openssl, branch OpenSSL_1_0_2a

Prepare for 1.0.2a release

2015-03-19T13:31:16Z

Reviewed-by: Richard Levitte

make update

2015-03-19T13:31:16Z

Reviewed-by: Richard Levitte

Fix unsigned/signed warnings

2015-03-19T12:58:36Z

Fix some unsigned/signed warnings introduced as part of the fix for CVE-2015-0293 Reviewed-by: Tim Hudson Reviewed-by: Richard Levitte

Fix a failure to NULL a pointer freed on error.

2015-03-19T12:58:35Z

Reported by the LibreSSL project as a follow on to CVE-2015-0209 Reviewed-by: Richard Levitte

Update NEWS file

2015-03-19T12:58:35Z

Update the NEWS file with the latest entries from CHANGES ready for the release. Reviewed-by: Richard Levitte

Update CHANGES for release

2015-03-19T12:58:35Z

Update CHANGES file with all the latest fixes ready for the release. Reviewed-by: Richard Levitte

Fix discrepancy in NEWS file

2015-03-19T12:58:35Z

There was a discrepancy between the 1.0.2 version of NEWS and the 1.0.1 version. This fixes it. Reviewed-by: Richard Levitte

Fix CHANGES discrepancies

2015-03-19T12:58:35Z

There were some discrepancies in the CHANGES file between the 1.0.1 version and 1.0.2. This corrects it. Reviewed-by: Richard Levitte

Remove overlapping CHANGES/NEWS entries

2015-03-19T12:58:35Z

Remove entries from CHANGES and NEWS from letter releases that occur *after* the next point release. Without this we get duplicate entries for the same issue appearing multiple times. Reviewed-by: Richard Levitte

Fix reachable assert in SSLv2 servers.

2015-03-19T12:58:35Z

This assert is reachable for servers that support SSLv2 and export ciphers. Therefore, such servers can be DoSed by sending a specially crafted SSLv2 CLIENT-MASTER-KEY. Also fix s2_srvr.c to error out early if the key lengths are malformed. These lengths are sent unencrypted, so this does not introduce an oracle. CVE-2015-0293 This issue was discovered by Sean Burford (Google) and Emilia Käsper of the OpenSSL development team. Reviewed-by: Richard Levitte Reviewed-by: Tim Hudson