openssl/crypto, branch OpenSSL_1_0_2m

Prepare for 1.0.2m release

2017-11-02T14:33:44Z

Reviewed-by: Andy Polyakov

make update

2017-11-02T14:33:44Z

Reviewed-by: Andy Polyakov

bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqrx8x_internal.

2017-11-02T11:06:40Z

Credit to OSS-Fuzz for finding this. CVE-2017-3736 Reviewed-by: Rich Salz

Address a timing side channel whereby it is possible to determine some

2017-11-01T16:43:06Z

information about the length of the scalar used in ECDSA operations from a large number (2^32) of signatures. Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for reporting this issue. Refer to #4576 for further details. Reviewed-by: Andy Polyakov Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4623)

Address a timing side channel whereby it is possible to determine some

2017-11-01T16:41:59Z

information about the length of a value used in DSA operations from a large number of signatures. This doesn't rate as a CVE because: * For the non-constant time code, there are easier ways to extract more information. * For the constant time code, it requires a significant number of signatures to leak a small amount of information. Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for reporting this issue. Original commit by Paul Dale. Backported to 1.0.2 by Matt Caswell Reviewed-by: Andy Polyakov Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4642)

Use malloc/memset not calloc for WinCE portability

2017-10-26T20:34:32Z

Fixes: #2539 Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/4594)

Don't use strcasecmp and strncasecmp for IA5 strings

2017-10-26T13:57:01Z

The functions strcasecmp() and strncasecmp() will use locale specific rules when performing comparison. This could cause some problems in certain locales. For example in the Turkish locale an 'I' character is not the uppercase version of 'i'. However IA5 strings should not use locale specific rules, i.e. for an IA5 string 'I' is uppercase 'i' even if using the Turkish locale. This fixes a bug in name constraints checking reported by Thomas Pornin (NCCGroup). This is not considered a security issue because it would require both a Turkish locale (or other locale with similar issues) and malfeasance by a trusted name-constrained CA for a certificate to pass name constraints in error. The constraints also have to be for excluded sub-trees which are extremely rare. Failure to match permitted subtrees is a bug, not a vulnerability. Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/4570)

Don't make any changes to the lhash structure if we are going to fail

2017-10-25T10:12:05Z

The lhash expand() function can fail if realloc fails. The previous implementation made changes to the structure and then attempted to do a realloc. If the realloc failed then it attempted to undo the changes it had just made. Unfortunately changes to lh->p were not undone correctly, ultimately causing subsequent expand() calls to increment num_nodes to a value higher than num_alloc_nodes, which can cause out-of-bounds reads/ writes. This is not considered a security issue because an attacker cannot cause realloc to fail. This commit moves the realloc call to near the beginning of the function before any other changes are made to the lhash structure. That way if a failure occurs we can immediately fail without having to undo anything. Thanks to Pavel Kopyl (Samsung) for reporting this issue. Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/4551)

asn1_item_embed_new(): don't free an embedded item

2017-10-24T11:42:41Z

The previous change with this intention didn't quite do it. An embedded item must not be freed itself, but might potentially contain non-embedded elements, which must be freed. So instead of calling ASN1_item_ex_free(), where we can't pass the combine flag, we call asn1_item_embed_free() directly. This changes asn1_item_embed_free() from being a static function to being a private non-static function. Reviewed-by: Rich Salz Reviewed-by: Bernd Edlinger (Merged from https://github.com/openssl/openssl/pull/4578)

Fix memory leak in GENERAL_NAME_set0_othername.

2017-10-24T08:40:45Z

CLA: trivial Reviewed-by: Tim Hudson Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/4544) (cherry picked from commit 04761b557a53f026630dd5916b2b8522d94579db)