_dup, as well as incorrect setting up of the session ticket. Follow on from CVE-2015-1791. Thanks to LibreSSL project for reporting these issues. Conflicts: ssl/ssl_sess.c Reviewed-by: Tim Hudson

EC_POINT_is_on_curve does not return a boolean

2015-06-10T09:57:05Z

The function EC_POINT_is_on_curve does not return a boolean value. It returns 1 if the point is on the curve, 0 if it is not, and -1 on error. Many usages within OpenSSL were incorrectly using this function and therefore not correctly handling error conditions. With thanks to the Open Crypto Audit Project for reporting this issue. Reviewed-by: Kurt Roeckx (cherry picked from commit 68886be7e2cd395a759fcd41d2cede461b68843d) Conflicts: crypto/ec/ec2_oct.c crypto/ec/ecp_oct.c crypto/ec/ectest.c

Fix Kerberos issue in ssl_session_dup

2015-06-10T09:03:42Z

The fix for CVE-2015-1791 introduced an error in ssl_session_dup for Kerberos. Reviewed-by: Tim Hudson (cherry picked from commit dcad51bc13c9b716d9a66248bcc4038c071ff158)

return correct NID for undefined object

2015-06-08T20:47:24Z

Reviewed-by: Tim Hudson (cherry picked from commit 0fb9990480919163cc375a2b6c0df1d8d901a77b)