openssl, branch OpenSSL_1_0_1q

Prepare for 1.0.1q release

2015-12-03T14:50:26Z

Reviewed-by: Richard Levitte

make update

2015-12-03T14:50:26Z

Reviewed-by: Richard Levitte

Update CHANGES and NEWS

2015-12-03T12:45:13Z

Update the CHANGES and NEWS files for the new release. Reviewed-by: Richard Levitte

Add PSS parameter check.

2015-12-03T12:45:13Z

Avoid seg fault by checking mgf1 parameter is not NULL. This can be triggered during certificate verification so could be a DoS attack against a client or a server enabling client authentication. Thanks to Loïc Jonas Etienne (Qnective AG) for discovering this bug. CVE-2015-3194 Reviewed-by: Matt Caswell

Fix leak with ASN.1 combine.

2015-12-03T12:45:13Z

When parsing a combined structure pass a flag to the decode routine so on error a pointer to the parent structure is not zeroed as this will leak any additional components in the parent. This can leak memory in any application parsing PKCS#7 or CMS structures. CVE-2015-3195. Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using libFuzzer. PR#4131 Reviewed-by: Richard Levitte

e_os.h: limit _MSC_VER trickery to older compilers.

2015-12-03T12:24:42Z

PR: #3390, backport from 1.0.2. Reviewed-by: Matt Caswell

typo

2015-12-02T21:49:37Z

Reviewed-by: Andy Polyakov

_BSD_SOURCE is deprecated, use _DEFAULT_SOURCE instead

2015-12-02T17:49:57Z

The feature_test_macros(7) manual tells us that _BSD_SOURCE is deprecated since glibc 2.20 and that the compiler will warn about it being used, unless _DEFAULT_SOURCE is defined as well. Reviewed-by: Rich Salz (cherry picked from commit f9fd35248c9a3b1125d9ab82ffb19d62e86533ac)

Return errors even if the cookie validation has succeeded

2015-11-30T10:51:43Z

In the DTLS ClientHello processing the return value is stored in |ret| which by default is -1. We wish to return 1 on success or 2 on success *and* we have validated the DTLS cookie. Previously on successful validation of the cookie we were setting |ret| to 2. Unfortunately if we later encounter an error then we can end up returning a successful (positive) return code from the function because we already set |ret| to a positive value. This does not appear to have a security consequence because the handshake just fails at a later point. Reviewed-by: Andy Polyakov

Use both sun and __sun

2015-11-24T22:44:50Z

Reviewed-by: Andy Polyakov (cherry picked from commit ed02493567390cac6d07447f193fcaac5b219af3)