openssl/crypto/objects/obj_dat.c, branch openssl-3.3.1

Copyright year updates

2024-03-20T12:07:54Z

Reviewed-by: Neil Horman Release: yes

Fix arithmetic expression overflow

2024-01-15T09:49:25Z

If the value of a->length is large (>= 2^12), then an integer overflow will occur for the signed type, which according to the C standard is UB. CLA: trivial Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23274)

Check ASN1_OBJECT_new result

2024-01-15T09:43:44Z

CLA: trivial Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23270)

ensure that ossl_obj_nid_lock is allocated before use

2023-10-18T14:52:45Z

external calls to OBJ_new_nid will fail on an attempt to lock the ossl_obj_nid_lock as it won't have been initalized yet. Bifurcate OBJ_new_nid into an external and internal variant, in which the former calls ossl_obj_write_lock (ensuring that the nid_lock is initalized), while OBJ_create (the sole internal caller) uses the latter to avoid having to drop and re-acquire the lock Fixes #22337 Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/22350)

fix: LINEAR search doesn't work properly (if CHARSET_EBCDIC is defined)

2023-10-18T14:39:34Z

CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/22108)

Copyright year updates

2023-09-07T08:59:15Z

Reviewed-by: Richard Levitte Release: yes

no_autoload: make the no-autoload-config option work again.

2023-08-04T01:57:27Z

Reviewed-by: Matt Caswell Reviewed-by: Shane Lontis (Merged from https://github.com/openssl/openssl/pull/21621)

Restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt will translate

2023-06-06T08:48:50Z

OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical numeric text form. For gigantic sub-identifiers, this would take a very long time, the time complexity being O(n^2) where n is the size of that sub-identifier. To mitigate this, a restriction on the size that OBJ_obj2txt() will translate to canonical numeric text form is added, based on RFC 2578 (STD 58), which says this: > 3.5. OBJECT IDENTIFIER values > > An OBJECT IDENTIFIER value is an ordered list of non-negative numbers. > For the SMIv2, each number in the list is referred to as a sub-identifier, > there are at most 128 sub-identifiers in a value, and each sub-identifier > has a maximum value of 2^32-1 (4294967295 decimal). Fixes otc/security#96 Fixes CVE-2023-2650 Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz

Don't call OPENSSL_init_crypto from inside a RUN_ONCE

2023-04-04T07:36:42Z

Calling OPENSSL_init_crypto from inside a RUN_ONCE seems like a bad idea. This is especially bad if OPENSSL_init_crypto can recursively end up attempting to call the RUN_ONCE that we're already inside. The initialisation in OPENSSL_init_crypto is already "run once" protected. There is no need to protect it "twice". Fixes #20653 Reviewed-by: Paul Dale Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/20662) (cherry picked from commit a9745427cd5d44a76b31690b4a2c6bef2ee677c4)

OBJ_nid2obj(): Return UNDEF object instead of NULL for NID_undef

2023-03-23T14:33:47Z

Fixes a regression from 3.0 from the obj creation refactoring. Fixes #20555 Reviewed-by: Richard Levitte Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/20556)