Skip to content

Commit 98965b1

Browse files
RafaelGSSjuanarbol
RafaelGSS
authored and
juanarbol
committed
deps: upgrade openssl sources to 1.1.1q
This updates all sources in deps/openssl/openssl by: $ cd deps/openssl/ $ rm -rf openssl $ tar zxf ~/tmp/openssl-1.1.1q.tar.gz $ mv openssl-1.1.1q openssl $ git add --all openssl $ git commit openssl PR-URL: #43686 Refs: https://mta.openssl.org/pipermail/openssl-announce/2022-July/000232.html Reviewed-By: Beth Griggs <bgriggs@redhat.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent 48c5aa5 commit 98965b1

File tree

15 files changed

+215
-21
lines changed

15 files changed

+215
-21
lines changed

‎deps/openssl/openssl/CHANGES

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,19 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1p and 1.1.1q [5 Jul 2022]
11+
12+
*) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
13+
implementation would not encrypt the entirety of the data under some
14+
circumstances. This could reveal sixteen bytes of data that was
15+
preexisting in the memory that wasn't written. In the special case of
16+
"in place" encryption, sixteen bytes of the plaintext would be revealed.
17+
18+
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS,
19+
they are both unaffected.
20+
(CVE-2022-2097)
21+
[Alex Chernyakhovsky, David Benjamin, Alejandro Sedeño]
22+
1023
Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
1124

1225
*) In addition to the c_rehash shell command injection identified in

‎deps/openssl/openssl/NEWS

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1p and OpenSSL 1.1.1q [5 Jul 2022]
9+
10+
o Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms
11+
(CVE-2022-2097)
12+
813
Major changes between OpenSSL 1.1.1o and OpenSSL 1.1.1p [21 Jun 2022]
914

1015
o Fixed additional bugs in the c_rehash script which was not properly

‎deps/openssl/openssl/README

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.1.1p 21 Jun 2022
2+
OpenSSL 1.1.1q 5 Jul 2022
33

44
Copyright (c) 1998-2022 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/crypto/aes/asm/aesni-x86.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#! /usr/bin/env perl
2-
# Copyright 2009-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
# Copyright 2009-2022 The OpenSSL Project Authors. All Rights Reserved.
33
#
44
# Licensed under the OpenSSL license (the "License"). You may not use
55
# this file except in compliance with the License. You can obtain a copy
@@ -2027,7 +2027,7 @@ sub aesni_generate6
20272027
&movdqu (&QWP(-16*2,$out,$inp),$inout4);
20282028
&movdqu (&QWP(-16*1,$out,$inp),$inout5);
20292029
&cmp ($inp,$len); # done yet?
2030-
&jb (&label("grandloop"));
2030+
&jbe (&label("grandloop"));
20312031

20322032
&set_label("short");
20332033
&add ($len,16*6);
@@ -2453,7 +2453,7 @@ sub aesni_generate6
24532453
&pxor ($rndkey1,$inout5);
24542454
&movdqu (&QWP(-16*1,$out,$inp),$inout5);
24552455
&cmp ($inp,$len); # done yet?
2456-
&jb (&label("grandloop"));
2456+
&jbe (&label("grandloop"));
24572457

24582458
&set_label("short");
24592459
&add ($len,16*6);

‎deps/openssl/openssl/crypto/bn/bn_gcd.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -47,7 +47,8 @@ BIGNUM *bn_mod_inverse_no_branch(BIGNUM *in,
4747
if (R == NULL)
4848
goto err;
4949

50-
BN_one(X);
50+
if (!BN_one(X))
51+
goto err;
5152
BN_zero(Y);
5253
if (BN_copy(B, a) == NULL)
5354
goto err;
@@ -235,7 +236,8 @@ BIGNUM *int_bn_mod_inverse(BIGNUM *in,
235236
if (R == NULL)
236237
goto err;
237238

238-
BN_one(X);
239+
if (!BN_one(X))
240+
goto err;
239241
BN_zero(Y);
240242
if (BN_copy(B, a) == NULL)
241243
goto err;

‎deps/openssl/openssl/crypto/ec/ec_asn1.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -794,7 +794,7 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params)
794794
}
795795

796796
/* extract the order */
797-
if ((a = ASN1_INTEGER_to_BN(params->order, a)) == NULL) {
797+
if (ASN1_INTEGER_to_BN(params->order, a) == NULL) {
798798
ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, ERR_R_ASN1_LIB);
799799
goto err;
800800
}
@@ -811,7 +811,7 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params)
811811
if (params->cofactor == NULL) {
812812
BN_free(b);
813813
b = NULL;
814-
} else if ((b = ASN1_INTEGER_to_BN(params->cofactor, b)) == NULL) {
814+
} else if (ASN1_INTEGER_to_BN(params->cofactor, b) == NULL) {
815815
ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, ERR_R_ASN1_LIB);
816816
goto err;
817817
}

‎deps/openssl/openssl/crypto/x509v3/v3_addr.c

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -13,6 +13,8 @@
1313

1414
#include <stdio.h>
1515
#include <stdlib.h>
16+
#include <assert.h>
17+
#include <string.h>
1618

1719
#include "internal/cryptlib.h"
1820
#include <openssl/conf.h>
@@ -342,8 +344,13 @@ static int range_should_be_prefix(const unsigned char *min,
342344
unsigned char mask;
343345
int i, j;
344346

345-
if (memcmp(min, max, length) <= 0)
346-
return -1;
347+
/*
348+
* It is the responsibility of the caller to confirm min <= max. We don't
349+
* use ossl_assert() here since we have no way of signalling an error from
350+
* this function - so we just use a plain assert instead.
351+
*/
352+
assert(memcmp(min, max, length) <= 0);
353+
347354
for (i = 0; i < length && min[i] == max[i]; i++) ;
348355
for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--) ;
349356
if (i < j)
@@ -426,6 +433,9 @@ static int make_addressRange(IPAddressOrRange **result,
426433
IPAddressOrRange *aor;
427434
int i, prefixlen;
428435

436+
if (memcmp(min, max, length) > 0)
437+
return 0;
438+
429439
if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
430440
return make_addressPrefix(result, min, prefixlen);
431441

‎deps/openssl/openssl/crypto/x509v3/v3_sxnet.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,8 @@ static int sxnet_i2r(X509V3_EXT_METHOD *method, SXNET *sx, BIO *out,
7878
for (i = 0; i < sk_SXNETID_num(sx->ids); i++) {
7979
id = sk_SXNETID_value(sx->ids, i);
8080
tmp = i2s_ASN1_INTEGER(NULL, id->zone);
81+
if (tmp == NULL)
82+
return 0;
8183
BIO_printf(out, "\n%*sZone: %s, User: ", indent, "", tmp);
8284
OPENSSL_free(tmp);
8385
ASN1_STRING_print(out, id->user);

‎deps/openssl/openssl/doc/man3/SSL_get_current_cipher.pod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ SSL_get_pending_cipher - get SSL_CIPHER of a connection
1010

1111
#include <openssl/ssl.h>
1212

13-
SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl);
14-
SSL_CIPHER *SSL_get_pending_cipher(const SSL *ssl);
13+
const SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl);
14+
const SSL_CIPHER *SSL_get_pending_cipher(const SSL *ssl);
1515

1616
const char *SSL_get_cipher_name(const SSL *s);
1717
const char *SSL_get_cipher(const SSL *s);
@@ -61,7 +61,7 @@ L<ssl(7)>, L<SSL_CIPHER_get_name(3)>
6161

6262
=head1 COPYRIGHT
6363

64-
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
64+
Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
6565

6666
Licensed under the OpenSSL license (the "License"). You may not use
6767
this file except in compliance with the License. You can obtain a copy

‎deps/openssl/openssl/include/crypto/bn_conf.h

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)