openssl, branch OpenSSL_1_0_2h

Prepare for 1.0.2h release

2016-05-03T13:46:41Z

Reviewed-by: Rich Salz

make update

2016-05-03T13:46:41Z

Reviewed-by: Rich Salz

Update CHANGES and NEWS for the new release

2016-05-03T12:19:10Z

Reviewed-by: Richard Levitte

Fix ASN1_INTEGER handling.

2016-05-03T12:05:34Z

Only treat an ASN1_ANY type as an integer if it has the V_ASN1_INTEGER tag: V_ASN1_NEG_INTEGER is an internal only value which is never used for on the wire encoding. Thanks to David Benjamin for reporting this bug. This was found using libFuzzer. RT#4364 (part)CVE-2016-2108. Reviewed-by: Emilia Käsper

Check that we have enough padding characters.

2016-05-03T12:05:34Z

Reviewed-by: Emilia Käsper CVE-2016-2107 MR: #2572

Remove some documentation for functions not in 1.0.x

2016-05-03T11:53:47Z

A few functions in the recently added EVP_EncodeInit docs don't apply to the 1.0.x branches. Reviewed-by: Richard Levitte

Add documentation for EVP_EncodeInit() and similar functions

2016-05-03T10:50:13Z

Reviewed-by: Richard Levitte

Ensure EVP_EncodeUpdate handles an output length that is too long

2016-05-03T10:49:12Z

With the EVP_EncodeUpdate function it is the caller's responsibility to determine how big the output buffer should be. The function writes the amount actually used to |*outl|. However this could go negative with a sufficiently large value for |inl|. We add a check for this error condition. Reviewed-by: Richard Levitte

Avoid overflow in EVP_EncodeUpdate

2016-05-03T10:48:28Z

An overflow can occur in the EVP_EncodeUpdate function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption. Due to the very large amounts of data involved this will most likely result in a crash. Internally to OpenSSL the EVP_EncodeUpdate function is primarly used by the PEM_write_bio* family of functions. These are mainly used within the OpenSSL command line applications, so any application which processes data from an untrusted source and outputs it as a PEM file should be considered vulnerable to this issue. User applications that call these APIs directly with large amounts of untrusted data may also be vulnerable. Issue reported by Guido Vranken. CVE-2016-2105 Reviewed-by: Richard Levitte

Prevent EBCDIC overread for very long strings

2016-05-03T09:25:05Z

ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer. Issue reported by Guido Vranken. CVE-2016-2176 Reviewed-by: Andy Polyakov