From matt at openssl.org  Tue Jun  2 08:18:56 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 08:18:56 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433233136.454080.26941.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  cce3e4adb78a8d3eeb6e0e4efe332fcc5d75f615 (commit)
      from  f3e85f43598a1511b72c3813a71e403f19ddf458 (commit)


- Log -----------------------------------------------------------------
commit cce3e4adb78a8d3eeb6e0e4efe332fcc5d75f615
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Mar 9 16:09:04 2015 +0000

    Clear state in DTLSv1_listen
    
    This is a backport of commit e83ee04bb7de800cdb71d522fa562e99328003a3 from
    the master branch (and this has also been applied to 1.0.2). In 1.0.2 this
    was CVE-2015-0207. For other branches there is no known security issue, but
    this is being backported as a precautionary measure.
    
    The DTLSv1_listen function is intended to be stateless and processes
    the initial ClientHello from many peers. It is common for user code to
    loop over the call to DTLSv1_listen until a valid ClientHello is received
    with an associated cookie. A defect in the implementation of DTLSv1_listen
    means that state is preserved in the SSL object from one invokation to the
    next.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/d1_lib.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 94acb15..011d7b7 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -496,6 +496,9 @@ int dtls1_listen(SSL *s, struct sockaddr *client)
 {
     int ret;
 
+    /* Ensure there is no state left over from a previous invocation */
+    SSL_clear(s);
+
     SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE);
     s->d1->listen = 1;
 

From matt at openssl.org  Tue Jun  2 08:19:07 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 08:19:07 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433233147.461343.27180.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  98377858d14e6582c6dbca4a8bee8c9972ec0a7c (commit)
      from  aaa654d607f85cbab320e712377a8a345fa1158c (commit)


- Log -----------------------------------------------------------------
commit 98377858d14e6582c6dbca4a8bee8c9972ec0a7c
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Mar 9 16:09:04 2015 +0000

    Clear state in DTLSv1_listen
    
    This is a backport of commit e83ee04bb7de800cdb71d522fa562e99328003a3 from
    the master branch (and this has also been applied to 1.0.2). In 1.0.2 this
    was CVE-2015-0207. For other branches there is no known security issue, but
    this is being backported as a precautionary measure.
    
    The DTLSv1_listen function is intended to be stateless and processes
    the initial ClientHello from many peers. It is common for user code to
    loop over the call to DTLSv1_listen until a valid ClientHello is received
    with an associated cookie. A defect in the implementation of DTLSv1_listen
    means that state is preserved in the SSL object from one invokation to the
    next.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit cce3e4adb78a8d3eeb6e0e4efe332fcc5d75f615)

-----------------------------------------------------------------------

Summary of changes:
 ssl/d1_lib.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index f494e04..6e8b7d4 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -481,6 +481,9 @@ int dtls1_listen(SSL *s, struct sockaddr *client)
 {
     int ret;
 
+    /* Ensure there is no state left over from a previous invocation */
+    SSL_clear(s);
+
     SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE);
     s->d1->listen = 1;
 

From matt at openssl.org  Tue Jun  2 08:19:19 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 08:19:19 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1433233159.451256.27433.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  113d36a3fb4c157242fa995d0cdfe7e36107fba6 (commit)
      from  f16093d2d6a61ae8b14e4b337b3c33e1900791f1 (commit)


- Log -----------------------------------------------------------------
commit 113d36a3fb4c157242fa995d0cdfe7e36107fba6
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Mar 9 16:09:04 2015 +0000

    Clear state in DTLSv1_listen
    
    This is a backport of commit e83ee04bb7de800cdb71d522fa562e99328003a3 from
    the master branch (and this has also been applied to 1.0.2). In 1.0.2 this
    was CVE-2015-0207. For other branches there is no known security issue, but
    this is being backported as a precautionary measure.
    
    The DTLSv1_listen function is intended to be stateless and processes
    the initial ClientHello from many peers. It is common for user code to
    loop over the call to DTLSv1_listen until a valid ClientHello is received
    with an associated cookie. A defect in the implementation of DTLSv1_listen
    means that state is preserved in the SSL object from one invokation to the
    next.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit cce3e4adb78a8d3eeb6e0e4efe332fcc5d75f615)

-----------------------------------------------------------------------

Summary of changes:
 ssl/d1_lib.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 41daf4a..b4f5fcd 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -496,6 +496,9 @@ int dtls1_listen(SSL *s, struct sockaddr *client)
 {
     int ret;
 
+    /* Ensure there is no state left over from a previous invocation */
+    SSL_clear(s);
+
     SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE);
     s->d1->listen = 1;
 

From matt at openssl.org  Tue Jun  2 11:52:03 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 11:52:03 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433245923.796723.6537.nullmailer@dev.openssl.org>

The branch master has been updated
       via  98ece4eebfb6cd45cc8d550c6ac0022965071afc (commit)
      from  8c2b1d872b25f3ec78e04f5cd2de8f21e853c4a6 (commit)


- Log -----------------------------------------------------------------
commit 98ece4eebfb6cd45cc8d550c6ac0022965071afc
Author: Matt Caswell <matt at openssl.org>
Date:   Mon May 18 16:27:48 2015 +0100

    Fix race condition in NewSessionTicket
    
    If a NewSessionTicket is received by a multi-threaded client when
    attempting to reuse a previous ticket then a race condition can occur
    potentially leading to a double free of the ticket data.
    
    CVE-2015-1791
    
    This also fixes RT#3808 where a session ID is changed for a session already
    in the client session cache. Since the session ID is the key to the cache
    this breaks the cache access.
    
    Parts of this patch were inspired by this Akamai change:
    https://github.com/akamai/openssl/commit/c0bf69a791239ceec64509f9f19fcafb2461b0d3
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 include/openssl/ssl.h |   1 +
 ssl/s3_clnt.c         |  32 ++++++++++++++
 ssl/ssl_err.c         |   1 +
 ssl/ssl_locl.h        |   1 +
 ssl/ssl_sess.c        | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 151 insertions(+)

diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index 3e2dac6..4e18b65 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -2048,6 +2048,7 @@ void ERR_load_SSL_strings(void);
 # define SSL_F_SSL_READ                                   223
 # define SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT                320
 # define SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT                321
+# define SSL_F_SSL_SESSION_DUP                            348
 # define SSL_F_SSL_SESSION_NEW                            189
 # define SSL_F_SSL_SESSION_PRINT_FP                       190
 # define SSL_F_SSL_SESSION_SET1_ID_CONTEXT                312
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index f70dce4..d6f53b0 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2238,6 +2238,38 @@ int ssl3_get_new_session_ticket(SSL *s)
     }
 
     p = d = (unsigned char *)s->init_msg;
+
+    if (s->session->session_id_length > 0) {
+        int i = s->session_ctx->session_cache_mode;
+        SSL_SESSION *new_sess;
+        /*
+         * We reused an existing session, so we need to replace it with a new
+         * one
+         */
+        if (i & SSL_SESS_CACHE_CLIENT) {
+            /*
+             * Remove the old session from the cache
+             */
+            if (i & SSL_SESS_CACHE_NO_INTERNAL_STORE) {
+                if (s->session_ctx->remove_session_cb != NULL)
+                    s->session_ctx->remove_session_cb(s->session_ctx,
+                                                      s->session);
+            } else {
+                /* We carry on if this fails */
+                SSL_CTX_remove_session(s->session_ctx, s->session);
+            }
+        }
+
+        if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
+            al = SSL_AD_INTERNAL_ERROR;
+            SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
+            goto f_err;
+        }
+
+        SSL_SESSION_free(s->session);
+        s->session = new_sess;
+    }
+
     n2l(p, s->session->tlsext_tick_lifetime_hint);
     n2s(p, ticklen);
     /* ticket_lifetime_hint + ticket_length + ticket */
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index 86f8fa8..4b4d89c 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -274,6 +274,7 @@ static ERR_STRING_DATA SSL_str_functs[] = {
      "SSL_SCAN_CLIENTHELLO_TLSEXT"},
     {ERR_FUNC(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT),
      "SSL_SCAN_SERVERHELLO_TLSEXT"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_DUP), "ssl_session_dup"},
     {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
     {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
     {ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT),
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 9d1f80a..3252631 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -1860,6 +1860,7 @@ __owur int ssl_set_peer_cert_type(SESS_CERT *c, int type);
 __owur int ssl_get_new_session(SSL *s, int session);
 __owur int ssl_get_prev_session(SSL *s, unsigned char *session, int len,
                          const unsigned char *limit);
+__owur SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
 __owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
 DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
 __owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index f1c2095..fd94054 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -225,6 +225,122 @@ SSL_SESSION *SSL_SESSION_new(void)
     return (ss);
 }
 
+/*
+ * Create a new SSL_SESSION and duplicate the contents of |src| into it. If
+ * ticket == 0 then no ticket information is duplicated, otherwise it is.
+ */
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
+{
+    SSL_SESSION *dest;
+
+    dest = OPENSSL_malloc(sizeof(*src));
+    if (dest == NULL) {
+        goto err;
+    }
+    memcpy(dest, src, sizeof(*dest));
+
+#ifndef OPENSSL_NO_PSK
+    if (src->psk_identity_hint) {
+        dest->psk_identity_hint = BUF_strdup(src->psk_identity_hint);
+        if (dest->psk_identity_hint == NULL) {
+            goto err;
+        }
+    } else {
+        dest->psk_identity_hint = NULL;
+    }
+    if (src->psk_identity) {
+        dest->psk_identity = BUF_strdup(src->psk_identity);
+        if (dest->psk_identity == NULL) {
+            goto err;
+        }
+    } else {
+        dest->psk_identity = NULL;
+    }
+#endif
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
+
+    dest->references = 1;
+
+    if(src->ciphers != NULL) {
+        dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
+        if (dest->ciphers == NULL)
+            goto err;
+    } else {
+        dest->ciphers = NULL;
+    }
+
+    if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
+                                            &dest->ex_data, &src->ex_data)) {
+        goto err;
+    }
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+#ifndef OPENSSL_NO_TLSEXT
+    if (src->tlsext_hostname) {
+        dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
+        if (dest->tlsext_hostname == NULL) {
+            goto err;
+        }
+    } else {
+        dest->tlsext_hostname = NULL;
+    }
+# ifndef OPENSSL_NO_EC
+    if (src->tlsext_ecpointformatlist) {
+        dest->tlsext_ecpointformatlist =
+            BUF_memdup(src->tlsext_ecpointformatlist,
+                       src->tlsext_ecpointformatlist_length);
+        if (dest->tlsext_ecpointformatlist == NULL)
+            goto err;
+        dest->tlsext_ecpointformatlist_length =
+            src->tlsext_ecpointformatlist_length;
+    }
+    if (src->tlsext_ellipticcurvelist) {
+        dest->tlsext_ellipticcurvelist =
+            BUF_memdup(src->tlsext_ellipticcurvelist,
+                       src->tlsext_ellipticcurvelist_length);
+        if (dest->tlsext_ellipticcurvelist == NULL)
+            goto err;
+        dest->tlsext_ellipticcurvelist_length =
+            src->tlsext_ellipticcurvelist_length;
+    }
+# endif
+#endif
+
+    if (ticket != 0) {
+        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
+        dest->tlsext_ticklen = src->tlsext_ticklen;
+        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+            goto err;
+        }
+    }
+
+#ifndef OPENSSL_NO_SRP
+    dest->srp_username = NULL;
+    if (src->srp_username) {
+        dest->srp_username = BUF_strdup(src->srp_username);
+        if (dest->srp_username == NULL) {
+            goto err;
+        }
+    } else {
+        dest->srp_username = NULL;
+    }
+#endif
+
+    return dest;
+err:
+    SSLerr(SSL_F_SSL_SESSION_DUP, ERR_R_MALLOC_FAILURE);
+    SSL_SESSION_free(dest);
+    return NULL;
+}
+
 const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,
                                         unsigned int *len)
 {

From matt at openssl.org  Tue Jun  2 11:52:14 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 11:52:14 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433245934.626206.7360.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  27c76b9b8010b536687318739c6f631ce4194688 (commit)
      from  8744ba5e4260ccb47daae3c45bb8e7b5bac42cd3 (commit)


- Log -----------------------------------------------------------------
commit 27c76b9b8010b536687318739c6f631ce4194688
Author: Matt Caswell <matt at openssl.org>
Date:   Mon May 18 16:27:48 2015 +0100

    Fix race condition in NewSessionTicket
    
    If a NewSessionTicket is received by a multi-threaded client when
    attempting to reuse a previous ticket then a race condition can occur
    potentially leading to a double free of the ticket data.
    
    CVE-2015-1791
    
    This also fixes RT#3808 where a session ID is changed for a session already
    in the client session cache. Since the session ID is the key to the cache
    this breaks the cache access.
    
    Parts of this patch were inspired by this Akamai change:
    https://github.com/akamai/openssl/commit/c0bf69a791239ceec64509f9f19fcafb2461b0d3
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c  |  32 +++++++++++++++
 ssl/ssl.h      |   1 +
 ssl/ssl_err.c  |   1 +
 ssl/ssl_locl.h |   1 +
 ssl/ssl_sess.c | 123 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 158 insertions(+)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 98c7b9e..feb1e3b 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2229,6 +2229,38 @@ int ssl3_get_new_session_ticket(SSL *s)
     }
 
     p = d = (unsigned char *)s->init_msg;
+
+    if (s->session->session_id_length > 0) {
+        int i = s->session_ctx->session_cache_mode;
+        SSL_SESSION *new_sess;
+        /*
+         * We reused an existing session, so we need to replace it with a new
+         * one
+         */
+        if (i & SSL_SESS_CACHE_CLIENT) {
+            /*
+             * Remove the old session from the cache
+             */
+            if (i & SSL_SESS_CACHE_NO_INTERNAL_STORE) {
+                if (s->session_ctx->remove_session_cb != NULL)
+                    s->session_ctx->remove_session_cb(s->session_ctx,
+                                                      s->session);
+            } else {
+                /* We carry on if this fails */
+                SSL_CTX_remove_session(s->session_ctx, s->session);
+            }
+        }
+
+        if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
+            al = SSL_AD_INTERNAL_ERROR;
+            SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
+            goto f_err;
+        }
+
+        SSL_SESSION_free(s->session);
+        s->session = new_sess;
+    }
+
     n2l(p, s->session->tlsext_tick_lifetime_hint);
     n2s(p, ticklen);
     /* ticket_lifetime_hint + ticket_length + ticket */
diff --git a/ssl/ssl.h b/ssl/ssl.h
index 8eb852a..6fe1a24 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -2787,6 +2787,7 @@ void ERR_load_SSL_strings(void);
 # define SSL_F_SSL_RSA_PUBLIC_ENCRYPT                     188
 # define SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT                320
 # define SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT                321
+# define SSL_F_SSL_SESSION_DUP                            348
 # define SSL_F_SSL_SESSION_NEW                            189
 # define SSL_F_SSL_SESSION_PRINT_FP                       190
 # define SSL_F_SSL_SESSION_SET1_ID_CONTEXT                312
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index fc0fb8f..1a6030e 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -312,6 +312,7 @@ static ERR_STRING_DATA SSL_str_functs[] = {
      "SSL_SCAN_CLIENTHELLO_TLSEXT"},
     {ERR_FUNC(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT),
      "SSL_SCAN_SERVERHELLO_TLSEXT"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_DUP), "ssl_session_dup"},
     {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
     {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
     {ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT),
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index fb65fed..6c2c551 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -1058,6 +1058,7 @@ int ssl_set_peer_cert_type(SESS_CERT *c, int type);
 int ssl_get_new_session(SSL *s, int session);
 int ssl_get_prev_session(SSL *s, unsigned char *session, int len,
                          const unsigned char *limit);
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
 DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 8b9945b..ca5d2d6 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -227,6 +227,129 @@ SSL_SESSION *SSL_SESSION_new(void)
     return (ss);
 }
 
+/*
+ * Create a new SSL_SESSION and duplicate the contents of |src| into it. If
+ * ticket == 0 then no ticket information is duplicated, otherwise it is.
+ */
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
+{
+    SSL_SESSION *dest;
+
+    dest = OPENSSL_malloc(sizeof(*src));
+    if (dest == NULL) {
+        goto err;
+    }
+    memcpy(dest, src, sizeof(*dest));
+
+#ifndef OPENSSL_NO_KRB5
+    dest->krb5_client_princ_len = dest->krb5_client_princ_len;
+    if (src->krb5_client_princ_len > 0)
+        memcpy(dest->krb5_client_princ, src->krb5_client_princ,
+               src->krb5_client_princ_len);
+#endif
+
+#ifndef OPENSSL_NO_PSK
+    if (src->psk_identity_hint) {
+        dest->psk_identity_hint = BUF_strdup(src->psk_identity_hint);
+        if (dest->psk_identity_hint == NULL) {
+            goto err;
+        }
+    } else {
+        dest->psk_identity_hint = NULL;
+    }
+    if (src->psk_identity) {
+        dest->psk_identity = BUF_strdup(src->psk_identity);
+        if (dest->psk_identity == NULL) {
+            goto err;
+        }
+    } else {
+        dest->psk_identity = NULL;
+    }
+#endif
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
+
+    dest->references = 1;
+
+    if(src->ciphers != NULL) {
+        dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
+        if (dest->ciphers == NULL)
+            goto err;
+    } else {
+        dest->ciphers = NULL;
+    }
+
+    if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
+                                            &dest->ex_data, &src->ex_data)) {
+        goto err;
+    }
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+#ifndef OPENSSL_NO_TLSEXT
+    if (src->tlsext_hostname) {
+        dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
+        if (dest->tlsext_hostname == NULL) {
+            goto err;
+        }
+    } else {
+        dest->tlsext_hostname = NULL;
+    }
+# ifndef OPENSSL_NO_EC
+    if (src->tlsext_ecpointformatlist) {
+        dest->tlsext_ecpointformatlist =
+            BUF_memdup(src->tlsext_ecpointformatlist,
+                       src->tlsext_ecpointformatlist_length);
+        if (dest->tlsext_ecpointformatlist == NULL)
+            goto err;
+        dest->tlsext_ecpointformatlist_length =
+            src->tlsext_ecpointformatlist_length;
+    }
+    if (src->tlsext_ellipticcurvelist) {
+        dest->tlsext_ellipticcurvelist =
+            BUF_memdup(src->tlsext_ellipticcurvelist,
+                       src->tlsext_ellipticcurvelist_length);
+        if (dest->tlsext_ellipticcurvelist == NULL)
+            goto err;
+        dest->tlsext_ellipticcurvelist_length =
+            src->tlsext_ellipticcurvelist_length;
+    }
+# endif
+#endif
+
+    if (ticket != 0) {
+        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
+        dest->tlsext_ticklen = src->tlsext_ticklen;
+        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+            goto err;
+        }
+    }
+
+#ifndef OPENSSL_NO_SRP
+    dest->srp_username = NULL;
+    if (src->srp_username) {
+        dest->srp_username = BUF_strdup(src->srp_username);
+        if (dest->srp_username == NULL) {
+            goto err;
+        }
+    } else {
+        dest->srp_username = NULL;
+    }
+#endif
+
+    return dest;
+err:
+    SSLerr(SSL_F_SSL_SESSION_DUP, ERR_R_MALLOC_FAILURE);
+    SSL_SESSION_free(dest);
+    return NULL;
+}
+
 const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,
                                         unsigned int *len)
 {

From matt at openssl.org  Tue Jun  2 11:52:26 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 11:52:26 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433245946.375899.7659.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  939b4960276b040fc0ed52232238fcc9e2e9ec21 (commit)
      from  cce3e4adb78a8d3eeb6e0e4efe332fcc5d75f615 (commit)


- Log -----------------------------------------------------------------
commit 939b4960276b040fc0ed52232238fcc9e2e9ec21
Author: Matt Caswell <matt at openssl.org>
Date:   Mon May 18 16:27:48 2015 +0100

    Fix race condition in NewSessionTicket
    
    If a NewSessionTicket is received by a multi-threaded client when
    attempting to reuse a previous ticket then a race condition can occur
    potentially leading to a double free of the ticket data.
    
    CVE-2015-1791
    
    This also fixes RT#3808 where a session ID is changed for a session already
    in the client session cache. Since the session ID is the key to the cache
    this breaks the cache access.
    
    Parts of this patch were inspired by this Akamai change:
    https://github.com/akamai/openssl/commit/c0bf69a791239ceec64509f9f19fcafb2461b0d3
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 27c76b9b8010b536687318739c6f631ce4194688)
    
    Conflicts:
    	ssl/ssl.h
    	ssl/ssl_err.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c  |  32 +++++++++++++++
 ssl/ssl.h      |   1 +
 ssl/ssl_err.c  |   1 +
 ssl/ssl_locl.h |   1 +
 ssl/ssl_sess.c | 123 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 158 insertions(+)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 012905b..eb7b94e 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2139,6 +2139,38 @@ int ssl3_get_new_session_ticket(SSL *s)
     }
 
     p = d = (unsigned char *)s->init_msg;
+
+    if (s->session->session_id_length > 0) {
+        int i = s->session_ctx->session_cache_mode;
+        SSL_SESSION *new_sess;
+        /*
+         * We reused an existing session, so we need to replace it with a new
+         * one
+         */
+        if (i & SSL_SESS_CACHE_CLIENT) {
+            /*
+             * Remove the old session from the cache
+             */
+            if (i & SSL_SESS_CACHE_NO_INTERNAL_STORE) {
+                if (s->session_ctx->remove_session_cb != NULL)
+                    s->session_ctx->remove_session_cb(s->session_ctx,
+                                                      s->session);
+            } else {
+                /* We carry on if this fails */
+                SSL_CTX_remove_session(s->session_ctx, s->session);
+            }
+        }
+
+        if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
+            al = SSL_AD_INTERNAL_ERROR;
+            SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
+            goto f_err;
+        }
+
+        SSL_SESSION_free(s->session);
+        s->session = new_sess;
+    }
+
     n2l(p, s->session->tlsext_tick_lifetime_hint);
     n2s(p, ticklen);
     /* ticket_lifetime_hint + ticket_length + ticket */
diff --git a/ssl/ssl.h b/ssl/ssl.h
index 32e27c6..d2ab0c0 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -2410,6 +2410,7 @@ void ERR_load_SSL_strings(void);
 # define SSL_F_SSL_READ                                   223
 # define SSL_F_SSL_RSA_PRIVATE_DECRYPT                    187
 # define SSL_F_SSL_RSA_PUBLIC_ENCRYPT                     188
+# define SSL_F_SSL_SESSION_DUP                            348
 # define SSL_F_SSL_SESSION_NEW                            189
 # define SSL_F_SSL_SESSION_PRINT_FP                       190
 # define SSL_F_SSL_SESSION_SET1_ID_CONTEXT                312
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index fef324d..88621b7 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -299,6 +299,7 @@ static ERR_STRING_DATA SSL_str_functs[] = {
     {ERR_FUNC(SSL_F_SSL_READ), "SSL_read"},
     {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"},
     {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_DUP), "ssl_session_dup"},
     {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
     {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
     {ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT),
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index aff3b65..a7f3f8d 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -865,6 +865,7 @@ int ssl_set_peer_cert_type(SESS_CERT *c, int type);
 int ssl_get_new_session(SSL *s, int session);
 int ssl_get_prev_session(SSL *s, unsigned char *session, int len,
                          const unsigned char *limit);
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
 DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index eb7936b..e673f9c 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -227,6 +227,129 @@ SSL_SESSION *SSL_SESSION_new(void)
     return (ss);
 }
 
+/*
+ * Create a new SSL_SESSION and duplicate the contents of |src| into it. If
+ * ticket == 0 then no ticket information is duplicated, otherwise it is.
+ */
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
+{
+    SSL_SESSION *dest;
+
+    dest = OPENSSL_malloc(sizeof(*src));
+    if (dest == NULL) {
+        goto err;
+    }
+    memcpy(dest, src, sizeof(*dest));
+
+#ifndef OPENSSL_NO_KRB5
+    dest->krb5_client_princ_len = dest->krb5_client_princ_len;
+    if (src->krb5_client_princ_len > 0)
+        memcpy(dest->krb5_client_princ, src->krb5_client_princ,
+               src->krb5_client_princ_len);
+#endif
+
+#ifndef OPENSSL_NO_PSK
+    if (src->psk_identity_hint) {
+        dest->psk_identity_hint = BUF_strdup(src->psk_identity_hint);
+        if (dest->psk_identity_hint == NULL) {
+            goto err;
+        }
+    } else {
+        dest->psk_identity_hint = NULL;
+    }
+    if (src->psk_identity) {
+        dest->psk_identity = BUF_strdup(src->psk_identity);
+        if (dest->psk_identity == NULL) {
+            goto err;
+        }
+    } else {
+        dest->psk_identity = NULL;
+    }
+#endif
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
+
+    dest->references = 1;
+
+    if(src->ciphers != NULL) {
+        dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
+        if (dest->ciphers == NULL)
+            goto err;
+    } else {
+        dest->ciphers = NULL;
+    }
+
+    if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
+                                            &dest->ex_data, &src->ex_data)) {
+        goto err;
+    }
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+#ifndef OPENSSL_NO_TLSEXT
+    if (src->tlsext_hostname) {
+        dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
+        if (dest->tlsext_hostname == NULL) {
+            goto err;
+        }
+    } else {
+        dest->tlsext_hostname = NULL;
+    }
+# ifndef OPENSSL_NO_EC
+    if (src->tlsext_ecpointformatlist) {
+        dest->tlsext_ecpointformatlist =
+            BUF_memdup(src->tlsext_ecpointformatlist,
+                       src->tlsext_ecpointformatlist_length);
+        if (dest->tlsext_ecpointformatlist == NULL)
+            goto err;
+        dest->tlsext_ecpointformatlist_length =
+            src->tlsext_ecpointformatlist_length;
+    }
+    if (src->tlsext_ellipticcurvelist) {
+        dest->tlsext_ellipticcurvelist =
+            BUF_memdup(src->tlsext_ellipticcurvelist,
+                       src->tlsext_ellipticcurvelist_length);
+        if (dest->tlsext_ellipticcurvelist == NULL)
+            goto err;
+        dest->tlsext_ellipticcurvelist_length =
+            src->tlsext_ellipticcurvelist_length;
+    }
+# endif
+#endif
+
+    if (ticket != 0) {
+        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
+        dest->tlsext_ticklen = src->tlsext_ticklen;
+        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+            goto err;
+        }
+    }
+
+#ifndef OPENSSL_NO_SRP
+    dest->srp_username = NULL;
+    if (src->srp_username) {
+        dest->srp_username = BUF_strdup(src->srp_username);
+        if (dest->srp_username == NULL) {
+            goto err;
+        }
+    } else {
+        dest->srp_username = NULL;
+    }
+#endif
+
+    return dest;
+err:
+    SSLerr(SSL_F_SSL_SESSION_DUP, ERR_R_MALLOC_FAILURE);
+    SSL_SESSION_free(dest);
+    return NULL;
+}
+
 const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,
                                         unsigned int *len)
 {

From matt at openssl.org  Tue Jun  2 11:52:42 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 11:52:42 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433245962.194854.7950.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  0ae3473e8578b547100389bd029873af0cd9a22e (commit)
      from  98377858d14e6582c6dbca4a8bee8c9972ec0a7c (commit)


- Log -----------------------------------------------------------------
commit 0ae3473e8578b547100389bd029873af0cd9a22e
Author: Matt Caswell <matt at openssl.org>
Date:   Mon May 18 16:27:48 2015 +0100

    Fix race condition in NewSessionTicket
    
    If a NewSessionTicket is received by a multi-threaded client when
    attempting to reuse a previous ticket then a race condition can occur
    potentially leading to a double free of the ticket data.
    
    CVE-2015-1791
    
    This also fixes RT#3808 where a session ID is changed for a session already
    in the client session cache. Since the session ID is the key to the cache
    this breaks the cache access.
    
    Parts of this patch were inspired by this Akamai change:
    https://github.com/akamai/openssl/commit/c0bf69a791239ceec64509f9f19fcafb2461b0d3
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 27c76b9b8010b536687318739c6f631ce4194688)
    
    Conflicts:
    	ssl/ssl.h
    	ssl/ssl_err.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c  |  32 +++++++++++++++++
 ssl/ssl.h      |   1 +
 ssl/ssl_err.c  |   1 +
 ssl/ssl_locl.h |   1 +
 ssl/ssl_sess.c | 111 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 146 insertions(+)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index ce7269a..f906389 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1855,6 +1855,38 @@ int ssl3_get_new_session_ticket(SSL *s)
     }
 
     p = d = (unsigned char *)s->init_msg;
+
+    if (s->session->session_id_length > 0) {
+        int i = s->session_ctx->session_cache_mode;
+        SSL_SESSION *new_sess;
+        /*
+         * We reused an existing session, so we need to replace it with a new
+         * one
+         */
+        if (i & SSL_SESS_CACHE_CLIENT) {
+            /*
+             * Remove the old session from the cache
+             */
+            if (i & SSL_SESS_CACHE_NO_INTERNAL_STORE) {
+                if (s->session_ctx->remove_session_cb != NULL)
+                    s->session_ctx->remove_session_cb(s->session_ctx,
+                                                      s->session);
+            } else {
+                /* We carry on if this fails */
+                SSL_CTX_remove_session(s->session_ctx, s->session);
+            }
+        }
+
+        if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
+            al = SSL_AD_INTERNAL_ERROR;
+            SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
+            goto f_err;
+        }
+
+        SSL_SESSION_free(s->session);
+        s->session = new_sess;
+    }
+
     n2l(p, s->session->tlsext_tick_lifetime_hint);
     n2s(p, ticklen);
     /* ticket_lifetime_hint + ticket_length + ticket */
diff --git a/ssl/ssl.h b/ssl/ssl.h
index 3f4d0ac..ca341b4 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -2144,6 +2144,7 @@ void ERR_load_SSL_strings(void);
 # define SSL_F_SSL_READ                                   223
 # define SSL_F_SSL_RSA_PRIVATE_DECRYPT                    187
 # define SSL_F_SSL_RSA_PUBLIC_ENCRYPT                     188
+# define SSL_F_SSL_SESSION_DUP                            348
 # define SSL_F_SSL_SESSION_NEW                            189
 # define SSL_F_SSL_SESSION_PRINT_FP                       190
 # define SSL_F_SSL_SESS_CERT_NEW                          225
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index f2ef076..967448f 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -287,6 +287,7 @@ static ERR_STRING_DATA SSL_str_functs[] = {
     {ERR_FUNC(SSL_F_SSL_READ), "SSL_read"},
     {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"},
     {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_DUP), "ssl_session_dup"},
     {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
     {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
     {ERR_FUNC(SSL_F_SSL_SESS_CERT_NEW), "SSL_SESS_CERT_NEW"},
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 60ad58d..da2b19b 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -831,6 +831,7 @@ int ssl_set_peer_cert_type(SESS_CERT *c, int type);
 int ssl_get_new_session(SSL *s, int session);
 int ssl_get_prev_session(SSL *s, unsigned char *session, int len,
                          const unsigned char *limit);
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
 DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index b9432fd..98b9107 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -224,6 +224,117 @@ SSL_SESSION *SSL_SESSION_new(void)
     return (ss);
 }
 
+/*
+ * Create a new SSL_SESSION and duplicate the contents of |src| into it. If
+ * ticket == 0 then no ticket information is duplicated, otherwise it is.
+ */
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
+{
+    SSL_SESSION *dest;
+
+    dest = OPENSSL_malloc(sizeof(*src));
+    if (dest == NULL) {
+        goto err;
+    }
+    memcpy(dest, src, sizeof(*dest));
+
+#ifndef OPENSSL_NO_KRB5
+    dest->krb5_client_princ_len = dest->krb5_client_princ_len;
+    if (src->krb5_client_princ_len > 0)
+        memcpy(dest->krb5_client_princ, src->krb5_client_princ,
+               src->krb5_client_princ_len);
+#endif
+
+#ifndef OPENSSL_NO_PSK
+    if (src->psk_identity_hint) {
+        dest->psk_identity_hint = BUF_strdup(src->psk_identity_hint);
+        if (dest->psk_identity_hint == NULL) {
+            goto err;
+        }
+    } else {
+        dest->psk_identity_hint = NULL;
+    }
+    if (src->psk_identity) {
+        dest->psk_identity = BUF_strdup(src->psk_identity);
+        if (dest->psk_identity == NULL) {
+            goto err;
+        }
+    } else {
+        dest->psk_identity = NULL;
+    }
+#endif
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
+
+    dest->references = 1;
+
+    if(src->ciphers != NULL) {
+        dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
+        if (dest->ciphers == NULL)
+            goto err;
+    } else {
+        dest->ciphers = NULL;
+    }
+
+    if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
+                                            &dest->ex_data, &src->ex_data)) {
+        goto err;
+    }
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+#ifndef OPENSSL_NO_TLSEXT
+    if (src->tlsext_hostname) {
+        dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
+        if (dest->tlsext_hostname == NULL) {
+            goto err;
+        }
+    } else {
+        dest->tlsext_hostname = NULL;
+    }
+# ifndef OPENSSL_NO_EC
+    if (src->tlsext_ecpointformatlist) {
+        dest->tlsext_ecpointformatlist =
+            BUF_memdup(src->tlsext_ecpointformatlist,
+                       src->tlsext_ecpointformatlist_length);
+        if (dest->tlsext_ecpointformatlist == NULL)
+            goto err;
+        dest->tlsext_ecpointformatlist_length =
+            src->tlsext_ecpointformatlist_length;
+    }
+    if (src->tlsext_ellipticcurvelist) {
+        dest->tlsext_ellipticcurvelist =
+            BUF_memdup(src->tlsext_ellipticcurvelist,
+                       src->tlsext_ellipticcurvelist_length);
+        if (dest->tlsext_ellipticcurvelist == NULL)
+            goto err;
+        dest->tlsext_ellipticcurvelist_length =
+            src->tlsext_ellipticcurvelist_length;
+    }
+# endif
+#endif
+
+    if (ticket != 0) {
+        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
+        dest->tlsext_ticklen = src->tlsext_ticklen;
+        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+            goto err;
+        }
+    }
+
+    return dest;
+err:
+    SSLerr(SSL_F_SSL_SESSION_DUP, ERR_R_MALLOC_FAILURE);
+    SSL_SESSION_free(dest);
+    return NULL;
+}
+
 const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,
                                         unsigned int *len)
 {

From matt at openssl.org  Tue Jun  2 11:52:53 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 11:52:53 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1433245973.110235.8191.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  467daf6b6ef0753ccfc5c024c2f63c948354d698 (commit)
      from  113d36a3fb4c157242fa995d0cdfe7e36107fba6 (commit)


- Log -----------------------------------------------------------------
commit 467daf6b6ef0753ccfc5c024c2f63c948354d698
Author: Matt Caswell <matt at openssl.org>
Date:   Mon May 18 16:27:48 2015 +0100

    Fix race condition in NewSessionTicket
    
    If a NewSessionTicket is received by a multi-threaded client when
    attempting to reuse a previous ticket then a race condition can occur
    potentially leading to a double free of the ticket data.
    
    CVE-2015-1791
    
    This also fixes RT#3808 where a session ID is changed for a session already
    in the client session cache. Since the session ID is the key to the cache
    this breaks the cache access.
    
    Parts of this patch were inspired by this Akamai change:
    https://github.com/akamai/openssl/commit/c0bf69a791239ceec64509f9f19fcafb2461b0d3
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 27c76b9b8010b536687318739c6f631ce4194688)
    
    Conflicts:
    	ssl/ssl.h
    	ssl/ssl_err.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c  | 32 ++++++++++++++++++++++++++
 ssl/ssl.h      |  1 +
 ssl/ssl_err.c  |  1 +
 ssl/ssl_locl.h |  1 +
 ssl/ssl_sess.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 107 insertions(+)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 118856f..8d035f7 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1722,6 +1722,38 @@ int ssl3_get_new_session_ticket(SSL *s)
     }
 
     p = d = (unsigned char *)s->init_msg;
+
+    if (s->session->session_id_length > 0) {
+        int i = s->session_ctx->session_cache_mode;
+        SSL_SESSION *new_sess;
+        /*
+         * We reused an existing session, so we need to replace it with a new
+         * one
+         */
+        if (i & SSL_SESS_CACHE_CLIENT) {
+            /*
+             * Remove the old session from the cache
+             */
+            if (i & SSL_SESS_CACHE_NO_INTERNAL_STORE) {
+                if (s->session_ctx->remove_session_cb != NULL)
+                    s->session_ctx->remove_session_cb(s->session_ctx,
+                                                      s->session);
+            } else {
+                /* We carry on if this fails */
+                SSL_CTX_remove_session(s->session_ctx, s->session);
+            }
+        }
+
+        if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
+            al = SSL_AD_INTERNAL_ERROR;
+            SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
+            goto f_err;
+        }
+
+        SSL_SESSION_free(s->session);
+        s->session = new_sess;
+    }
+
     n2l(p, s->session->tlsext_tick_lifetime_hint);
     n2s(p, ticklen);
     /* ticket_lifetime_hint + ticket_length + ticket */
diff --git a/ssl/ssl.h b/ssl/ssl.h
index ee9944f..2dcc3b8 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -1945,6 +1945,7 @@ void ERR_load_SSL_strings(void);
 # define SSL_F_SSL_READ                                   223
 # define SSL_F_SSL_RSA_PRIVATE_DECRYPT                    187
 # define SSL_F_SSL_RSA_PUBLIC_ENCRYPT                     188
+# define SSL_F_SSL_SESSION_DUP                            348
 # define SSL_F_SSL_SESSION_NEW                            189
 # define SSL_F_SSL_SESSION_PRINT_FP                       190
 # define SSL_F_SSL_SESS_CERT_NEW                          225
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index c874591..65c8f61 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -279,6 +279,7 @@ static ERR_STRING_DATA SSL_str_functs[] = {
     {ERR_FUNC(SSL_F_SSL_READ), "SSL_read"},
     {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"},
     {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_DUP), "ssl_session_dup"},
     {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
     {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
     {ERR_FUNC(SSL_F_SSL_SESS_CERT_NEW), "SSL_SESS_CERT_NEW"},
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 9fa209d..038554f 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -760,6 +760,7 @@ int ssl_set_peer_cert_type(SESS_CERT *c, int type);
 int ssl_get_new_session(SSL *s, int session);
 int ssl_get_prev_session(SSL *s, unsigned char *session, int len,
                          const unsigned char *limit);
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
                           const SSL_CIPHER *const *bp);
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index fc31296..9baa090 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -135,6 +135,78 @@ SSL_SESSION *SSL_SESSION_new(void)
     return (ss);
 }
 
+/*
+ * Create a new SSL_SESSION and duplicate the contents of |src| into it. If
+ * ticket == 0 then no ticket information is duplicated, otherwise it is.
+ */
+SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
+{
+    SSL_SESSION *dest;
+
+    dest = OPENSSL_malloc(sizeof(*src));
+    if (dest == NULL) {
+        goto err;
+    }
+    memcpy(dest, src, sizeof(*dest));
+
+#ifndef OPENSSL_NO_KRB5
+    dest->krb5_client_princ_len = dest->krb5_client_princ_len;
+    if (src->krb5_client_princ_len > 0)
+        memcpy(dest->krb5_client_princ, src->krb5_client_princ,
+               src->krb5_client_princ_len);
+#endif
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
+
+    dest->references = 1;
+
+    if(src->ciphers != NULL) {
+        dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
+        if (dest->ciphers == NULL)
+            goto err;
+    } else {
+        dest->ciphers = NULL;
+    }
+
+    if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
+                                            &dest->ex_data, &src->ex_data)) {
+        goto err;
+    }
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+#ifndef OPENSSL_NO_TLSEXT
+    if (src->tlsext_hostname) {
+        dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
+        if (dest->tlsext_hostname == NULL) {
+            goto err;
+        }
+    } else {
+        dest->tlsext_hostname = NULL;
+    }
+#endif
+
+    if (ticket != 0) {
+        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
+        dest->tlsext_ticklen = src->tlsext_ticklen;
+        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+            goto err;
+        }
+    }
+
+    return dest;
+err:
+    SSLerr(SSL_F_SSL_SESSION_DUP, ERR_R_MALLOC_FAILURE);
+    SSL_SESSION_free(dest);
+    return NULL;
+}
+
 const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,
                                         unsigned int *len)
 {

From matt at openssl.org  Tue Jun  2 12:01:20 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 12:01:20 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433246480.938848.10867.nullmailer@dev.openssl.org>

The branch master has been updated
       via  0baaff1a76d4c91b9c1121059be63175454d7b03 (commit)
      from  98ece4eebfb6cd45cc8d550c6ac0022965071afc (commit)


- Log -----------------------------------------------------------------
commit 0baaff1a76d4c91b9c1121059be63175454d7b03
Author: Per Allansson <per.allansson at cryptzone.com>
Date:   Tue Jun 2 09:38:28 2015 +0100

    Fix IP_MTU_DISCOVER typo
    
    The code in bss_dgram.c checks if IP_MTUDISCOVER is defined, where it
    should test for IP_MTU_DISCOVER
    
    RT#3888
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bss_dgram.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c
index 5eade50..7cd57bf 100644
--- a/crypto/bio/bss_dgram.c
+++ b/crypto/bio/bss_dgram.c
@@ -882,7 +882,7 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
                 perror("setsockopt");
                 ret = -1;
             }
-# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTUDISCOVER)
+# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER)
             if ((sockopt_val = num ? IP_PMTUDISC_PROBE : IP_PMTUDISC_DONT),
                 (ret = setsockopt(b->num, IPPROTO_IP, IP_MTU_DISCOVER,
                                   &sockopt_val, sizeof(sockopt_val))) < 0) {

From matt at openssl.org  Tue Jun  2 12:01:40 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 12:01:40 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433246500.664919.11570.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  188f3f976764f2b0d486448a5054ea711f9b8abe (commit)
      from  27c76b9b8010b536687318739c6f631ce4194688 (commit)


- Log -----------------------------------------------------------------
commit 188f3f976764f2b0d486448a5054ea711f9b8abe
Author: Per Allansson <per.allansson at cryptzone.com>
Date:   Tue Jun 2 09:38:28 2015 +0100

    Fix IP_MTU_DISCOVER typo
    
    The code in bss_dgram.c checks if IP_MTUDISCOVER is defined, where it
    should test for IP_MTU_DISCOVER
    
    RT#3888
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 0baaff1a76d4c91b9c1121059be63175454d7b03)

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bss_dgram.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c
index dc4479f..6493a38 100644
--- a/crypto/bio/bss_dgram.c
+++ b/crypto/bio/bss_dgram.c
@@ -897,7 +897,7 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
                 perror("setsockopt");
                 ret = -1;
             }
-# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTUDISCOVER)
+# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER)
             if ((sockopt_val = num ? IP_PMTUDISC_PROBE : IP_PMTUDISC_DONT),
                 (ret = setsockopt(b->num, IPPROTO_IP, IP_MTU_DISCOVER,
                                   &sockopt_val, sizeof(sockopt_val))) < 0) {

From rsalz at openssl.org  Tue Jun  2 15:24:55 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 15:24:55 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433258695.464549.32147.nullmailer@dev.openssl.org>

The branch master has been updated
       via  8846adbd36c1de2b0d38a73ca32e28fde50083b8 (commit)
      from  0baaff1a76d4c91b9c1121059be63175454d7b03 (commit)


- Log -----------------------------------------------------------------
commit 8846adbd36c1de2b0d38a73ca32e28fde50083b8
Author: Olaf Johansson <olof at ethup.se>
Date:   Tue Jun 2 07:41:35 2015 -0400

    GH249: Fix bad regexp in arg parsing.
    
    Signed-off-by: Rich Salz <rsalz at akamai.com>
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 tools/c_rehash.in | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/c_rehash.in b/tools/c_rehash.in
index 887e927..b086ff9 100644
--- a/tools/c_rehash.in
+++ b/tools/c_rehash.in
@@ -15,13 +15,13 @@ my $symlink_exists=eval {symlink("",""); 1};
 my $removelinks = 1;
 
 ##  Parse flags.
-while ( $ARGV[0] =~ '-.*' ) {
+while ( $ARGV[0] =~ /^-/ ) {
     my $flag = shift @ARGV;
     last if ( $flag eq '--');
-    if ( $flag =~ /-old/) {
+    if ( $flag eq '-old') {
 	    $x509hash = "-subject_hash_old";
 	    $crlhash = "-hash_old";
-    } elsif ( $flag =~ /-h/) {
+    } elsif ( $flag eq '-h') {
 	    help();
     } elsif ( $flag eq '-n' ) {
 	    $removelinks = 0;

From rsalz at openssl.org  Tue Jun  2 15:25:31 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 15:25:31 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433258731.140185.498.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  bd5b5b4c4bda92399bf2b96cf399d6fef107856e (commit)
      from  188f3f976764f2b0d486448a5054ea711f9b8abe (commit)


- Log -----------------------------------------------------------------
commit bd5b5b4c4bda92399bf2b96cf399d6fef107856e
Author: Olaf Johansson <olof at ethup.se>
Date:   Tue Jun 2 07:41:35 2015 -0400

    GH249: Fix bad regexp in arg parsing.
    
    Signed-off-by: Rich Salz <rsalz at akamai.com>
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit 8846adbd36c1de2b0d38a73ca32e28fde50083b8)

-----------------------------------------------------------------------

Summary of changes:
 tools/c_rehash.in | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/c_rehash.in b/tools/c_rehash.in
index 887e927..b086ff9 100644
--- a/tools/c_rehash.in
+++ b/tools/c_rehash.in
@@ -15,13 +15,13 @@ my $symlink_exists=eval {symlink("",""); 1};
 my $removelinks = 1;
 
 ##  Parse flags.
-while ( $ARGV[0] =~ '-.*' ) {
+while ( $ARGV[0] =~ /^-/ ) {
     my $flag = shift @ARGV;
     last if ( $flag eq '--');
-    if ( $flag =~ /-old/) {
+    if ( $flag eq '-old') {
 	    $x509hash = "-subject_hash_old";
 	    $crlhash = "-hash_old";
-    } elsif ( $flag =~ /-h/) {
+    } elsif ( $flag eq '-h') {
 	    help();
     } elsif ( $flag eq '-n' ) {
 	    $removelinks = 0;

From rsalz at openssl.org  Tue Jun  2 15:53:31 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 15:53:31 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433260411.080944.7157.nullmailer@dev.openssl.org>

The branch master has been updated
       via  45d051c82563a75b07ec54b63e3a5bbad388ab67 (commit)
      from  8846adbd36c1de2b0d38a73ca32e28fde50083b8 (commit)


- Log -----------------------------------------------------------------
commit 45d051c82563a75b07ec54b63e3a5bbad388ab67
Author: Gunnar Kudrjavets <gunnarku at exchange.microsoft.com>
Date:   Wed May 13 15:13:55 2015 -0400

    RT3848: Call SSL_COMP_free_compression_methods
    
    Signed-off-by: Rich Salz <rsalz at akamai.com>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/openssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/openssl.c b/apps/openssl.c
index e04ddce..9a152f5 100644
--- a/apps/openssl.c
+++ b/apps/openssl.c
@@ -189,6 +189,7 @@ static void apps_shutdown()
     CONF_modules_unload(1);
 #ifndef OPENSSL_NO_COMP
     COMP_zlib_cleanup();
+    SSL_COMP_free_compression_methods();
 #endif
     OBJ_cleanup();
     EVP_cleanup();

From levitte at openssl.org  Tue Jun  2 15:57:19 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 02 Jun 2015 15:57:19 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433260639.429631.8718.nullmailer@dev.openssl.org>

The branch master has been updated
       via  3f131556d6678bc3754f1e6d98a9a5bfc24e368c (commit)
      from  45d051c82563a75b07ec54b63e3a5bbad388ab67 (commit)


- Log -----------------------------------------------------------------
commit 3f131556d6678bc3754f1e6d98a9a5bfc24e368c
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun May 31 17:47:31 2015 +0200

    Add the macro OPENSSL_SYS_WIN64
    
    This is for consistency.
    Additionally, have its presence define OPENSSL_SYS_WINDOWS as well.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 include/openssl/e_os2.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/openssl/e_os2.h b/include/openssl/e_os2.h
index eef2a0b..177b098 100644
--- a/include/openssl/e_os2.h
+++ b/include/openssl/e_os2.h
@@ -104,6 +104,12 @@ extern "C" {
 #     define OPENSSL_SYS_WIN32
 #    endif
 #   endif
+#   if defined(_WIN64) || defined(OPENSSL_SYS_WIN64)
+#    undef OPENSSL_SYS_UNIX
+#    if !defined(OPENSSL_SYS_WIN64)
+#     define OPENSSL_SYS_WIN64
+#    endif
+#   endif
 #   if defined(OPENSSL_SYS_WINNT)
 #    undef OPENSSL_SYS_UNIX
 #   endif
@@ -114,7 +120,7 @@ extern "C" {
 # endif
 
 /* Anything that tries to look like Microsoft is "Windows" */
-# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
+# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN64) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
 #  undef OPENSSL_SYS_UNIX
 #  define OPENSSL_SYS_WINDOWS
 #  ifndef OPENSSL_SYS_MSDOS

From rsalz at openssl.org  Tue Jun  2 15:58:13 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 15:58:13 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433260693.308630.10152.nullmailer@dev.openssl.org>

The branch master has been updated
       via  f20bb4eb18b01979cb23b2ae4a60675c83c4ba91 (commit)
      from  3f131556d6678bc3754f1e6d98a9a5bfc24e368c (commit)


- Log -----------------------------------------------------------------
commit f20bb4eb18b01979cb23b2ae4a60675c83c4ba91
Author: Jeffrey Walton <noloader at gmail.com>
Date:   Wed May 13 15:27:57 2015 -0400

    RT3472: Doc pkcs8 -iter flag is in OpenSSL 1.1
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 doc/apps/pkcs8.pod | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/doc/apps/pkcs8.pod b/doc/apps/pkcs8.pod
index 44c27f1..433e55c 100644
--- a/doc/apps/pkcs8.pod
+++ b/doc/apps/pkcs8.pod
@@ -83,9 +83,9 @@ see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
 
 =item B<-iter count>
 
-When creating new PKCS#8 containers, use a given number of iterations on the password
-in deriving the encryption key for the PKCS#8 output. High values increase the time
-required to brute-force a PKCS#8 container.
+When creating new PKCS#8 containers, use a given number of iterations on
+the password in deriving the encryption key for the PKCS#8 output.
+High values increase the time required to brute-force a PKCS#8 container.
 
 =item B<-nocrypt>
 
@@ -279,4 +279,8 @@ the old format at present.
 L<dsa(1)|dsa(1)>, L<rsa(1)|rsa(1)>, L<genrsa(1)|genrsa(1)>,
 L<gendsa(1)|gendsa(1)> 
 
+=head1 HISTORY
+
+The B<-iter> option was added to OpenSSL 1.1.0.
+
 =cut

From levitte at openssl.org  Tue Jun  2 16:08:07 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 02 Jun 2015 16:08:07 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1433261287.419646.19812.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  f9603f2673154bfba52d24654bc6e5f5dd19a88a (commit)
      from  467daf6b6ef0753ccfc5c024c2f63c948354d698 (commit)


- Log -----------------------------------------------------------------
commit f9603f2673154bfba52d24654bc6e5f5dd19a88a
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun May 31 17:47:31 2015 +0200

    Add the macro OPENSSL_SYS_WIN64
    
    This is for consistency.
    Additionally, have its presence define OPENSSL_SYS_WINDOWS as well.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 3f131556d6678bc3754f1e6d98a9a5bfc24e368c)
    
    Conflicts:
    	e_os2.h

-----------------------------------------------------------------------

Summary of changes:
 e_os2.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/e_os2.h b/e_os2.h
index c9f2543..9d691e2 100644
--- a/e_os2.h
+++ b/e_os2.h
@@ -109,6 +109,12 @@ extern "C" {
 #    undef OPENSSL_SYS_UNIX
 #    define OPENSSL_SYS_WIN32
 #   endif
+#   if defined(_WIN64) || defined(OPENSSL_SYSNAME_WIN64)
+#    undef OPENSSL_SYS_UNIX
+#    if !defined(OPENSSL_SYS_WIN64)
+#     define OPENSSL_SYS_WIN64
+#    endif
+#   endif
 #   if defined(OPENSSL_SYSNAME_WINNT)
 #    undef OPENSSL_SYS_UNIX
 #    define OPENSSL_SYS_WINNT
@@ -121,7 +127,7 @@ extern "C" {
 # endif
 
 /* Anything that tries to look like Microsoft is "Windows" */
-# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
+# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN64) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
 #  undef OPENSSL_SYS_UNIX
 #  define OPENSSL_SYS_WINDOWS
 #  ifndef OPENSSL_SYS_MSDOS

From levitte at openssl.org  Tue Jun  2 16:08:11 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 02 Jun 2015 16:08:11 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433261291.334426.20016.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  a85eef72f5c12b1efbcf7abcbbabf0140fb997bf (commit)
      from  0ae3473e8578b547100389bd029873af0cd9a22e (commit)


- Log -----------------------------------------------------------------
commit a85eef72f5c12b1efbcf7abcbbabf0140fb997bf
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun May 31 17:47:31 2015 +0200

    Add the macro OPENSSL_SYS_WIN64
    
    This is for consistency.
    Additionally, have its presence define OPENSSL_SYS_WINDOWS as well.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 3f131556d6678bc3754f1e6d98a9a5bfc24e368c)
    
    Conflicts:
    	e_os2.h

-----------------------------------------------------------------------

Summary of changes:
 e_os2.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/e_os2.h b/e_os2.h
index ad61e72..cc2ae39 100644
--- a/e_os2.h
+++ b/e_os2.h
@@ -109,6 +109,12 @@ extern "C" {
 #    undef OPENSSL_SYS_UNIX
 #    define OPENSSL_SYS_WIN32
 #   endif
+#   if defined(_WIN64) || defined(OPENSSL_SYSNAME_WIN64)
+#    undef OPENSSL_SYS_UNIX
+#    if !defined(OPENSSL_SYS_WIN64)
+#     define OPENSSL_SYS_WIN64
+#    endif
+#   endif
 #   if defined(OPENSSL_SYSNAME_WINNT)
 #    undef OPENSSL_SYS_UNIX
 #    define OPENSSL_SYS_WINNT
@@ -121,7 +127,7 @@ extern "C" {
 # endif
 
 /* Anything that tries to look like Microsoft is "Windows" */
-# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
+# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN64) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
 #  undef OPENSSL_SYS_UNIX
 #  define OPENSSL_SYS_WINDOWS
 #  ifndef OPENSSL_SYS_MSDOS

From levitte at openssl.org  Tue Jun  2 16:08:16 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 02 Jun 2015 16:08:16 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433261296.971146.20275.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  1977240204fbb85087d15a75c4a2169820eff787 (commit)
      from  939b4960276b040fc0ed52232238fcc9e2e9ec21 (commit)


- Log -----------------------------------------------------------------
commit 1977240204fbb85087d15a75c4a2169820eff787
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun May 31 17:47:31 2015 +0200

    Add the macro OPENSSL_SYS_WIN64
    
    This is for consistency.
    Additionally, have its presence define OPENSSL_SYS_WINDOWS as well.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 3f131556d6678bc3754f1e6d98a9a5bfc24e368c)
    
    Conflicts:
    	e_os2.h

-----------------------------------------------------------------------

Summary of changes:
 e_os2.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/e_os2.h b/e_os2.h
index d400ac7..2b1b78f 100644
--- a/e_os2.h
+++ b/e_os2.h
@@ -109,6 +109,12 @@ extern "C" {
 #    undef OPENSSL_SYS_UNIX
 #    define OPENSSL_SYS_WIN32
 #   endif
+#   if defined(_WIN64) || defined(OPENSSL_SYSNAME_WIN64)
+#    undef OPENSSL_SYS_UNIX
+#    if !defined(OPENSSL_SYS_WIN64)
+#     define OPENSSL_SYS_WIN64
+#    endif
+#   endif
 #   if defined(OPENSSL_SYSNAME_WINNT)
 #    undef OPENSSL_SYS_UNIX
 #    define OPENSSL_SYS_WINNT
@@ -121,7 +127,7 @@ extern "C" {
 # endif
 
 /* Anything that tries to look like Microsoft is "Windows" */
-# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
+# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN64) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
 #  undef OPENSSL_SYS_UNIX
 #  define OPENSSL_SYS_WINDOWS
 #  ifndef OPENSSL_SYS_MSDOS

From levitte at openssl.org  Tue Jun  2 16:08:19 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 02 Jun 2015 16:08:19 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433261299.395080.20450.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  858de8718f3125fe1e5dc30b289e8e00fff47357 (commit)
      from  bd5b5b4c4bda92399bf2b96cf399d6fef107856e (commit)


- Log -----------------------------------------------------------------
commit 858de8718f3125fe1e5dc30b289e8e00fff47357
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun May 31 17:47:31 2015 +0200

    Add the macro OPENSSL_SYS_WIN64
    
    This is for consistency.
    Additionally, have its presence define OPENSSL_SYS_WINDOWS as well.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 3f131556d6678bc3754f1e6d98a9a5bfc24e368c)
    
    Conflicts:
    	e_os2.h

-----------------------------------------------------------------------

Summary of changes:
 e_os2.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/e_os2.h b/e_os2.h
index 613607f..7be9989 100644
--- a/e_os2.h
+++ b/e_os2.h
@@ -109,6 +109,12 @@ extern "C" {
 #    undef OPENSSL_SYS_UNIX
 #    define OPENSSL_SYS_WIN32
 #   endif
+#   if defined(_WIN64) || defined(OPENSSL_SYSNAME_WIN64)
+#    undef OPENSSL_SYS_UNIX
+#    if !defined(OPENSSL_SYS_WIN64)
+#     define OPENSSL_SYS_WIN64
+#    endif
+#   endif
 #   if defined(OPENSSL_SYSNAME_WINNT)
 #    undef OPENSSL_SYS_UNIX
 #    define OPENSSL_SYS_WINNT
@@ -121,7 +127,7 @@ extern "C" {
 # endif
 
 /* Anything that tries to look like Microsoft is "Windows" */
-# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
+# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN64) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
 #  undef OPENSSL_SYS_UNIX
 #  define OPENSSL_SYS_WINDOWS
 #  ifndef OPENSSL_SYS_MSDOS

From rsalz at openssl.org  Tue Jun  2 16:22:48 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 16:22:48 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433262168.660896.24300.nullmailer@dev.openssl.org>

The branch master has been updated
       via  366e2a60b2fcc727b061f1459343245476ad6c3b (commit)
      from  f20bb4eb18b01979cb23b2ae4a60675c83c4ba91 (commit)


- Log -----------------------------------------------------------------
commit 366e2a60b2fcc727b061f1459343245476ad6c3b
Author: Rich Salz <rsalz at akamai.com>
Date:   Sat May 2 10:44:31 2015 -0400

    RT832: Use REUSEADDR in ocsp responder
    
    I also re-ordered some of #ifdef's.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/ocsp.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/apps/ocsp.c b/apps/ocsp.c
index 4c3aa39..5d3e646 100644
--- a/apps/ocsp.c
+++ b/apps/ocsp.c
@@ -1010,22 +1010,27 @@ static BIO *init_responder(const char *port)
 {
     BIO *acbio = NULL, *bufbio = NULL;
 
-    bufbio = BIO_new(BIO_f_buffer());
-    if (!bufbio)
-        goto err;
-# ifndef OPENSSL_NO_SOCK
-    acbio = BIO_new_accept(port);
-# else
+# ifdef OPENSSL_NO_SOCK
     BIO_printf(bio_err,
                "Error setting up accept BIO - sockets not supported.\n");
+    return NULL;
 # endif
-    if (!acbio)
+    bufbio = BIO_new(BIO_f_buffer());
+    if (!bufbio)
         goto err;
+    acbio = BIO_new(BIO_s_accept());
+    if (acbio == NULL
+        || BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
+        || BIO_set_accept_port(acbio, port) < 0) {
+        BIO_printf(bio_err, "Error setting up accept BIO\n");
+        ERR_print_errors(bio_err);
+        goto err;
+    }
+
     BIO_set_accept_bios(acbio, bufbio);
     bufbio = NULL;
-
     if (BIO_do_accept(acbio) <= 0) {
-        BIO_printf(bio_err, "Error setting up accept BIO\n");
+        BIO_printf(bio_err, "Error starting accept\n");
         ERR_print_errors(bio_err);
         goto err;
     }

From rsalz at openssl.org  Tue Jun  2 16:40:50 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 16:40:50 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433263250.447920.28908.nullmailer@dev.openssl.org>

The branch master has been updated
       via  9c3bcfa027cb32421ed20ab77553860b922b82fc (commit)
      from  366e2a60b2fcc727b061f1459343245476ad6c3b (commit)


- Log -----------------------------------------------------------------
commit 9c3bcfa027cb32421ed20ab77553860b922b82fc
Author: Rich Salz <rsalz at akamai.com>
Date:   Fri May 15 13:50:38 2015 -0400

    Standardize handling of #ifdef'd options.
    
    Here are the "rules" for handling flags that depend on #ifdef:
    
    - Do not ifdef the enum.  Only ifdef the OPTIONS table.  All ifdef'd
      entries appear at the end; by convention "engine" is last.  This
      ensures that at run-time, the flag will never be recognized/allowed.
      The next two bullets entries are for silencing compiler warnings:
    - In the while/switch parsing statement, use #ifdef for the body to
      disable it; leave the "case OPT_xxx:" and "break" statements outside
      the ifdef/ifndef.  See ciphers.c for example.
    - If there are multiple options controlled by a single guard, OPT_FOO,
      OPT_BAR, etc., put a an #ifdef around the set, and then do "#else"
      and a series of case labels and a break. See OPENSSL_NO_AES in cms.c
      for example.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/ciphers.c  |  14 +++---
 apps/cms.c      |  15 ++++---
 apps/crl.c      |  16 +++----
 apps/dgst.c     |   2 +-
 apps/dhparam.c  |   6 +--
 apps/dsa.c      |  24 ++++++-----
 apps/dsaparam.c |   6 +--
 apps/ec.c       |   6 +--
 apps/enc.c      |  12 +++---
 apps/gendsa.c   |   2 +-
 apps/genpkey.c  |   1 +
 apps/passwd.c   |   4 +-
 apps/pkcs12.c   |   2 +-
 apps/req.c      |   2 +-
 apps/rsa.c      |  18 ++++----
 apps/s_client.c | 130 ++++++++++++++++++++++++++------------------------------
 apps/s_server.c | 127 +++++++++++++++++++++++++++++-------------------------
 apps/s_time.c   |   6 +--
 apps/speed.c    |  16 +++----
 apps/ts.c       |   2 +-
 apps/verify.c   |   2 +-
 apps/x509.c     |  28 ++++++------
 22 files changed, 222 insertions(+), 219 deletions(-)

diff --git a/apps/ciphers.c b/apps/ciphers.c
index b1b3bdd..a2ccf28 100644
--- a/apps/ciphers.c
+++ b/apps/ciphers.c
@@ -64,12 +64,8 @@
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
-#ifndef OPENSSL_NO_SSL_TRACE
     OPT_STDNAME,
-#endif
-#ifndef OPENSSL_NO_SSL3
     OPT_SSL3,
-#endif
     OPT_TLS1,
     OPT_V, OPT_UPPER_V, OPT_S
 } OPTION_CHOICE;
@@ -79,13 +75,13 @@ OPTIONS ciphers_options[] = {
     {"v", OPT_V, '-', "Verbose listing of the SSL/TLS ciphers"},
     {"V", OPT_UPPER_V, '-', "Even more verbose"},
     {"s", OPT_S, '-', "Only supported ciphers"},
+    {"tls1", OPT_TLS1, '-', "TLS1 mode"},
 #ifndef OPENSSL_NO_SSL_TRACE
     {"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
 #endif
 #ifndef OPENSSL_NO_SSL3
     {"ssl3", OPT_SSL3, '-', "SSL3 mode"},
 #endif
-    {"tls1", OPT_TLS1, '-', "TLS1 mode"},
     {NULL}
 };
 
@@ -125,16 +121,16 @@ int ciphers_main(int argc, char **argv)
         case OPT_S:
             use_supported = 1;
             break;
-#ifndef OPENSSL_NO_SSL_TRACE
         case OPT_STDNAME:
+#ifndef OPENSSL_NO_SSL_TRACE
             stdname = verbose = 1;
-            break;
 #endif
-#ifndef OPENSSL_NO_SSL3
+            break;
         case OPT_SSL3:
+#ifndef OPENSSL_NO_SSL3
             meth = SSLv3_client_method();
-            break;
 #endif
+            break;
         case OPT_TLS1:
             meth = TLSv1_client_method();
             break;
diff --git a/apps/cms.c b/apps/cms.c
index 7ccca5b..e40686b 100644
--- a/apps/cms.c
+++ b/apps/cms.c
@@ -208,6 +208,8 @@ OPTIONS cms_options[] = {
     {"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"},
     {"receipt_request_from", OPT_RR_FROM, 's'},
     {"receipt_request_to", OPT_RR_TO, 's'},
+    {"", OPT_CIPHER, '-', "Any supported cipher"},
+    OPT_V_OPTIONS,
 # ifndef OPENSSL_NO_AES
     {"aes128-wrap", OPT_AES128_WRAP, '-', "Use AES128 to wrap key"},
     {"aes192-wrap", OPT_AES192_WRAP, '-', "Use AES192 to wrap key"},
@@ -219,9 +221,7 @@ OPTIONS cms_options[] = {
 # ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
 # endif
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
-    OPT_V_OPTIONS,
-    {NULL},
+    {NULL}
 };
 
 int cms_main(int argc, char **argv)
@@ -588,11 +588,11 @@ int cms_main(int argc, char **argv)
                 goto end;
             vpmtouched++;
             break;
-# ifndef OPENSSL_NO_DES
         case OPT_3DES_WRAP:
+# ifndef OPENSSL_NO_DES
             wrap_cipher = EVP_des_ede3_wrap();
-            break;
 # endif
+            break;
 # ifndef OPENSSL_NO_AES
         case OPT_AES128_WRAP:
             wrap_cipher = EVP_aes_128_wrap();
@@ -603,6 +603,11 @@ int cms_main(int argc, char **argv)
         case OPT_AES256_WRAP:
             wrap_cipher = EVP_aes_256_wrap();
             break;
+# else
+        case OPT_AES128_WRAP:
+        case OPT_AES192_WRAP:
+        case OPT_AES256_WRAP:
+            break;
 # endif
         }
     }
diff --git a/apps/crl.c b/apps/crl.c
index 17391e2..c897335 100644
--- a/apps/crl.c
+++ b/apps/crl.c
@@ -95,11 +95,11 @@ OPTIONS crl_options[] = {
     {"verify", OPT_VERIFY, '-'},
     {"text", OPT_TEXT, '-', "Print out a text format version"},
     {"hash", OPT_HASH, '-', "Print hash value"},
+    {"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
+    {"", OPT_MD, '-', "Any supported digest"},
 #ifndef OPENSSL_NO_MD5
     {"hash_old", OPT_HASH_OLD, '-', "Print old-style (MD5) hash value"},
 #endif
-    {"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
-    {"", OPT_MD, '-', "Any supported digest"},
     {NULL}
 };
 
@@ -117,11 +117,11 @@ int crl_main(int argc, char **argv)
     char *infile = NULL, *outfile = NULL, *crldiff = NULL, *keyfile = NULL;
     char *CAfile = NULL, *CApath = NULL, *prog;
     OPTION_CHOICE o;
-    int hash = 0, issuer = 0, lastupdate = 0, nextupdate = 0, noout =
-        0, text = 0;
+    int hash = 0, issuer = 0, lastupdate = 0, nextupdate = 0, noout = 0;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyformat = FORMAT_PEM;
-    int ret = 1, num = 0, badsig = 0, fingerprint = 0, crlnumber =
-        0, i, do_ver = 0;
+    int ret = 1, num = 0, badsig = 0, fingerprint = 0, crlnumber = 0;
+    int text = 0, do_ver = 0;
+    int i;
 #ifndef OPENSSL_NO_MD5
     int hash_old = 0;
 #endif
@@ -170,11 +170,11 @@ int crl_main(int argc, char **argv)
             CAfile = opt_arg();
             do_ver = 1;
             break;
-#ifndef OPENSSL_NO_MD5
         case OPT_HASH_OLD:
+#ifndef OPENSSL_NO_MD5
             hash_old = ++num;
-            break;
 #endif
+            break;
         case OPT_VERIFY:
             do_ver = 1;
             break;
diff --git a/apps/dgst.c b/apps/dgst.c
index 308555c..e6142ca 100644
--- a/apps/dgst.c
+++ b/apps/dgst.c
@@ -111,11 +111,11 @@ OPTIONS dgst_options[] = {
     {"mac", OPT_MAC, 's', "Create MAC (not neccessarily HMAC)"},
     {"sigop", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
     {"macop", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
+    {"", OPT_DIGEST, '-', "Any supported digest"},
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
     {"engine_impl", OPT_ENGINE_IMPL, '-'},
 #endif
-    {"", OPT_DIGEST, '-', "Any supported digest"},
     {NULL}
 };
 
diff --git a/apps/dhparam.c b/apps/dhparam.c
index 931bf10..2e5ce2c 100644
--- a/apps/dhparam.c
+++ b/apps/dhparam.c
@@ -153,13 +153,13 @@ OPTIONS dhparam_options[] = {
     {"C", OPT_C, '-', "Print C code"},
     {"2", OPT_2, '-', "Generate parameters using 2 as the generator value"},
     {"5", OPT_5, '-', "Generate parameters using 5 as the generator value"},
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-# endif
 # ifndef OPENSSL_NO_DSA
     {"dsaparam", OPT_DSAPARAM, '-',
      "Read or generate DSA parameters, convert to DH"},
 # endif
+# ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+# endif
     {NULL}
 };
 
diff --git a/apps/dsa.c b/apps/dsa.c
index f02f293..f61e151 100644
--- a/apps/dsa.c
+++ b/apps/dsa.c
@@ -82,14 +82,8 @@ OPTIONS dsa_options[] = {
     {"help", OPT_HELP, '-', "Display this summary"},
     {"inform", OPT_INFORM, 'F', "Input format, DER PEM PVK"},
     {"outform", OPT_OUTFORM, 'F', "Output format, DER PEM PVK"},
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-# endif
     {"in", OPT_IN, '<', "Input file"},
     {"out", OPT_OUT, '>', "Output file"},
-    {"pvk-strong", OPT_PVK_STRONG, '-'},
-    {"pvk-weak", OPT_PVK_WEAK, '-'},
-    {"pvk-none", OPT_PVK_NONE, '-'},
     {"noout", OPT_NOOUT, '-', "Don't print key out"},
     {"text", OPT_TEXT, '-', "Print the key in text"},
     {"modulus", OPT_MODULUS, '-', "Print the DSA public value"},
@@ -98,6 +92,14 @@ OPTIONS dsa_options[] = {
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
     {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
     {"", OPT_CIPHER, '-', "Any supported cipher"},
+# ifndef OPENSSL_NO_RC4
+    {"pvk-strong", OPT_PVK_STRONG, '-'},
+    {"pvk-weak", OPT_PVK_WEAK, '-'},
+    {"pvk-none", OPT_PVK_NONE, '-'},
+# endif
+# ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+# endif
     {NULL}
 };
 
@@ -118,11 +120,6 @@ int dsa_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
-#ifdef OPENSSL_NO_RC4
-        case OPT_PVK_STRONG:
-        case OPT_PVK_WEAK:
-        case OPT_PVK_NONE:
-#endif
  opthelp:
             ret = 0;
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
@@ -166,6 +163,11 @@ int dsa_main(int argc, char **argv)
         case OPT_PVK_NONE:
             pvk_encr = 0;
             break;
+#else
+        case OPT_PVK_STRONG:
+        case OPT_PVK_WEAK:
+        case OPT_PVK_NONE:
+            break;
 #endif
         case OPT_NOOUT:
             noout = 1;
diff --git a/apps/dsaparam.c b/apps/dsaparam.c
index ffd81ff..27170a2 100644
--- a/apps/dsaparam.c
+++ b/apps/dsaparam.c
@@ -103,12 +103,12 @@ OPTIONS dsaparam_options[] = {
     {"genkey", OPT_GENKEY, '-', "Generate a DSA key"},
     {"rand", OPT_RAND, 's', "Files to use for random number input"},
     {"non-fips-allow", OPT_NON_FIPS_ALLOW, '-'},
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-# endif
 # ifdef GENCB_TEST
     {"timebomb", OPT_TIMEBOMB, 'p', "Interrupt keygen after 'pnum' seconds"},
 # endif
+# ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+# endif
     {NULL}
 };
 
diff --git a/apps/ec.c b/apps/ec.c
index 83a6aa4..341243f 100644
--- a/apps/ec.c
+++ b/apps/ec.c
@@ -92,9 +92,6 @@ OPTIONS ec_options[] = {
     {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
     {"out", OPT_OUT, '>', "Output file"},
     {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-# endif
     {"noout", OPT_NOOUT, '-', "Don't print key out"},
     {"text", OPT_TEXT, '-', "Print the key"},
     {"param_out", OPT_PARAM_OUT, '-', "Print the elliptic curve parameters"},
@@ -106,6 +103,9 @@ OPTIONS ec_options[] = {
      "Specifies the way the ec parameters are encoded"},
     {"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
     {"", OPT_CIPHER, '-', "Any supported cipher"},
+# ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+# endif
     {NULL}
 };
 
diff --git a/apps/enc.c b/apps/enc.c
index d045d15..628142a 100644
--- a/apps/enc.c
+++ b/apps/enc.c
@@ -92,9 +92,6 @@ OPTIONS enc_options[] = {
     {"in", OPT_IN, '<', "Input file"},
     {"out", OPT_OUT, '>', "Output file"},
     {"pass", OPT_PASS, 's', "Passphrase source"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
     {"e", OPT_E, '-', "Encrypt"},
     {"d", OPT_D, '-', "Decrypt"},
     {"p", OPT_P, '-', "Print the iv/key"},
@@ -107,9 +104,6 @@ OPTIONS enc_options[] = {
     {"A", OPT_UPPER_A, '-'},
     {"a", OPT_A, '-', "base64 encode/decode, depending on encryption flag"},
     {"base64", OPT_A, '-', "Base64 output as a single line"},
-#ifdef ZLIB
-    {"z", OPT_Z, '-', "Use zlib as the 'encryption'"},
-#endif
     {"bufsize", OPT_BUFSIZE, 's', "Buffer size"},
     {"k", OPT_K, 's', "Passphrase"},
     {"kfile", OPT_KFILE, '<', "Fead passphrase from file"},
@@ -120,6 +114,12 @@ OPTIONS enc_options[] = {
     {"non-fips-allow", OPT_NON_FIPS_ALLOW, '-'},
     {"none", OPT_NONE, '-', "Don't encrypt"},
     {"", OPT_CIPHER, '-', "Any supported cipher"},
+#ifdef ZLIB
+    {"z", OPT_Z, '-', "Use zlib as the 'encryption'"},
+#endif
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#endif
     {NULL}
 };
 
diff --git a/apps/gendsa.c b/apps/gendsa.c
index a832ec3..01bbceb 100644
--- a/apps/gendsa.c
+++ b/apps/gendsa.c
@@ -84,10 +84,10 @@ OPTIONS gendsa_options[] = {
     {"passout", OPT_PASSOUT, 's'},
     {"rand", OPT_RAND, 's',
      "Load the file(s) into the random number generator"},
+    {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
 # ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 # endif
-    {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
     {NULL}
 };
 
diff --git a/apps/genpkey.c b/apps/genpkey.c
index b9843cf..7c8d551 100644
--- a/apps/genpkey.c
+++ b/apps/genpkey.c
@@ -89,6 +89,7 @@ OPTIONS genpkey_options[] = {
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 #endif
+    /* This is deliberately last. */
     {OPT_HELP_STR, 1, 1,
      "Order of options may be important!  See the documentation.\n"},
     {NULL}
diff --git a/apps/passwd.c b/apps/passwd.c
index f34ef9f..2e37629 100644
--- a/apps/passwd.c
+++ b/apps/passwd.c
@@ -101,6 +101,8 @@ OPTIONS passwd_options[] = {
     {"quiet", OPT_QUIET, '-', "No warnings"},
     {"table", OPT_TABLE, '-', "Format output as table"},
     {"reverse", OPT_REVERSE, '-', "Switch table columns"},
+    {"salt", OPT_SALT, 's', "Use provided salt"},
+    {"stdin", OPT_STDIN, '-', "Read passwords from stdin"},
 # ifndef NO_MD5CRYPT_1
     {"apr1", OPT_APR1, '-', "MD5-based password algorithm, Apache variant"},
     {"1", OPT_1, '-', "MD5-based password algorithm"},
@@ -108,8 +110,6 @@ OPTIONS passwd_options[] = {
 # ifndef OPENSSL_NO_DES
     {"crypt", OPT_CRYPT, '-', "Standard Unix password algorithm (default)"},
 # endif
-    {"salt", OPT_SALT, 's', "Use provided salt"},
-    {"stdin", OPT_STDIN, '-', "Read passwords from stdin"},
     {NULL}
 };
 
diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index 82131e8..9ab7f69 100644
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -149,10 +149,10 @@ OPTIONS pkcs12_options[] = {
     {"password", OPT_PASSWORD, 's', "Set import/export password source"},
     {"CApath", OPT_CAPATH, '/', "PEM-format directory of CA's"},
     {"CAfile", OPT_CAFILE, '<', "PEM-format file of CA's"},
+    {"", OPT_CIPHER, '-', "Any supported cipher"},
 # ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 # endif
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
     {NULL}
 };
 
diff --git a/apps/req.c b/apps/req.c
index 3bae59e..00d7c4a 100644
--- a/apps/req.c
+++ b/apps/req.c
@@ -176,11 +176,11 @@ OPTIONS req_options[] = {
      "Cert extension section (override value in config file)"},
     {"reqexts", OPT_REQEXTS, 's',
      "Request extension section (override value in config file)"},
+    {"", OPT_MD, '-', "Any supported digest"},
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
     {"keygen_engine", OPT_KEYGEN_ENGINE, 's'},
 #endif
-    {"", OPT_MD, '-', "Any supported digest"},
     {NULL}
 };
 
diff --git a/apps/rsa.c b/apps/rsa.c
index 87cb702..51581ae 100644
--- a/apps/rsa.c
+++ b/apps/rsa.c
@@ -138,14 +138,16 @@ OPTIONS rsa_options[] = {
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
     {"RSAPublicKey_in", OPT_RSAPUBKEY_IN, '-', "Input is an RSAPublicKey"},
     {"RSAPublicKey_out", OPT_RSAPUBKEY_OUT, '-', "Output is an RSAPublicKey"},
-    {"pvk-strong", OPT_PVK_STRONG, '-'},
-    {"pvk-weak", OPT_PVK_WEAK, '-'},
-    {"pvk-none", OPT_PVK_NONE, '-'},
     {"noout", OPT_NOOUT, '-', "Don't print key out"},
     {"text", OPT_TEXT, '-', "Print the key in text"},
     {"modulus", OPT_MODULUS, '-', "Print the RSA key modulus"},
     {"check", OPT_CHECK, '-', "Verify key consistency"},
     {"", OPT_CIPHER, '-', "Any supported cipher"},
+# ifdef OPENSSL_NO_RC4
+    {"pvk-strong", OPT_PVK_STRONG, '-'},
+    {"pvk-weak", OPT_PVK_WEAK, '-'},
+    {"pvk-none", OPT_PVK_NONE, '-'},
+# endif
 # ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 # endif
@@ -170,11 +172,6 @@ int rsa_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
-#ifdef OPENSSL_NO_RC4
-        case OPT_PVK_STRONG:
-        case OPT_PVK_WEAK:
-        case OPT_PVK_NONE:
-#endif
  opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
@@ -227,6 +224,11 @@ int rsa_main(int argc, char **argv)
         case OPT_PVK_NONE:
             pvk_encr = 0;
             break;
+#else
+        case OPT_PVK_STRONG:
+        case OPT_PVK_WEAK:
+        case OPT_PVK_NONE:
+            break;
 #endif
         case OPT_NOOUT:
             noout = 1;
diff --git a/apps/s_client.c b/apps/s_client.c
index 009e5fe..22aa270 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -509,17 +509,9 @@ OPTIONS s_client_options[] = {
     {"quiet", OPT_QUIET, '-', "No s_client output"},
     {"ign_eof", OPT_IGN_EOF, '-', "Ignore input eof (default when -quiet)"},
     {"no_ign_eof", OPT_NO_IGN_EOF, '-', "Don't ignore input eof"},
-#ifndef OPENSSL_NO_SSL3
-    {"ssl3", OPT_SSL3, '-', "Just use SSLv3"},
-#endif
     {"tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2"},
     {"tls1_1", OPT_TLS1_1, '-', "Just use TLSv1.1"},
     {"tls1", OPT_TLS1, '-', "Just use TLSv1"},
-    {"dtls", OPT_DTLS, '-'},
-    {"dtls1", OPT_DTLS1, '-', "Just use DTLSv1"},
-    {"dtls1_2", OPT_DTLS1_2, '-'},
-    {"timeout", OPT_TIMEOUT, '-'},
-    {"mtu", OPT_MTU, 'p', "Set the link layer MTU"},
     {"starttls", OPT_STARTTLS, 's',
      "Use the STARTTLS command before starting TLS"},
     {"xmpphost", OPT_XMPPHOST, 's', "Host to use with \"-starttls xmpp\""},
@@ -534,6 +526,48 @@ OPTIONS s_client_options[] = {
     {"keymatexportlen", OPT_KEYMATEXPORTLEN, 'p',
      "Export len bytes of keying material (default 20)"},
     {"fallback_scsv", OPT_FALLBACKSCSV, '-', "Send the fallback SCSV"},
+    {"name", OPT_SMTPHOST, 's', "Hostname to use for \"-starttls smtp\""},
+    {"CRL", OPT_CRL, '<'},
+    {"crl_download", OPT_CRL_DOWNLOAD, '-'},
+    {"CRLform", OPT_CRLFORM, 'F'},
+    {"verify_return_error", OPT_VERIFY_RET_ERROR, '-'},
+    {"verify_quiet", OPT_VERIFY_QUIET, '-'},
+    {"brief", OPT_BRIEF, '-'},
+    {"prexit", OPT_PREXIT, '-'},
+    {"security_debug", OPT_SECURITY_DEBUG, '-'},
+    {"security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-'},
+    {"cert_chain", OPT_CERT_CHAIN, '<'},
+    {"chainCApath", OPT_CHAINCAPATH, '/'},
+    {"verifyCApath", OPT_VERIFYCAPATH, '/'},
+    {"build_chain", OPT_BUILD_CHAIN, '-'},
+    {"chainCAfile", OPT_CHAINCAFILE, '<'},
+    {"verifyCAfile", OPT_VERIFYCAFILE, '<'},
+    {"nocommands", OPT_NOCMDS, '-', "Do not use interactive command letters"},
+    {"servername", OPT_SERVERNAME, 's',
+     "Set TLS extension servername in ClientHello"},
+    {"tlsextdebug", OPT_TLSEXTDEBUG, '-',
+     "Hex dump of all TLS extensions received"},
+    {"status", OPT_STATUS, '-', "Request certificate status from server"},
+    {"serverinfo", OPT_SERVERINFO, 's',
+     "types  Send empty ClientHello extensions (comma-separated numbers)"},
+    {"alpn", OPT_ALPN, 's',
+     "Enable ALPN extension, considering named protocols supported (comma-separated list)"},
+    OPT_S_OPTIONS,
+    OPT_V_OPTIONS,
+    OPT_X_OPTIONS,
+#ifndef OPENSSL_NO_SSL3
+    {"ssl3", OPT_SSL3, '-', "Just use SSLv3"},
+#endif
+#ifndef OPENSSL_NO_DTLS1
+    {"dtls", OPT_DTLS, '-'},
+    {"dtls1", OPT_DTLS1, '-', "Just use DTLSv1"},
+    {"dtls1_2", OPT_DTLS1_2, '-'},
+    {"timeout", OPT_TIMEOUT, '-'},
+    {"mtu", OPT_MTU, 'p', "Set the link layer MTU"},
+#endif
+#ifndef OPENSSL_NO_SSL_TRACE
+    {"trace", OPT_TRACE, '-'},
+#endif
 #ifdef WATT32
     {"wdebug", OPT_WDEBUG, '-', "WATT-32 tcp debugging"},
 #endif
@@ -556,44 +590,14 @@ OPTIONS s_client_options[] = {
      "Tolerate other than the known g N values."},
     {"srp_strength", OPT_SRP_STRENGTH, 'p', "Minimal mength in bits for N"},
 #endif
-    {"name", OPT_SMTPHOST, 's', "Hostname to use for \"-starttls smtp\""},
-    {"servername", OPT_SERVERNAME, 's',
-     "Set TLS extension servername in ClientHello"},
-    {"tlsextdebug", OPT_TLSEXTDEBUG, '-',
-     "Hex dump of all TLS extensions received"},
-    {"status", OPT_STATUS, '-', "Request certificate status from server"},
-    {"serverinfo", OPT_SERVERINFO, 's',
-     "types  Send empty ClientHello extensions (comma-separated numbers)"},
-    {"alpn", OPT_ALPN, 's',
-     "Enable ALPN extension, considering named protocols supported (comma-separated list)"},
 #ifndef OPENSSL_NO_NEXTPROTONEG
     {"nextprotoneg", OPT_NEXTPROTONEG, 's',
      "Enable NPN extension, considering named protocols supported (comma-separated list)"},
 #endif
-    {"CRL", OPT_CRL, '<'},
-    {"crl_download", OPT_CRL_DOWNLOAD, '-'},
-    {"CRLform", OPT_CRLFORM, 'F'},
-    {"verify_return_error", OPT_VERIFY_RET_ERROR, '-'},
-    {"verify_quiet", OPT_VERIFY_QUIET, '-'},
-    {"brief", OPT_BRIEF, '-'},
-    {"prexit", OPT_PREXIT, '-'},
-    {"trace", OPT_TRACE, '-'},
-    {"security_debug", OPT_SECURITY_DEBUG, '-'},
-    {"security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-'},
-    {"cert_chain", OPT_CERT_CHAIN, '<'},
-    {"chainCApath", OPT_CHAINCAPATH, '/'},
-    {"verifyCApath", OPT_VERIFYCAPATH, '/'},
-    {"build_chain", OPT_BUILD_CHAIN, '-'},
-    {"chainCAfile", OPT_CHAINCAFILE, '<'},
-    {"verifyCAfile", OPT_VERIFYCAFILE, '<'},
-    {"nocommands", OPT_NOCMDS, '-', "Do not use interactive command letters"},
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
     {"ssl_client_engine", OPT_SSL_CLIENT_ENGINE, 's'},
 #endif
-    OPT_S_OPTIONS,
-    OPT_V_OPTIONS,
-    OPT_X_OPTIONS,
     {NULL}
 };
 
@@ -706,29 +710,6 @@ int s_client_main(int argc, char **argv)
     prog = opt_init(argc, argv, s_client_options);
     while ((o = opt_next()) != OPT_EOF) {
         switch (o) {
-#ifndef WATT32
-        case OPT_WDEBUG:
-#endif
-#ifdef OPENSSL_NO_JPAKE
-        case OPT_JPAKE:
-#endif
-#ifdef OPENSSL_NO_SSL_TRACE
-        case OPT_TRACE:
-#endif
-#ifdef OPENSSL_NO_PSK
-        case OPT_PSK_IDENTITY:
-        case OPT_PSK:
-#endif
-#ifdef OPENSSL_NO_SSL3
-        case OPT_SSL3:
-#endif
-#ifdef OPENSSL_NO_DTLS1
-        case OPT_DTLS:
-        case OPT_DTLS1:
-        case OPT_DTLS1_2:
-        case OPT_TIMEOUT:
-        case OPT_MTU:
-#endif
         case OPT_EOF:
         case OPT_ERR:
  opthelp:
@@ -866,22 +847,22 @@ int s_client_main(int argc, char **argv)
         case OPT_STATUS:
             c_status_req = 1;
             break;
-#ifdef WATT32
         case OPT_WDEBUG:
+#ifdef WATT32
             dbug_init();
-            break;
 #endif
+            break;
         case OPT_MSG:
             c_msg = 1;
             break;
         case OPT_MSGFILE:
             bio_c_msg = BIO_new_file(opt_arg(), "w");
             break;
-#ifndef OPENSSL_NO_SSL_TRACE
         case OPT_TRACE:
+#ifndef OPENSSL_NO_SSL_TRACE
             c_msg = 2;
-            break;
 #endif
+            break;
         case OPT_SECURITY_DEBUG:
             sdebug = 1;
             break;
@@ -908,6 +889,9 @@ int s_client_main(int argc, char **argv)
                 BIO_printf(bio_err, "Not a hex number '%s'\n", psk_key);
                 goto end;
             }
+#else
+        case OPT_PSK_IDENTITY:
+        case OPT_PSK:
             break;
 #endif
 #ifndef OPENSSL_NO_SRP
@@ -941,11 +925,11 @@ int s_client_main(int argc, char **argv)
         case OPT_SRP_MOREGROUPS:
             break;
 #endif
-#ifndef OPENSSL_NO_SSL3
         case OPT_SSL3:
+#ifndef OPENSSL_NO_SSL3
             meth = SSLv3_client_method();
-            break;
 #endif
+            break;
         case OPT_TLS1_2:
             meth = TLSv1_2_client_method();
             break;
@@ -974,6 +958,13 @@ int s_client_main(int argc, char **argv)
         case OPT_MTU:
             socket_mtu = atol(opt_arg());
             break;
+#else
+        case OPT_DTLS:
+        case OPT_DTLS1:
+        case OPT_DTLS1_2:
+        case OPT_TIMEOUT:
+        case OPT_MTU:
+            break;
 #endif
         case OPT_FALLBACKSCSV:
             fallback_scsv = 1;
@@ -1038,13 +1029,12 @@ int s_client_main(int argc, char **argv)
                 goto end;
         case OPT_SERVERNAME:
             servername = opt_arg();
-            /* meth=TLSv1_client_method(); */
             break;
-#ifndef OPENSSL_NO_JPAKE
         case OPT_JPAKE:
+#ifndef OPENSSL_NO_JPAKE
             jpake_secret = opt_arg();
-            break;
 #endif
+            break;
         case OPT_USE_SRTP:
             srtp_profiles = opt_arg();
             break;
diff --git a/apps/s_server.c b/apps/s_server.c
index 189019d..6bd0257 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -806,9 +806,7 @@ typedef enum OPTION_choice {
     OPT_BRIEF, OPT_NO_TMP_RSA, OPT_NO_DHE, OPT_NO_ECDHE,
     OPT_NO_RESUME_EPHEMERAL, OPT_PSK_HINT, OPT_PSK, OPT_SRPVFILE,
     OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP,
-#ifndef OPENSSL_NO_SSL3
     OPT_SSL3,
-#endif
     OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1,
     OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_CHAIN,
     OPT_ID_PREFIX, OPT_RAND, OPT_SERVERNAME, OPT_SERVERNAME_FATAL,
@@ -821,7 +819,6 @@ typedef enum OPTION_choice {
 
 OPTIONS s_server_options[] = {
     {"help", OPT_HELP, '-', "Display this summary"},
-
     {"port", OPT_PORT, 'p'},
     {"accept", OPT_PORT, 'p',
      "TCP/IP port to accept on (default is " PORT_STR ")"},
@@ -851,9 +848,6 @@ OPTIONS s_server_options[] = {
     {"dkeyform", OPT_DKEYFORM, 'F',
      "Second key format (PEM, DER or ENGINE) PEM default"},
     {"dpass", OPT_DPASS, 's', "Second private key file pass phrase source"},
-#ifdef FIONBIO
-    {"nbio", OPT_NBIO, '-', "Use non-blocking IO"},
-#endif
     {"nbio_test", OPT_NBIO_TEST, '-', "Test with the non-blocking test bio"},
     {"crlf", OPT_CRLF, '-', "Convert LF from terminal into CRLF"},
     {"debug", OPT_DEBUG, '-', "Print more output"},
@@ -865,47 +859,13 @@ OPTIONS s_server_options[] = {
     {"nocert", OPT_NOCERT, '-', "Don't use any certificates (Anon-DH)"},
     {"quiet", OPT_QUIET, '-', "No server output"},
     {"no_tmp_rsa", OPT_NO_TMP_RSA, '-', "Do not generate a tmp RSA key"},
-#ifndef OPENSSL_NO_PSK
-    {"psk_hint", OPT_PSK_HINT, 's', "PSK identity hint to use"},
-    {"psk", OPT_PSK, 's', "PSK in hex (without 0x)"},
-# ifndef OPENSSL_NO_JPAKE
-    {"jpake", OPT_JPAKE, 's', "JPAKE secret to use"},
-# endif
-#endif
-#ifndef OPENSSL_NO_SRP
-    {"srpvfile", OPT_SRPVFILE, '<', "The verifier file for SRP"},
-    {"srpuserseed", OPT_SRPUSERSEED, 's',
-     "A seed string for a default user salt"},
-#endif
-#ifndef OPENSSL_NO_SSL3
-    {"ssl3", OPT_SSL3, '-', "Just talk SSLv3"},
-#endif
     {"tls1_2", OPT_TLS1_2, '-', "just talk TLSv1.2"},
     {"tls1_1", OPT_TLS1_1, '-', "Just talk TLSv1.1"},
     {"tls1", OPT_TLS1, '-', "Just talk TLSv1"},
-#ifndef OPENSSL_NO_DTLS1
-    {"dtls", OPT_DTLS, '-'},
-    {"dtls1", OPT_DTLS1, '-', "Just talk DTLSv1"},
-    {"dtls1_2", OPT_DTLS1_2, '-', "Just talk DTLSv1.2"},
-    {"timeout", OPT_TIMEOUT, '-', "Enable timeouts"},
-    {"mtu", OPT_MTU, 'p', "Set link layer MTU"},
-    {"chain", OPT_CHAIN, '-', "Read a certificate chain"},
-#endif
-#ifndef OPENSSL_NO_DH
-    {"no_dhe", OPT_NO_DHE, '-', "Disable ephemeral DH"},
-#endif
-#ifndef OPENSSL_NO_EC
-    {"no_ecdhe", OPT_NO_ECDHE, '-', "Disable ephemeral ECDH"},
-#endif
     {"no_resume_ephemeral", OPT_NO_RESUME_EPHEMERAL, '-',
      "Disable caching and tickets if ephemeral (EC)DH is used"},
     {"www", OPT_WWW, '-', "Respond to a 'GET /' with a status page"},
     {"WWW", OPT_UPPER_WWW, '-', "Respond to a 'GET with the file ./path"},
-    {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path incluedes HTTP headers"},
-    {"id_prefix", OPT_ID_PREFIX, 's',
-     "Generate SSL/TLS session IDs prefixed by arg"},
-    {"rand", OPT_RAND, 's',
-     "Load the file(s) into the random number generator"},
     {"servername", OPT_SERVERNAME, 's',
      "Servername for HostName TLS extension"},
     {"servername_fatal", OPT_SERVERNAME_FATAL, '-',
@@ -916,14 +876,11 @@ OPTIONS s_server_options[] = {
      "-Private Key file to use for servername if not in -cert2"},
     {"tlsextdebug", OPT_TLSEXTDEBUG, '-',
      "Hex dump of all TLS extensions received"},
-#ifndef OPENSSL_NO_NEXTPROTONEG
-    {"nextprotoneg", OPT_NEXTPROTONEG, 's',
-     "Set the advertised protocols for the NPN extension (comma-separated list)"},
-#endif
-    {"use_srtp", OPT_SRTP_PROFILES, '<',
-     "Offer SRTP key management with a colon-separated profile list"},
-    {"alpn", OPT_ALPN, 's',
-     "Set the advertised protocols for the ALPN extension (comma-separated list)"},
+    {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path incluedes HTTP headers"},
+    {"id_prefix", OPT_ID_PREFIX, 's',
+     "Generate SSL/TLS session IDs prefixed by arg"},
+    {"rand", OPT_RAND, 's',
+     "Load the file(s) into the random number generator"},
     {"keymatexport", OPT_KEYMATEXPORT, 's',
      "Export keying material using label"},
     {"keymatexportlen", OPT_KEYMATEXPORTLEN, 'p',
@@ -953,12 +910,54 @@ OPTIONS s_server_options[] = {
     {"security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-'},
     {"brief", OPT_BRIEF, '-'},
     {"rev", OPT_REV, '-'},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's'},
-#endif
     OPT_S_OPTIONS,
     OPT_V_OPTIONS,
     OPT_X_OPTIONS,
+#ifdef FIONBIO
+    {"nbio", OPT_NBIO, '-', "Use non-blocking IO"},
+#endif
+#ifndef OPENSSL_NO_PSK
+    {"psk_hint", OPT_PSK_HINT, 's', "PSK identity hint to use"},
+    {"psk", OPT_PSK, 's', "PSK in hex (without 0x)"},
+# ifndef OPENSSL_NO_JPAKE
+    {"jpake", OPT_JPAKE, 's', "JPAKE secret to use"},
+# endif
+#endif
+#ifndef OPENSSL_NO_SRP
+    {"srpvfile", OPT_SRPVFILE, '<', "The verifier file for SRP"},
+    {"srpuserseed", OPT_SRPUSERSEED, 's',
+     "A seed string for a default user salt"},
+#endif
+#ifndef OPENSSL_NO_SSL3
+    {"ssl3", OPT_SSL3, '-', "Just talk SSLv3"},
+#endif
+#ifndef OPENSSL_NO_DTLS1
+    {"dtls", OPT_DTLS, '-'},
+    {"dtls1", OPT_DTLS1, '-', "Just talk DTLSv1"},
+    {"dtls1_2", OPT_DTLS1_2, '-', "Just talk DTLSv1.2"},
+    {"timeout", OPT_TIMEOUT, '-', "Enable timeouts"},
+    {"mtu", OPT_MTU, 'p', "Set link layer MTU"},
+    {"chain", OPT_CHAIN, '-', "Read a certificate chain"},
+#endif
+#ifndef OPENSSL_NO_DH
+    {"no_dhe", OPT_NO_DHE, '-', "Disable ephemeral DH"},
+#endif
+#ifndef OPENSSL_NO_EC
+    {"no_ecdhe", OPT_NO_ECDHE, '-', "Disable ephemeral ECDH"},
+#endif
+#ifndef OPENSSL_NO_NEXTPROTONEG
+    {"nextprotoneg", OPT_NEXTPROTONEG, 's',
+     "Set the advertised protocols for the NPN extension (comma-separated list)"},
+#endif
+#ifndef OPENSSL_NO_SRTP
+    {"use_srtp", OPT_SRTP_PROFILES, '<',
+     "Offer SRTP key management with a colon-separated profile list"},
+    {"alpn", OPT_ALPN, 's',
+     "Set the advertised protocols for the ALPN extension (comma-separated list)"},
+#endif
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's'},
+#endif
     {NULL}
 };
 
@@ -1246,13 +1245,11 @@ int s_server_main(int argc, char *argv[])
         case OPT_MSGFILE:
             bio_s_msg = BIO_new_file(opt_arg(), "w");
             break;
-#ifndef OPENSSL_NO_SSL_TRACE
         case OPT_TRACE:
+#ifndef OPENSSL_NO_SSL_TRACE
             s_msg = 2;
-            break;
 #else
-        case OPT_TRACE:
-            goto opthelp;
+            break;
 #endif
         case OPT_SECURITY_DEBUG:
             sdebug = 1;
@@ -1296,6 +1293,10 @@ int s_server_main(int argc, char *argv[])
                 goto end;
             }
             break;
+#else
+        case OPT_PSK_HINT:
+        case OPT_PSK:
+            break;
 #endif
 #ifndef OPENSSL_NO_SRP
         case OPT_SRPVFILE:
@@ -1323,11 +1324,11 @@ int s_server_main(int argc, char *argv[])
         case OPT_HTTP:
             www = 3;
             break;
-#ifndef OPENSSL_NO_SSL3
         case OPT_SSL3:
+#ifndef OPENSSL_NO_SSL3
             meth = SSLv3_server_method();
-            break;
 #endif
+            break;
         case OPT_TLS1_2:
             meth = TLSv1_2_server_method();
             break;
@@ -1359,6 +1360,14 @@ int s_server_main(int argc, char *argv[])
         case OPT_CHAIN:
             cert_chain = 1;
             break;
+#else
+        case OPT_DTLS:
+        case OPT_DTLS1:
+        case OPT_DTLS1_2:
+        case OPT_TIMEOUT:
+        case OPT_MTU:
+        case OPT_CHAIN:
+            break;
 #endif
         case OPT_ID_PREFIX:
             session_id_prefix = opt_arg();
@@ -1381,11 +1390,11 @@ int s_server_main(int argc, char *argv[])
         case OPT_KEY2:
             s_key_file2 = opt_arg();
             break;
-#ifndef OPENSSL_NO_NEXTPROTONEG
         case OPT_NEXTPROTONEG:
+# ifndef OPENSSL_NO_NEXTPROTONEG
             next_proto_neg_in = opt_arg();
-            break;
 #endif
+            break;
         case OPT_ALPN:
             alpn_in = opt_arg();
             break;
diff --git a/apps/s_time.c b/apps/s_time.c
index 74decd2..4f56174 100644
--- a/apps/s_time.c
+++ b/apps/s_time.c
@@ -114,9 +114,7 @@ typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_CONNECT, OPT_CIPHER, OPT_CERT, OPT_KEY, OPT_CAPATH,
     OPT_CAFILE, OPT_NEW, OPT_REUSE, OPT_BUGS, OPT_VERIFY, OPT_TIME,
-#ifndef OPENSSL_NO_SSL3
     OPT_SSL3,
-#endif
     OPT_WWW
 } OPTION_CHOICE;
 
@@ -227,11 +225,11 @@ int s_time_main(int argc, char **argv)
                 goto end;
             }
             break;
-#ifndef OPENSSL_NO_SSL3
         case OPT_SSL3:
+#ifndef OPENSSL_NO_SSL3
             meth = SSLv3_client_method();
-            break;
 #endif
+            break;
         }
     }
     argc = opt_num_rest();
diff --git a/apps/speed.c b/apps/speed.c
index b93237e..45a060f 100644
--- a/apps/speed.c
+++ b/apps/speed.c
@@ -358,19 +358,19 @@ OPTIONS speed_options[] = {
     {OPT_HELP_STR, 1, '-', "Usage: %s [options] ciphers...\n"},
     {OPT_HELP_STR, 1, '-', "Valid options are:\n"},
     {"help", OPT_HELP, '-', "Display this summary"},
+    {"evp", OPT_EVP, 's', "Use specified EVP cipher"},
+    {"decrypt", OPT_DECRYPT, '-',
+     "Time decryption instead of encryption (only EVP)"},
+    {"mr", OPT_MR, '-', "Produce machine readable output"},
+    {"mb", OPT_MB, '-'},
+    {"misalign", OPT_MISALIGN, 'n', "Amount to mis-align buffers"},
 #if defined(TIMES) || defined(USE_TOD)
     {"elapsed", OPT_ELAPSED, '-',
      "Measure time in real time instead of CPU user time"},
 #endif
-    {"evp", OPT_EVP, 's', "Use specified EVP cipher"},
-    {"decrypt", OPT_DECRYPT, '-',
-     "Time decryption instead of encryption (only EVP)"},
 #ifndef NO_FORK
     {"multi", OPT_MULTI, 'p', "Run benchmarks in parallel"},
 #endif
-    {"mr", OPT_MR, '-', "Produce machine readable output"},
-    {"mb", OPT_MB, '-'},
-    {"misalign", OPT_MISALIGN, 'n', "Amount to mis-align buffers"},
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 #endif
@@ -829,11 +829,11 @@ int speed_main(int argc, char **argv)
         case OPT_ENGINE:
             (void)setup_engine(opt_arg(), 0);
             break;
-#ifndef NO_FORK
         case OPT_MULTI:
+#ifndef NO_FORK
             multi = atoi(opt_arg());
-            break;
 #endif
+            break;
         case OPT_MISALIGN:
             if (!opt_int(opt_arg(), &misalign))
                 goto end;
diff --git a/apps/ts.c b/apps/ts.c
index dfbf7ea..feec34b 100644
--- a/apps/ts.c
+++ b/apps/ts.c
@@ -151,10 +151,10 @@ OPTIONS ts_options[] = {
     {"CApath", OPT_CAPATH, '/', "Path to trusted CA files"},
     {"CAfile", OPT_CAFILE, '<', "File with trusted CA certs"},
     {"untrusted", OPT_UNTRUSTED, '<', "File with untrusted certs"},
+    {"", OPT_MD, '-', "Any supported digest"},
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 #endif
-    {"", OPT_MD, '-', "Any supported digest"},
     {NULL}
 };
 
diff --git a/apps/verify.c b/apps/verify.c
index 0235194..227b85b 100644
--- a/apps/verify.c
+++ b/apps/verify.c
@@ -91,10 +91,10 @@ OPTIONS verify_options[] = {
     {"CRLfile", OPT_CRLFILE, '<'},
     {"crl_download", OPT_CRL_DOWNLOAD, '-'},
     {"show_chain", OPT_SHOW_CHAIN, '-'},
+    OPT_V_OPTIONS,
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 #endif
-    OPT_V_OPTIONS,
     {NULL}
 };
 
diff --git a/apps/x509.c b/apps/x509.c
index 77a2a6b..0345cf0 100644
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -107,13 +107,9 @@ typedef enum OPTION_choice {
     OPT_PURPOSE, OPT_STARTDATE, OPT_ENDDATE, OPT_CHECKEND, OPT_CHECKHOST,
     OPT_CHECKEMAIL, OPT_CHECKIP, OPT_NOOUT, OPT_TRUSTOUT, OPT_CLRTRUST,
     OPT_CLRREJECT, OPT_ALIAS, OPT_CACREATESERIAL, OPT_CLREXT, OPT_OCSPID,
-#ifndef OPENSSL_NO_MD5
     OPT_SUBJECT_HASH_OLD,
     OPT_ISSUER_HASH_OLD,
-#endif
-#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
     OPT_FORCE_VERSION,
-#endif
     OPT_BADSIG, OPT_MD, OPT_ENGINE, OPT_NOCERT
 } OPTION_CHOICE;
 
@@ -130,12 +126,6 @@ OPTIONS x509_options[] = {
     {"serial", OPT_SERIAL, '-', "Print serial number value"},
     {"subject_hash", OPT_HASH, '-', "Print subject hash value"},
     {"issuer_hash", OPT_ISSUER_HASH, '-', "Print issuer hash value"},
-#ifndef OPENSSL_NO_MD5
-    {"subject_hash_old", OPT_SUBJECT_HASH_OLD, '-',
-     "Print old-style (MD5) issuer hash value"},
-    {"issuer_hash_old", OPT_ISSUER_HASH_OLD, '-',
-     "Print old-style (MD5) subject hash value"},
-#endif
     {"hash", OPT_HASH, '-', "Synonym for -subject_hash"},
     {"subject", OPT_SUBJECT, '-', "Print subject DN"},
     {"issuer", OPT_ISSUER, '-', "Print issuer DN"},
@@ -194,12 +184,18 @@ OPTIONS x509_options[] = {
     {"clrreject", OPT_CLRREJECT, '-'},
     {"badsig", OPT_BADSIG, '-'},
     {"", OPT_MD, '-', "Any supported digest"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#ifndef OPENSSL_NO_MD5
+    {"subject_hash_old", OPT_SUBJECT_HASH_OLD, '-',
+     "Print old-style (MD5) issuer hash value"},
+    {"issuer_hash_old", OPT_ISSUER_HASH_OLD, '-',
+     "Print old-style (MD5) subject hash value"},
 #endif
 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
     {"force_version", OPT_FORCE_VERSION, 'p'},
 #endif
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#endif
     {NULL}
 };
 
@@ -291,11 +287,11 @@ int x509_main(int argc, char **argv)
             if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
                 goto opthelp;
             break;
-#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
         case OPT_FORCE_VERSION:
+#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
             force_version = atoi(opt_arg()) - 1;
-            break;
 #endif
+            break;
         case OPT_DAYS:
             days = atoi(opt_arg());
             break;
@@ -459,6 +455,10 @@ int x509_main(int argc, char **argv)
         case OPT_ISSUER_HASH_OLD:
             issuer_hash_old = ++num;
             break;
+#else
+        case OPT_SUBJECT_HASH_OLD:
+        case OPT_ISSUER_HASH_OLD:
+            break;
 #endif
         case OPT_DATES:
             startdate = ++num;

From rsalz at openssl.org  Tue Jun  2 21:17:07 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 21:17:07 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433279827.031331.16630.nullmailer@dev.openssl.org>

The branch master has been updated
       via  591b7aef05b22cba09b179e5787a9bf40dfc9508 (commit)
      from  9c3bcfa027cb32421ed20ab77553860b922b82fc (commit)


- Log -----------------------------------------------------------------
commit 591b7aef05b22cba09b179e5787a9bf40dfc9508
Author: Annie Yousar <a.yousar at informatik.hu-berlin.de>
Date:   Sun May 3 09:05:47 2015 -0400

    RT3230: Better test for C identifier
    
    objects.pl only looked for a space to see if the name could be
    used as a C identifier.  Improve the test to match the real C
    rules.
    
    Signed-off-by: Rich Salz <rsalz at akamai.com>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/objects.README | 8 ++++----
 crypto/objects/objects.pl     | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/crypto/objects/objects.README b/crypto/objects/objects.README
index 4d74550..cb1d216 100644
--- a/crypto/objects/objects.README
+++ b/crypto/objects/objects.README
@@ -8,9 +8,9 @@ The basic syntax for adding an object is as follows:
 
 	1 2 3 4		: shortName	: Long Name
 
-		If the long name doesn't contain spaces, or no short name
-		exists, the long name is used as basis for the base name
-		in C.  Otherwise, the short name is used.
+		If Long Name contains only word characters and hyphen-minus
+		(0x2D) or full stop (0x2E) then Long Name is used as basis
+		for the base name in C. Otherwise, the shortName is used.
 
 		The base name (let's call it 'base') will then be used to
 		create the C macros SN_base, LN_base, NID_base and OBJ_base.
@@ -22,7 +22,7 @@ Then there are some extra commands:
 
 	!Alias foo 1 2 3 4
 
-		This juts makes a name foo for an OID.  The C macro
+		This just makes a name foo for an OID.  The C macro
 		OBJ_foo will be created as a result.
 
 	!Cname foo
diff --git a/crypto/objects/objects.pl b/crypto/objects/objects.pl
index d0ed459..389dc34 100644
--- a/crypto/objects/objects.pl
+++ b/crypto/objects/objects.pl
@@ -67,7 +67,7 @@ while (<IN>)
 		$myoid = &process_oid($myoid);
 		}
 
-	if ($Cname eq "" && !($myln =~ / /))
+	if ($Cname eq "" && ($myln =~ /^[_A-Za-z][\w.-]*$/ ))
 		{
 		$Cname = $myln;
 		$Cname =~ s/\./_/g;

From rsalz at openssl.org  Tue Jun  2 21:17:50 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 21:17:50 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433279870.025032.17496.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  fb22f7406485f1c4e08dbf065d75146c2336b345 (commit)
      from  858de8718f3125fe1e5dc30b289e8e00fff47357 (commit)


- Log -----------------------------------------------------------------
commit fb22f7406485f1c4e08dbf065d75146c2336b345
Author: Annie Yousar <a.yousar at informatik.hu-berlin.de>
Date:   Sun May 3 09:05:47 2015 -0400

    RT3230: Better test for C identifier
    
    objects.pl only looked for a space to see if the name could be
    used as a C identifier.  Improve the test to match the real C
    rules.
    
    Signed-off-by: Rich Salz <rsalz at akamai.com>
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 591b7aef05b22cba09b179e5787a9bf40dfc9508)

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/objects.README | 8 ++++----
 crypto/objects/objects.pl     | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/crypto/objects/objects.README b/crypto/objects/objects.README
index 4d74550..cb1d216 100644
--- a/crypto/objects/objects.README
+++ b/crypto/objects/objects.README
@@ -8,9 +8,9 @@ The basic syntax for adding an object is as follows:
 
 	1 2 3 4		: shortName	: Long Name
 
-		If the long name doesn't contain spaces, or no short name
-		exists, the long name is used as basis for the base name
-		in C.  Otherwise, the short name is used.
+		If Long Name contains only word characters and hyphen-minus
+		(0x2D) or full stop (0x2E) then Long Name is used as basis
+		for the base name in C. Otherwise, the shortName is used.
 
 		The base name (let's call it 'base') will then be used to
 		create the C macros SN_base, LN_base, NID_base and OBJ_base.
@@ -22,7 +22,7 @@ Then there are some extra commands:
 
 	!Alias foo 1 2 3 4
 
-		This juts makes a name foo for an OID.  The C macro
+		This just makes a name foo for an OID.  The C macro
 		OBJ_foo will be created as a result.
 
 	!Cname foo
diff --git a/crypto/objects/objects.pl b/crypto/objects/objects.pl
index d0ed459..389dc34 100644
--- a/crypto/objects/objects.pl
+++ b/crypto/objects/objects.pl
@@ -67,7 +67,7 @@ while (<IN>)
 		$myoid = &process_oid($myoid);
 		}
 
-	if ($Cname eq "" && !($myln =~ / /))
+	if ($Cname eq "" && ($myln =~ /^[_A-Za-z][\w.-]*$/ ))
 		{
 		$Cname = $myln;
 		$Cname =~ s/\./_/g;

From rsalz at openssl.org  Tue Jun  2 21:18:00 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 02 Jun 2015 21:18:00 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433279880.771099.17748.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  32b2ad7e071d0e766da6956f5b0c9cf2ccb18388 (commit)
      from  1977240204fbb85087d15a75c4a2169820eff787 (commit)


- Log -----------------------------------------------------------------
commit 32b2ad7e071d0e766da6956f5b0c9cf2ccb18388
Author: Annie Yousar <a.yousar at informatik.hu-berlin.de>
Date:   Sun May 3 09:05:47 2015 -0400

    RT3230: Better test for C identifier
    
    objects.pl only looked for a space to see if the name could be
    used as a C identifier.  Improve the test to match the real C
    rules.
    
    Signed-off-by: Rich Salz <rsalz at akamai.com>
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 591b7aef05b22cba09b179e5787a9bf40dfc9508)

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/objects.README | 8 ++++----
 crypto/objects/objects.pl     | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/crypto/objects/objects.README b/crypto/objects/objects.README
index 4d74550..cb1d216 100644
--- a/crypto/objects/objects.README
+++ b/crypto/objects/objects.README
@@ -8,9 +8,9 @@ The basic syntax for adding an object is as follows:
 
 	1 2 3 4		: shortName	: Long Name
 
-		If the long name doesn't contain spaces, or no short name
-		exists, the long name is used as basis for the base name
-		in C.  Otherwise, the short name is used.
+		If Long Name contains only word characters and hyphen-minus
+		(0x2D) or full stop (0x2E) then Long Name is used as basis
+		for the base name in C. Otherwise, the shortName is used.
 
 		The base name (let's call it 'base') will then be used to
 		create the C macros SN_base, LN_base, NID_base and OBJ_base.
@@ -22,7 +22,7 @@ Then there are some extra commands:
 
 	!Alias foo 1 2 3 4
 
-		This juts makes a name foo for an OID.  The C macro
+		This just makes a name foo for an OID.  The C macro
 		OBJ_foo will be created as a result.
 
 	!Cname foo
diff --git a/crypto/objects/objects.pl b/crypto/objects/objects.pl
index d0ed459..389dc34 100644
--- a/crypto/objects/objects.pl
+++ b/crypto/objects/objects.pl
@@ -67,7 +67,7 @@ while (<IN>)
 		$myoid = &process_oid($myoid);
 		}
 
-	if ($Cname eq "" && !($myln =~ / /))
+	if ($Cname eq "" && ($myln =~ /^[_A-Za-z][\w.-]*$/ ))
 		{
 		$Cname = $myln;
 		$Cname =~ s/\./_/g;

From matt at openssl.org  Tue Jun  2 22:40:18 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 22:40:18 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433284818.291151.30343.nullmailer@dev.openssl.org>

The branch master has been updated
       via  133dce447b259e0bb93076bf5fd0ce475d16910a (commit)
      from  591b7aef05b22cba09b179e5787a9bf40dfc9508 (commit)


- Log -----------------------------------------------------------------
commit 133dce447b259e0bb93076bf5fd0ce475d16910a
Author: Matt Caswell <matt at openssl.org>
Date:   Tue Jun 2 20:18:05 2015 +0100

    Fix compilation failure for some tool chains
    
    Some tool chains (e.g. android) do not define IP_PMTUDISC_PROBE, and so
    this build breaks.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bss_dgram.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c
index 7cd57bf..3f6cd50 100644
--- a/crypto/bio/bss_dgram.c
+++ b/crypto/bio/bss_dgram.c
@@ -882,7 +882,7 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
                 perror("setsockopt");
                 ret = -1;
             }
-# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER)
+# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER) && defined (IP_PMTUDISC_PROBE)
             if ((sockopt_val = num ? IP_PMTUDISC_PROBE : IP_PMTUDISC_DONT),
                 (ret = setsockopt(b->num, IPPROTO_IP, IP_MTU_DISCOVER,
                                   &sockopt_val, sizeof(sockopt_val))) < 0) {

From matt at openssl.org  Tue Jun  2 22:40:39 2015
From: matt at openssl.org (Matt Caswell)
Date: Tue, 02 Jun 2015 22:40:39 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433284839.117050.31048.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  b1d5b8a4a47f0f3c0e10c904b3b0fdc53a235fd0 (commit)
      from  fb22f7406485f1c4e08dbf065d75146c2336b345 (commit)


- Log -----------------------------------------------------------------
commit b1d5b8a4a47f0f3c0e10c904b3b0fdc53a235fd0
Author: Matt Caswell <matt at openssl.org>
Date:   Tue Jun 2 20:18:05 2015 +0100

    Fix compilation failure for some tool chains
    
    Some tool chains (e.g. android) do not define IP_PMTUDISC_PROBE, and so
    this build breaks.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit 133dce447b259e0bb93076bf5fd0ce475d16910a)

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bss_dgram.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c
index 6493a38..7fcd831 100644
--- a/crypto/bio/bss_dgram.c
+++ b/crypto/bio/bss_dgram.c
@@ -897,7 +897,7 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
                 perror("setsockopt");
                 ret = -1;
             }
-# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER)
+# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER) && defined (IP_PMTUDISC_PROBE)
             if ((sockopt_val = num ? IP_PMTUDISC_PROBE : IP_PMTUDISC_DONT),
                 (ret = setsockopt(b->num, IPPROTO_IP, IP_MTU_DISCOVER,
                                   &sockopt_val, sizeof(sockopt_val))) < 0) {

From steve at openssl.org  Wed Jun  3 14:32:15 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Wed, 03 Jun 2015 14:32:15 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433341935.436421.1019.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  adba3b3bf1e82b9fe38c986baa7d3c9366a81fab (commit)
       via  ad0fb7f4988c8a717fe6bcb035304385fbdaef41 (commit)
      from  b1d5b8a4a47f0f3c0e10c904b3b0fdc53a235fd0 (commit)


- Log -----------------------------------------------------------------
commit adba3b3bf1e82b9fe38c986baa7d3c9366a81fab
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Mon Jun 1 12:50:47 2015 +0100

    make update
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit ad0fb7f4988c8a717fe6bcb035304385fbdaef41
Author: Sergey Agievich <agievich at gmail.com>
Date:   Mon Jun 1 12:48:27 2015 +0100

    Add funtions to set item_sign and item_verify
    
    PR#3872
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    Reviewed-by: Stephen Henson <steve at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/Makefile           | 22 ----------------------
 crypto/asn1/ameth_lib.c | 18 ++++++++++++++++++
 crypto/evp/evp.h        | 13 +++++++++++++
 crypto/x509v3/Makefile  | 32 ++++++++++++--------------------
 util/libeay.num         |  1 +
 5 files changed, 44 insertions(+), 42 deletions(-)

diff --git a/apps/Makefile b/apps/Makefile
index 963780f..a6c9d54 100644
--- a/apps/Makefile
+++ b/apps/Makefile
@@ -567,28 +567,6 @@ ocsp.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
 ocsp.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h
 ocsp.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
 ocsp.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h ocsp.c
-openssl.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
-openssl.o: ../include/openssl/buffer.h ../include/openssl/comp.h
-openssl.o: ../include/openssl/conf.h ../include/openssl/crypto.h
-openssl.o: ../include/openssl/dtls1.h ../include/openssl/e_os2.h
-openssl.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
-openssl.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
-openssl.o: ../include/openssl/err.h ../include/openssl/evp.h
-openssl.o: ../include/openssl/hmac.h ../include/openssl/kssl.h
-openssl.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-openssl.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
-openssl.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-openssl.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
-openssl.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
-openssl.o: ../include/openssl/pqueue.h ../include/openssl/rand.h
-openssl.o: ../include/openssl/safestack.h ../include/openssl/sha.h
-openssl.o: ../include/openssl/srtp.h ../include/openssl/ssl.h
-openssl.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
-openssl.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
-openssl.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h
-openssl.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
-openssl.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h
-openssl.o: openssl.c progs.h s_apps.h
 passwd.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 passwd.o: ../include/openssl/buffer.h ../include/openssl/conf.h
 passwd.o: ../include/openssl/crypto.h ../include/openssl/des.h
diff --git a/crypto/asn1/ameth_lib.c b/crypto/asn1/ameth_lib.c
index 02300df..5389c04 100644
--- a/crypto/asn1/ameth_lib.c
+++ b/crypto/asn1/ameth_lib.c
@@ -464,3 +464,21 @@ void EVP_PKEY_asn1_set_ctrl(EVP_PKEY_ASN1_METHOD *ameth,
 {
     ameth->pkey_ctrl = pkey_ctrl;
 }
+
+void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
+                            int (*item_verify) (EVP_MD_CTX *ctx,
+                                                const ASN1_ITEM *it,
+                                                void *asn,
+                                                X509_ALGOR *a,
+                                                ASN1_BIT_STRING *sig,
+                                                EVP_PKEY *pkey),
+                            int (*item_sign) (EVP_MD_CTX *ctx,
+                                              const ASN1_ITEM *it,
+                                              void *asn,
+                                              X509_ALGOR *alg1,
+                                              X509_ALGOR *alg2,
+                                              ASN1_BIT_STRING *sig))
+{
+    ameth->item_sign = item_sign;
+    ameth->item_verify = item_verify;
+}
diff --git a/crypto/evp/evp.h b/crypto/evp/evp.h
index 1d705cd..39ab793 100644
--- a/crypto/evp/evp.h
+++ b/crypto/evp/evp.h
@@ -1123,6 +1123,19 @@ void EVP_PKEY_asn1_set_free(EVP_PKEY_ASN1_METHOD *ameth,
 void EVP_PKEY_asn1_set_ctrl(EVP_PKEY_ASN1_METHOD *ameth,
                             int (*pkey_ctrl) (EVP_PKEY *pkey, int op,
                                               long arg1, void *arg2));
+void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
+                            int (*item_verify) (EVP_MD_CTX *ctx,
+                                                const ASN1_ITEM *it,
+                                                void *asn,
+                                                X509_ALGOR *a,
+                                                ASN1_BIT_STRING *sig,
+                                                EVP_PKEY *pkey),
+                            int (*item_sign) (EVP_MD_CTX *ctx,
+                                              const ASN1_ITEM *it,
+                                              void *asn,
+                                              X509_ALGOR *alg1,
+                                              X509_ALGOR *alg2,
+                                              ASN1_BIT_STRING *sig));
 
 # define EVP_PKEY_OP_UNDEFINED           0
 # define EVP_PKEY_OP_PARAMGEN            (1<<1)
diff --git a/crypto/x509v3/Makefile b/crypto/x509v3/Makefile
index 8cae749..9791b77 100644
--- a/crypto/x509v3/Makefile
+++ b/crypto/x509v3/Makefile
@@ -537,26 +537,18 @@ v3_purp.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
 v3_purp.o: ../cryptlib.h v3_purp.c
 v3_scts.o: ../../e_os.h ../../include/openssl/asn1.h
 v3_scts.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
-v3_scts.o: ../../include/openssl/comp.h ../../include/openssl/conf.h
-v3_scts.o: ../../include/openssl/crypto.h ../../include/openssl/dsa.h
-v3_scts.o: ../../include/openssl/dtls1.h ../../include/openssl/e_os2.h
-v3_scts.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
-v3_scts.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
-v3_scts.o: ../../include/openssl/evp.h ../../include/openssl/hmac.h
-v3_scts.o: ../../include/openssl/kssl.h ../../include/openssl/lhash.h
-v3_scts.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
-v3_scts.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-v3_scts.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pem.h
-v3_scts.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
-v3_scts.o: ../../include/openssl/pqueue.h ../../include/openssl/rsa.h
-v3_scts.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-v3_scts.o: ../../include/openssl/srtp.h ../../include/openssl/ssl.h
-v3_scts.o: ../../include/openssl/ssl2.h ../../include/openssl/ssl23.h
-v3_scts.o: ../../include/openssl/ssl3.h ../../include/openssl/stack.h
-v3_scts.o: ../../include/openssl/symhacks.h ../../include/openssl/tls1.h
-v3_scts.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-v3_scts.o: ../../include/openssl/x509v3.h ../../ssl/ssl_locl.h ../cryptlib.h
-v3_scts.o: v3_scts.c
+v3_scts.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+v3_scts.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+v3_scts.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+v3_scts.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+v3_scts.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+v3_scts.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+v3_scts.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+v3_scts.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
+v3_scts.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+v3_scts.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+v3_scts.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+v3_scts.o: ../cryptlib.h v3_scts.c
 v3_skey.o: ../../e_os.h ../../include/openssl/asn1.h
 v3_skey.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 v3_skey.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
diff --git a/util/libeay.num b/util/libeay.num
index b977e4e..7f7487d 100755
--- a/util/libeay.num
+++ b/util/libeay.num
@@ -4413,3 +4413,4 @@ ECDSA_METHOD_get_app_data               4770	EXIST::FUNCTION:ECDSA
 X509_VERIFY_PARAM_add1_host             4771	EXIST::FUNCTION:
 EC_GROUP_get_mont_data                  4772	EXIST::FUNCTION:EC
 i2d_re_X509_tbs                         4773	EXIST::FUNCTION:
+EVP_PKEY_asn1_set_item                  4774	EXIST::FUNCTION:

From steve at openssl.org  Wed Jun  3 14:40:29 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Wed, 03 Jun 2015 14:40:29 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433342429.510773.2909.nullmailer@dev.openssl.org>

The branch master has been updated
       via  97cacc537eba474d27dea0f96796b3b754e60034 (commit)
       via  3418f7b7b01139dbf4a72d2bc71135d918d4cf11 (commit)
      from  133dce447b259e0bb93076bf5fd0ce475d16910a (commit)


- Log -----------------------------------------------------------------
commit 97cacc537eba474d27dea0f96796b3b754e60034
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 3 15:37:39 2015 +0100

    make update.
    
    Make update with manual edit so EVP_PKEY_asn1_set_item uses the same
    ordinal as 1.0.2.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit 3418f7b7b01139dbf4a72d2bc71135d918d4cf11
Author: Sergey Agievich <agievich at gmail.com>
Date:   Mon Jun 1 12:48:27 2015 +0100

    Add funtions to set item_sign and item_verify
    
    PR#3872
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    Reviewed-by: Stephen Henson <steve at openssl.org>
    (cherry picked from commit ad0fb7f4988c8a717fe6bcb035304385fbdaef41)
    
    Conflicts:
    	crypto/asn1/ameth_lib.c

-----------------------------------------------------------------------

Summary of changes:
 crypto/asn1/ameth_lib.c | 18 ++++++++++++++++++
 crypto/bn/Makefile      |  2 +-
 include/openssl/evp.h   | 13 +++++++++++++
 util/libeay.num         |  4 ++--
 4 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/crypto/asn1/ameth_lib.c b/crypto/asn1/ameth_lib.c
index 1a61543..8060c18 100644
--- a/crypto/asn1/ameth_lib.c
+++ b/crypto/asn1/ameth_lib.c
@@ -466,3 +466,21 @@ void EVP_PKEY_asn1_set_security_bits(EVP_PKEY_ASN1_METHOD *ameth,
 {
     ameth->pkey_security_bits = pkey_security_bits;
 }
+
+void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
+                            int (*item_verify) (EVP_MD_CTX *ctx,
+                                                const ASN1_ITEM *it,
+                                                void *asn,
+                                                X509_ALGOR *a,
+                                                ASN1_BIT_STRING *sig,
+                                                EVP_PKEY *pkey),
+                            int (*item_sign) (EVP_MD_CTX *ctx,
+                                              const ASN1_ITEM *it,
+                                              void *asn,
+                                              X509_ALGOR *alg1,
+                                              X509_ALGOR *alg2,
+                                              ASN1_BIT_STRING *sig))
+{
+    ameth->item_sign = item_sign;
+    ameth->item_verify = item_verify;
+}
diff --git a/crypto/bn/Makefile b/crypto/bn/Makefile
index 7d55778..8875c41 100644
--- a/crypto/bn/Makefile
+++ b/crypto/bn/Makefile
@@ -247,7 +247,7 @@ bn_exp.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
 bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 bn_exp.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bn_exp.o: ../../include/openssl/symhacks.h ../include/internal/bn_int.h
-bn_exp.o: ../include/internal/cryptlib.h bn_exp.c bn_lcl.h rsaz_exp.h
+bn_exp.o: ../include/internal/cryptlib.h bn_exp.c bn_lcl.h
 bn_exp2.o: ../../e_os.h ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_exp2.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_exp2.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index dd4d701..dff81b0 100644
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -1171,6 +1171,19 @@ void EVP_PKEY_asn1_set_free(EVP_PKEY_ASN1_METHOD *ameth,
 void EVP_PKEY_asn1_set_ctrl(EVP_PKEY_ASN1_METHOD *ameth,
                             int (*pkey_ctrl) (EVP_PKEY *pkey, int op,
                                               long arg1, void *arg2));
+void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
+                            int (*item_verify) (EVP_MD_CTX *ctx,
+                                                const ASN1_ITEM *it,
+                                                void *asn,
+                                                X509_ALGOR *a,
+                                                ASN1_BIT_STRING *sig,
+                                                EVP_PKEY *pkey),
+                            int (*item_sign) (EVP_MD_CTX *ctx,
+                                              const ASN1_ITEM *it,
+                                              void *asn,
+                                              X509_ALGOR *alg1,
+                                              X509_ALGOR *alg2,
+                                              ASN1_BIT_STRING *sig));
 
 void EVP_PKEY_asn1_set_security_bits(EVP_PKEY_ASN1_METHOD *ameth,
                                      int (*pkey_security_bits) (const EVP_PKEY
diff --git a/util/libeay.num b/util/libeay.num
index 27460f0..c297ef7 100755
--- a/util/libeay.num
+++ b/util/libeay.num
@@ -4414,8 +4414,8 @@ ECDSA_METHOD_get_app_data               4770	EXIST::FUNCTION:EC
 X509_VERIFY_PARAM_add1_host             4771	EXIST::FUNCTION:
 EC_GROUP_get_mont_data                  4772	EXIST::FUNCTION:EC
 i2d_re_X509_tbs                         4773	EXIST::FUNCTION:
-RSA_security_bits                       4774	EXIST::FUNCTION:RSA
-FIPS_ecdsa_verify_digest                4775	NOEXIST::FUNCTION:
+EVP_PKEY_asn1_set_item                  4774	EXIST::FUNCTION:
+RSA_security_bits                       4775	EXIST::FUNCTION:RSA
 FIPS_ecdsa_verify                       4776	NOEXIST::FUNCTION:
 BN_security_bits                        4777	EXIST::FUNCTION:
 FIPS_ecdsa_verify_ctx                   4778	NOEXIST::FUNCTION:

From matt at openssl.org  Thu Jun  4 08:19:15 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 08:19:15 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433405955.756383.18102.nullmailer@dev.openssl.org>

The branch master has been updated
       via  7322abf5cefdeb47c7d61f3b916c428bf2cd69b6 (commit)
      from  97cacc537eba474d27dea0f96796b3b754e60034 (commit)


- Log -----------------------------------------------------------------
commit 7322abf5cefdeb47c7d61f3b916c428bf2cd69b6
Author: Matt Caswell <matt at openssl.org>
Date:   Wed May 6 11:40:06 2015 +0100

    Fix DTLS session resumption
    
    The session object on the client side is initially created during
    construction of the ClientHello. If the client is DTLS1.2 capable then it
    will store 1.2 as the version for the session. However if the server is only
    DTLS1.0 capable then when the ServerHello comes back the client switches to
    using DTLS1.0 from then on. However the session version does not get
    updated. Therefore when the client attempts to resume that session the
    server throws an alert because of an incorrect protocol version.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index d6f53b0..888fe4f 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1036,7 +1036,7 @@ int ssl3_get_server_hello(SSL *s)
             al = SSL_AD_PROTOCOL_VERSION;
             goto f_err;
         }
-        s->version = s->method->version;
+        s->session->ssl_version = s->version = s->method->version;
     } else if ((p[0] != (s->version >> 8)) || (p[1] != (s->version & 0xff))) {
         SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_WRONG_SSL_VERSION);
         s->version = (s->version & 0xff00) | p[1];

From matt at openssl.org  Thu Jun  4 08:19:26 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 08:19:26 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433405966.627653.18814.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  af3aa2b5ef741a35394c92872cbdbab4d46b9c90 (commit)
      from  adba3b3bf1e82b9fe38c986baa7d3c9366a81fab (commit)


- Log -----------------------------------------------------------------
commit af3aa2b5ef741a35394c92872cbdbab4d46b9c90
Author: Matt Caswell <matt at openssl.org>
Date:   Wed May 6 11:40:06 2015 +0100

    Fix DTLS session resumption
    
    The session object on the client side is initially created during
    construction of the ClientHello. If the client is DTLS1.2 capable then it
    will store 1.2 as the version for the session. However if the server is only
    DTLS1.0 capable then when the ServerHello comes back the client switches to
    using DTLS1.0 from then on. However the session version does not get
    updated. Therefore when the client attempts to resume that session the
    server throws an alert because of an incorrect protocol version.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit 7322abf5cefdeb47c7d61f3b916c428bf2cd69b6)
    
    Conflicts:
    	ssl/s3_clnt.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index feb1e3b..609b005 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -958,7 +958,7 @@ int ssl3_get_server_hello(SSL *s)
             al = SSL_AD_PROTOCOL_VERSION;
             goto f_err;
         }
-        s->version = s->method->version;
+        s->session->ssl_version = s->version = s->method->version;
     }
 
     if ((p[0] != (s->version >> 8)) || (p[1] != (s->version & 0xff))) {

From matt at openssl.org  Thu Jun  4 08:34:19 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 08:34:19 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433406859.092783.22164.nullmailer@dev.openssl.org>

The branch master has been updated
       via  c56353071d9849220714d8a556806703771b9269 (commit)
      from  7322abf5cefdeb47c7d61f3b916c428bf2cd69b6 (commit)


- Log -----------------------------------------------------------------
commit c56353071d9849220714d8a556806703771b9269
Author: Matt Caswell <matt at openssl.org>
Date:   Tue May 19 13:59:47 2015 +0100

    Fix off-by-one error in BN_bn2hex
    
    A BIGNUM can have the value of -0. The function BN_bn2hex fails to account
    for this and can allocate a buffer one byte too short in the event of -0
    being used, leading to a one byte buffer overrun. All usage within the
    OpenSSL library is considered safe. Any security risk is considered
    negligible.
    
    With thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke and
    Filip Palian for discovering and reporting this issue.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/bn_print.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
index b0b70b5..f528a36 100644
--- a/crypto/bn/bn_print.c
+++ b/crypto/bn/bn_print.c
@@ -71,7 +71,12 @@ char *BN_bn2hex(const BIGNUM *a)
     char *buf;
     char *p;
 
-    buf = OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    if (a->neg && BN_is_zero(a)) {
+        /* "-0" == 3 bytes including NULL terminator */
+        buf = OPENSSL_malloc(3);
+    } else {
+        buf = OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    }
     if (buf == NULL) {
         BNerr(BN_F_BN_BN2HEX, ERR_R_MALLOC_FAILURE);
         goto err;

From matt at openssl.org  Thu Jun  4 08:34:29 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 08:34:29 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433406869.217266.22884.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  361071993182c0a37d421e2ea9a1f84ec4f1ac4f (commit)
      from  af3aa2b5ef741a35394c92872cbdbab4d46b9c90 (commit)


- Log -----------------------------------------------------------------
commit 361071993182c0a37d421e2ea9a1f84ec4f1ac4f
Author: Matt Caswell <matt at openssl.org>
Date:   Tue May 19 13:59:47 2015 +0100

    Fix off-by-one error in BN_bn2hex
    
    A BIGNUM can have the value of -0. The function BN_bn2hex fails to account
    for this and can allocate a buffer one byte too short in the event of -0
    being used, leading to a one byte buffer overrun. All usage within the
    OpenSSL library is considered safe. Any security risk is considered
    negligible.
    
    With thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke and
    Filip Palian for discovering and reporting this issue.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit c56353071d9849220714d8a556806703771b9269)
    
    Conflicts:
    	crypto/bn/bn_print.c

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/bn_print.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
index 4dcaae3..ab10b95 100644
--- a/crypto/bn/bn_print.c
+++ b/crypto/bn/bn_print.c
@@ -71,7 +71,12 @@ char *BN_bn2hex(const BIGNUM *a)
     char *buf;
     char *p;
 
-    buf = (char *)OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    if (a->neg && BN_is_zero(a)) {
+        /* "-0" == 3 bytes including NULL terminator */
+        buf = OPENSSL_malloc(3);
+    } else {
+        buf = OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    }
     if (buf == NULL) {
         BNerr(BN_F_BN_BN2HEX, ERR_R_MALLOC_FAILURE);
         goto err;

From matt at openssl.org  Thu Jun  4 08:34:44 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 08:34:44 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433406884.774064.23129.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  05bdebb6e011459555795bab20f2e95786153dcc (commit)
      from  32b2ad7e071d0e766da6956f5b0c9cf2ccb18388 (commit)


- Log -----------------------------------------------------------------
commit 05bdebb6e011459555795bab20f2e95786153dcc
Author: Matt Caswell <matt at openssl.org>
Date:   Tue May 19 13:59:47 2015 +0100

    Fix off-by-one error in BN_bn2hex
    
    A BIGNUM can have the value of -0. The function BN_bn2hex fails to account
    for this and can allocate a buffer one byte too short in the event of -0
    being used, leading to a one byte buffer overrun. All usage within the
    OpenSSL library is considered safe. Any security risk is considered
    negligible.
    
    With thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke and
    Filip Palian for discovering and reporting this issue.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit c56353071d9849220714d8a556806703771b9269)
    
    Conflicts:
    	crypto/bn/bn_print.c

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/bn_print.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
index 4dcaae3..ab10b95 100644
--- a/crypto/bn/bn_print.c
+++ b/crypto/bn/bn_print.c
@@ -71,7 +71,12 @@ char *BN_bn2hex(const BIGNUM *a)
     char *buf;
     char *p;
 
-    buf = (char *)OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    if (a->neg && BN_is_zero(a)) {
+        /* "-0" == 3 bytes including NULL terminator */
+        buf = OPENSSL_malloc(3);
+    } else {
+        buf = OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    }
     if (buf == NULL) {
         BNerr(BN_F_BN_BN2HEX, ERR_R_MALLOC_FAILURE);
         goto err;

From matt at openssl.org  Thu Jun  4 08:35:12 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 08:35:12 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433406912.143202.23421.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  0d3a7e7c9147357ca69993944a279cd0931963d5 (commit)
      from  a85eef72f5c12b1efbcf7abcbbabf0140fb997bf (commit)


- Log -----------------------------------------------------------------
commit 0d3a7e7c9147357ca69993944a279cd0931963d5
Author: Matt Caswell <matt at openssl.org>
Date:   Tue May 19 13:59:47 2015 +0100

    Fix off-by-one error in BN_bn2hex
    
    A BIGNUM can have the value of -0. The function BN_bn2hex fails to account
    for this and can allocate a buffer one byte too short in the event of -0
    being used, leading to a one byte buffer overrun. All usage within the
    OpenSSL library is considered safe. Any security risk is considered
    negligible.
    
    With thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke and
    Filip Palian for discovering and reporting this issue.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit c56353071d9849220714d8a556806703771b9269)
    
    Conflicts:
    	crypto/bn/bn_print.c

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/bn_print.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
index a55836f..937d513 100644
--- a/crypto/bn/bn_print.c
+++ b/crypto/bn/bn_print.c
@@ -71,7 +71,12 @@ char *BN_bn2hex(const BIGNUM *a)
     char *buf;
     char *p;
 
-    buf = (char *)OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    if (a->neg && BN_is_zero(a)) {
+        /* "-0" == 3 bytes including NULL terminator */
+        buf = OPENSSL_malloc(3);
+    } else {
+        buf = OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    }
     if (buf == NULL) {
         BNerr(BN_F_BN_BN2HEX, ERR_R_MALLOC_FAILURE);
         goto err;

From matt at openssl.org  Thu Jun  4 08:35:27 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 08:35:27 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1433406927.317176.23681.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  9759ff0cd908270fad328ba7f35fed021e619868 (commit)
      from  f9603f2673154bfba52d24654bc6e5f5dd19a88a (commit)


- Log -----------------------------------------------------------------
commit 9759ff0cd908270fad328ba7f35fed021e619868
Author: Matt Caswell <matt at openssl.org>
Date:   Tue May 19 13:59:47 2015 +0100

    Fix off-by-one error in BN_bn2hex
    
    A BIGNUM can have the value of -0. The function BN_bn2hex fails to account
    for this and can allocate a buffer one byte too short in the event of -0
    being used, leading to a one byte buffer overrun. All usage within the
    OpenSSL library is considered safe. Any security risk is considered
    negligible.
    
    With thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke and
    Filip Palian for discovering and reporting this issue.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit c56353071d9849220714d8a556806703771b9269)
    
    Conflicts:
    	crypto/bn/bn_print.c

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/bn_print.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
index 15bc51a..6117653 100644
--- a/crypto/bn/bn_print.c
+++ b/crypto/bn/bn_print.c
@@ -71,7 +71,12 @@ char *BN_bn2hex(const BIGNUM *a)
     char *buf;
     char *p;
 
-    buf = (char *)OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    if (a->neg && BN_is_zero(a)) {
+        /* "-0" == 3 bytes including NULL terminator */
+        buf = OPENSSL_malloc(3);
+    } else {
+        buf = OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
+    }
     if (buf == NULL) {
         BNerr(BN_F_BN_BN2HEX, ERR_R_MALLOC_FAILURE);
         goto err;

From matt at openssl.org  Thu Jun  4 11:48:15 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 11:48:15 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433418495.740514.20624.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  4e3dbe37ca39fa68b6949fbde62f3ec0f0584f7e (commit)
      from  361071993182c0a37d421e2ea9a1f84ec4f1ac4f (commit)


- Log -----------------------------------------------------------------
commit 4e3dbe37ca39fa68b6949fbde62f3ec0f0584f7e
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:41:30 2015 +0100

    Clean Kerberos pre-master secret
    
    Ensure the Kerberos pre-master secret has OPENSSL_cleanse called on it.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_srvr.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index f0a16c4..de984c8 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2411,6 +2411,7 @@ int ssl3_get_client_key_exchange(SSL *s)
         int padl, outl;
         krb5_timestamp authtime = 0;
         krb5_ticket_times ttimes;
+        int kerr = 0;
 
         EVP_CIPHER_CTX_init(&ciph_ctx);
 
@@ -2514,23 +2515,27 @@ int ssl3_get_client_key_exchange(SSL *s)
         {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DECRYPTION_FAILED);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (outl > SSL_MAX_MASTER_KEY_LENGTH) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DATA_LENGTH_TOO_LONG);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (!EVP_DecryptFinal_ex(&ciph_ctx, &(pms[outl]), &padl)) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DECRYPTION_FAILED);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         outl += padl;
         if (outl > SSL_MAX_MASTER_KEY_LENGTH) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DATA_LENGTH_TOO_LONG);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (!((pms[0] == (s->client_version >> 8))
               && (pms[1] == (s->client_version & 0xff)))) {
@@ -2547,7 +2552,8 @@ int ssl3_get_client_key_exchange(SSL *s)
             if (!(s->options & SSL_OP_TLS_ROLLBACK_BUG)) {
                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                        SSL_AD_DECODE_ERROR);
-                goto err;
+                kerr = 1;
+                goto kclean;
             }
         }
 
@@ -2573,6 +2579,11 @@ int ssl3_get_client_key_exchange(SSL *s)
          *  kssl_ctx = kssl_ctx_free(kssl_ctx);
          *  if (s->kssl_ctx)  s->kssl_ctx = NULL;
          */
+
+ kclean:
+        OPENSSL_cleanse(pms, sizeof(pms));
+        if (kerr)
+            goto err;
     } else
 #endif                          /* OPENSSL_NO_KRB5 */
 

From matt at openssl.org  Thu Jun  4 11:48:38 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 11:48:38 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433418518.847212.21241.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  91e64e142770bc13145346a5e89e9d95bc3e22dd (commit)
      from  0d3a7e7c9147357ca69993944a279cd0931963d5 (commit)


- Log -----------------------------------------------------------------
commit 91e64e142770bc13145346a5e89e9d95bc3e22dd
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:41:30 2015 +0100

    Clean Kerberos pre-master secret
    
    Ensure the Kerberos pre-master secret has OPENSSL_cleanse called on it.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 4e3dbe37ca39fa68b6949fbde62f3ec0f0584f7e)

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_srvr.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 8e30083..8d3244f 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2215,6 +2215,7 @@ int ssl3_get_client_key_exchange(SSL *s)
         int padl, outl;
         krb5_timestamp authtime = 0;
         krb5_ticket_times ttimes;
+        int kerr = 0;
 
         EVP_CIPHER_CTX_init(&ciph_ctx);
 
@@ -2317,23 +2318,27 @@ int ssl3_get_client_key_exchange(SSL *s)
         {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DECRYPTION_FAILED);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (outl > SSL_MAX_MASTER_KEY_LENGTH) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DATA_LENGTH_TOO_LONG);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (!EVP_DecryptFinal_ex(&ciph_ctx, &(pms[outl]), &padl)) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DECRYPTION_FAILED);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         outl += padl;
         if (outl > SSL_MAX_MASTER_KEY_LENGTH) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DATA_LENGTH_TOO_LONG);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (!((pms[0] == (s->client_version >> 8))
               && (pms[1] == (s->client_version & 0xff)))) {
@@ -2350,7 +2355,8 @@ int ssl3_get_client_key_exchange(SSL *s)
             if (!(s->options & SSL_OP_TLS_ROLLBACK_BUG)) {
                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                        SSL_AD_DECODE_ERROR);
-                goto err;
+                kerr = 1;
+                goto kclean;
             }
         }
 
@@ -2376,6 +2382,11 @@ int ssl3_get_client_key_exchange(SSL *s)
          *  kssl_ctx = kssl_ctx_free(kssl_ctx);
          *  if (s->kssl_ctx)  s->kssl_ctx = NULL;
          */
+
+ kclean:
+        OPENSSL_cleanse(pms, sizeof(pms));
+        if (kerr)
+            goto err;
     } else
 #endif                          /* OPENSSL_NO_KRB5 */
 

From matt at openssl.org  Thu Jun  4 11:48:28 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 11:48:28 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433418508.228329.20950.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  c36d3840ff45a290ea7fe6fbaf1520fe3124b3cd (commit)
      from  05bdebb6e011459555795bab20f2e95786153dcc (commit)


- Log -----------------------------------------------------------------
commit c36d3840ff45a290ea7fe6fbaf1520fe3124b3cd
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:41:30 2015 +0100

    Clean Kerberos pre-master secret
    
    Ensure the Kerberos pre-master secret has OPENSSL_cleanse called on it.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 4e3dbe37ca39fa68b6949fbde62f3ec0f0584f7e)

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_srvr.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index cb6ef0a..d07f768 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2423,6 +2423,7 @@ int ssl3_get_client_key_exchange(SSL *s)
         int padl, outl;
         krb5_timestamp authtime = 0;
         krb5_ticket_times ttimes;
+        int kerr = 0;
 
         EVP_CIPHER_CTX_init(&ciph_ctx);
 
@@ -2526,23 +2527,27 @@ int ssl3_get_client_key_exchange(SSL *s)
         {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DECRYPTION_FAILED);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (outl > SSL_MAX_MASTER_KEY_LENGTH) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DATA_LENGTH_TOO_LONG);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (!EVP_DecryptFinal_ex(&ciph_ctx, &(pms[outl]), &padl)) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DECRYPTION_FAILED);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         outl += padl;
         if (outl > SSL_MAX_MASTER_KEY_LENGTH) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DATA_LENGTH_TOO_LONG);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (!((pms[0] == (s->client_version >> 8))
               && (pms[1] == (s->client_version & 0xff)))) {
@@ -2559,7 +2564,8 @@ int ssl3_get_client_key_exchange(SSL *s)
             if (!(s->options & SSL_OP_TLS_ROLLBACK_BUG)) {
                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                        SSL_AD_DECODE_ERROR);
-                goto err;
+                kerr = 1;
+                goto kclean;
             }
         }
 
@@ -2585,6 +2591,11 @@ int ssl3_get_client_key_exchange(SSL *s)
          *  kssl_ctx = kssl_ctx_free(kssl_ctx);
          *  if (s->kssl_ctx)  s->kssl_ctx = NULL;
          */
+
+ kclean:
+        OPENSSL_cleanse(pms, sizeof(pms));
+        if (kerr)
+            goto err;
     } else
 #endif                          /* OPENSSL_NO_KRB5 */
 

From matt at openssl.org  Thu Jun  4 11:48:53 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 11:48:53 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1433418533.179108.21513.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  f803a417f7ad13a22d250aeba44ba85911a2b593 (commit)
      from  9759ff0cd908270fad328ba7f35fed021e619868 (commit)


- Log -----------------------------------------------------------------
commit f803a417f7ad13a22d250aeba44ba85911a2b593
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:41:30 2015 +0100

    Clean Kerberos pre-master secret
    
    Ensure the Kerberos pre-master secret has OPENSSL_cleanse called on it.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 4e3dbe37ca39fa68b6949fbde62f3ec0f0584f7e)

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_srvr.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index fe7f685..8749ea2 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2009,6 +2009,7 @@ int ssl3_get_client_key_exchange(SSL *s)
         int padl, outl;
         krb5_timestamp authtime = 0;
         krb5_ticket_times ttimes;
+        int kerr = 0;
 
         EVP_CIPHER_CTX_init(&ciph_ctx);
 
@@ -2111,23 +2112,27 @@ int ssl3_get_client_key_exchange(SSL *s)
         {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DECRYPTION_FAILED);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (outl > SSL_MAX_MASTER_KEY_LENGTH) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DATA_LENGTH_TOO_LONG);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (!EVP_DecryptFinal_ex(&ciph_ctx, &(pms[outl]), &padl)) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DECRYPTION_FAILED);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         outl += padl;
         if (outl > SSL_MAX_MASTER_KEY_LENGTH) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                    SSL_R_DATA_LENGTH_TOO_LONG);
-            goto err;
+            kerr = 1;
+            goto kclean;
         }
         if (!((pms[0] == (s->client_version >> 8))
               && (pms[1] == (s->client_version & 0xff)))) {
@@ -2144,7 +2149,8 @@ int ssl3_get_client_key_exchange(SSL *s)
             if (!(s->options & SSL_OP_TLS_ROLLBACK_BUG)) {
                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                        SSL_AD_DECODE_ERROR);
-                goto err;
+                kerr = 1;
+                goto kclean;
             }
         }
 
@@ -2170,6 +2176,11 @@ int ssl3_get_client_key_exchange(SSL *s)
          *  kssl_ctx = kssl_ctx_free(kssl_ctx);
          *  if (s->kssl_ctx)  s->kssl_ctx = NULL;
          */
+
+ kclean:
+        OPENSSL_cleanse(pms, sizeof(pms));
+        if (kerr)
+            goto err;
     } else
 #endif                          /* OPENSSL_NO_KRB5 */
 

From matt at openssl.org  Thu Jun  4 11:59:47 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 11:59:47 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433419187.402019.23070.nullmailer@dev.openssl.org>

The branch master has been updated
       via  f3d889523ee84f1e87e4da0d59e2702a4bee7907 (commit)
       via  b7ee4815f2452c854cc859e8dda88f2673cdddea (commit)
      from  c56353071d9849220714d8a556806703771b9269 (commit)


- Log -----------------------------------------------------------------
commit f3d889523ee84f1e87e4da0d59e2702a4bee7907
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:18:55 2015 +0100

    Remove misleading comment
    
    Remove a comment that suggested further clean up was required.
    DH_free() performs the necessary cleanup.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit b7ee4815f2452c854cc859e8dda88f2673cdddea
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:16:16 2015 +0100

    Clean premaster_secret for GOST
    
    Ensure OPENSSL_cleanse() is called on the premaster secret value calculated for GOST.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c | 2 --
 ssl/s3_srvr.c | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 888fe4f..632d743 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2572,8 +2572,6 @@ int ssl3_send_client_key_exchange(SSL *s)
             }
 
             DH_free(dh_clnt);
-
-            /* perhaps clean things up a bit EAY EAY EAY EAY */
         }
 #endif
 
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 88e649d..90a67d1 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2825,6 +2825,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                                                         s->
                                                         session->master_key,
                                                         premaster_secret, 32);
+        OPENSSL_cleanse(premaster_secret, sizeof(premaster_secret));
         if (s->session->master_key_length < 0) {
             al = SSL_AD_INTERNAL_ERROR;
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);

From matt at openssl.org  Thu Jun  4 12:00:10 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 12:00:10 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433419210.867889.24269.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  c22ed559bbb6e75d03ce4e8cb3655988fc123d4f (commit)
       via  4b6f33a5c284168ef3aa49d1a37cbcc6565bc0e5 (commit)
      from  c36d3840ff45a290ea7fe6fbaf1520fe3124b3cd (commit)


- Log -----------------------------------------------------------------
commit c22ed559bbb6e75d03ce4e8cb3655988fc123d4f
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:18:55 2015 +0100

    Remove misleading comment
    
    Remove a comment that suggested further clean up was required.
    DH_free() performs the necessary cleanup.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit f3d889523ee84f1e87e4da0d59e2702a4bee7907)

commit 4b6f33a5c284168ef3aa49d1a37cbcc6565bc0e5
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:16:16 2015 +0100

    Clean premaster_secret for GOST
    
    Ensure OPENSSL_cleanse() is called on the premaster secret value calculated for GOST.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit b7ee4815f2452c854cc859e8dda88f2673cdddea)
    
    Conflicts:
    	ssl/s3_srvr.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c | 2 --
 ssl/s3_srvr.c | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index eb7b94e..f435899 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2595,8 +2595,6 @@ int ssl3_send_client_key_exchange(SSL *s)
             n += 2;
 
             DH_free(dh_clnt);
-
-            /* perhaps clean things up a bit EAY EAY EAY EAY */
         }
 #endif
 
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index d07f768..9aa3292 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2914,6 +2914,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                                                         s->
                                                         session->master_key,
                                                         premaster_secret, 32);
+        OPENSSL_cleanse(premaster_secret, sizeof(premaster_secret));
         /* Check if pubkey from client certificate was used */
         if (EVP_PKEY_CTX_ctrl
             (pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)

From matt at openssl.org  Thu Jun  4 11:59:58 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 11:59:58 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433419198.393522.23907.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  da5fab73255c24e0b6ce8717df2441a03f504939 (commit)
       via  efd89aa9cc7ed1142be8a4baa49567170bc4626e (commit)
      from  4e3dbe37ca39fa68b6949fbde62f3ec0f0584f7e (commit)


- Log -----------------------------------------------------------------
commit da5fab73255c24e0b6ce8717df2441a03f504939
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:18:55 2015 +0100

    Remove misleading comment
    
    Remove a comment that suggested further clean up was required.
    DH_free() performs the necessary cleanup.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit f3d889523ee84f1e87e4da0d59e2702a4bee7907)

commit efd89aa9cc7ed1142be8a4baa49567170bc4626e
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:16:16 2015 +0100

    Clean premaster_secret for GOST
    
    Ensure OPENSSL_cleanse() is called on the premaster secret value calculated for GOST.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit b7ee4815f2452c854cc859e8dda88f2673cdddea)
    
    Conflicts:
    	ssl/s3_srvr.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c | 2 --
 ssl/s3_srvr.c | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 609b005..c495641 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2721,8 +2721,6 @@ int ssl3_send_client_key_exchange(SSL *s)
             }
 
             DH_free(dh_clnt);
-
-            /* perhaps clean things up a bit EAY EAY EAY EAY */
         }
 #endif
 
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index de984c8..8885694 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2902,6 +2902,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                                                         s->
                                                         session->master_key,
                                                         premaster_secret, 32);
+        OPENSSL_cleanse(premaster_secret, sizeof(premaster_secret));
         /* Check if pubkey from client certificate was used */
         if (EVP_PKEY_CTX_ctrl
             (pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)

From matt at openssl.org  Thu Jun  4 12:00:21 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 04 Jun 2015 12:00:21 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433419221.250970.24536.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  bb82db1c776ec85b9a63f79fa04b001fb7d46fc7 (commit)
       via  470446db9a0861b01cba33dd42062ecc5734df53 (commit)
      from  91e64e142770bc13145346a5e89e9d95bc3e22dd (commit)


- Log -----------------------------------------------------------------
commit bb82db1c776ec85b9a63f79fa04b001fb7d46fc7
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:18:55 2015 +0100

    Remove misleading comment
    
    Remove a comment that suggested further clean up was required.
    DH_free() performs the necessary cleanup.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit f3d889523ee84f1e87e4da0d59e2702a4bee7907)

commit 470446db9a0861b01cba33dd42062ecc5734df53
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 11:16:16 2015 +0100

    Clean premaster_secret for GOST
    
    Ensure OPENSSL_cleanse() is called on the premaster secret value calculated for GOST.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit b7ee4815f2452c854cc859e8dda88f2673cdddea)
    
    Conflicts:
    	ssl/s3_srvr.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c | 2 --
 ssl/s3_srvr.c | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index f906389..980c74c 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2307,8 +2307,6 @@ int ssl3_send_client_key_exchange(SSL *s)
             n += 2;
 
             DH_free(dh_clnt);
-
-            /* perhaps clean things up a bit EAY EAY EAY EAY */
         }
 #endif
 
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 8d3244f..7ebcca6 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2664,6 +2664,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                                                         s->
                                                         session->master_key,
                                                         premaster_secret, 32);
+        OPENSSL_cleanse(premaster_secret, sizeof(premaster_secret));
         /* Check if pubkey from client certificate was used */
         if (EVP_PKEY_CTX_ctrl
             (pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)

From rsalz at openssl.org  Thu Jun  4 13:47:31 2015
From: rsalz at openssl.org (Rich Salz)
Date: Thu, 04 Jun 2015 13:47:31 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433425651.474492.9249.nullmailer@dev.openssl.org>

The branch master has been updated
       via  9c422b5b1ebc9871a7306f66648aa16c8769082a (commit)
      from  f3d889523ee84f1e87e4da0d59e2702a4bee7907 (commit)


- Log -----------------------------------------------------------------
commit 9c422b5b1ebc9871a7306f66648aa16c8769082a
Author: Rich Salz <rsalz at akamai.com>
Date:   Wed Jun 3 22:04:48 2015 -0400

    Rename all static TS_xxx to ts_xxx
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/ts/ts_conf.c       |  46 +++++++--------
 crypto/ts/ts_rsp_print.c  |  12 ++--
 crypto/ts/ts_rsp_sign.c   |  62 ++++++++++-----------
 crypto/ts/ts_rsp_verify.c | 139 ++++++++++++++++++++--------------------------
 4 files changed, 121 insertions(+), 138 deletions(-)

diff --git a/crypto/ts/ts_conf.c b/crypto/ts/ts_conf.c
index 1e511be..4d303f7 100644
--- a/crypto/ts/ts_conf.c
+++ b/crypto/ts/ts_conf.c
@@ -152,12 +152,12 @@ EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
 
 /* Function definitions for handling configuration options. */
 
-static void TS_CONF_lookup_fail(const char *name, const char *tag)
+static void ts_CONF_lookup_fail(const char *name, const char *tag)
 {
     fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
 }
 
-static void TS_CONF_invalid(const char *name, const char *tag)
+static void ts_CONF_invalid(const char *name, const char *tag)
 {
     fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
 }
@@ -167,7 +167,7 @@ const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
     if (!section) {
         section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
         if (!section)
-            TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
+            ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
     }
     return section;
 }
@@ -178,7 +178,7 @@ int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
     int ret = 0;
     char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
     if (!serial) {
-        TS_CONF_lookup_fail(section, ENV_SERIAL);
+        ts_CONF_lookup_fail(section, ENV_SERIAL);
         goto err;
     }
     TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
@@ -199,7 +199,7 @@ int TS_CONF_set_crypto_device(CONF *conf, const char *section,
         device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
 
     if (device && !TS_CONF_set_default_engine(device)) {
-        TS_CONF_invalid(section, ENV_CRYPTO_DEVICE);
+        ts_CONF_invalid(section, ENV_CRYPTO_DEVICE);
         goto err;
     }
     ret = 1;
@@ -246,7 +246,7 @@ int TS_CONF_set_signer_cert(CONF *conf, const char *section,
     if (cert == NULL) {
         cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
         if (cert == NULL) {
-            TS_CONF_lookup_fail(section, ENV_SIGNER_CERT);
+            ts_CONF_lookup_fail(section, ENV_SIGNER_CERT);
             goto err;
         }
     }
@@ -292,7 +292,7 @@ int TS_CONF_set_signer_key(CONF *conf, const char *section,
     if (!key)
         key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
     if (!key) {
-        TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
+        ts_CONF_lookup_fail(section, ENV_SIGNER_KEY);
         goto err;
     }
     if ((key_obj = TS_CONF_load_key(key, pass)) == NULL)
@@ -314,11 +314,11 @@ int TS_CONF_set_def_policy(CONF *conf, const char *section,
     if (!policy)
         policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
     if (!policy) {
-        TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
+        ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
         goto err;
     }
     if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) {
-        TS_CONF_invalid(section, ENV_DEFAULT_POLICY);
+        ts_CONF_invalid(section, ENV_DEFAULT_POLICY);
         goto err;
     }
     if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
@@ -339,7 +339,7 @@ int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
 
     /* If no other policy is specified, that's fine. */
     if (policies && (list = X509V3_parse_list(policies)) == NULL) {
-        TS_CONF_invalid(section, ENV_OTHER_POLICIES);
+        ts_CONF_invalid(section, ENV_OTHER_POLICIES);
         goto err;
     }
     for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
@@ -348,7 +348,7 @@ int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
         ASN1_OBJECT *objtmp;
 
         if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) {
-            TS_CONF_invalid(section, ENV_OTHER_POLICIES);
+            ts_CONF_invalid(section, ENV_OTHER_POLICIES);
             goto err;
         }
         if (!TS_RESP_CTX_add_policy(ctx, objtmp))
@@ -370,15 +370,15 @@ int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
     char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
 
     if (digests == NULL) {
-        TS_CONF_lookup_fail(section, ENV_DIGESTS);
+        ts_CONF_lookup_fail(section, ENV_DIGESTS);
         goto err;
     }
     if ((list = X509V3_parse_list(digests)) == NULL) {
-        TS_CONF_invalid(section, ENV_DIGESTS);
+        ts_CONF_invalid(section, ENV_DIGESTS);
         goto err;
     }
     if (sk_CONF_VALUE_num(list) == 0) {
-        TS_CONF_invalid(section, ENV_DIGESTS);
+        ts_CONF_invalid(section, ENV_DIGESTS);
         goto err;
     }
     for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
@@ -387,7 +387,7 @@ int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
         const EVP_MD *md;
 
         if ((md = EVP_get_digestbyname(extval)) == NULL) {
-            TS_CONF_invalid(section, ENV_DIGESTS);
+            ts_CONF_invalid(section, ENV_DIGESTS);
             goto err;
         }
         if (!TS_RESP_CTX_add_md(ctx, md))
@@ -409,7 +409,7 @@ int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
     char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
 
     if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) {
-        TS_CONF_invalid(section, ENV_ACCURACY);
+        ts_CONF_invalid(section, ENV_ACCURACY);
         goto err;
     }
     for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
@@ -424,7 +424,7 @@ int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
             if (val->value)
                 micros = atoi(val->value);
         } else {
-            TS_CONF_invalid(section, ENV_ACCURACY);
+            ts_CONF_invalid(section, ENV_ACCURACY);
             goto err;
         }
     }
@@ -450,7 +450,7 @@ int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
                             &digits))
         digits = 0;
     if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
-        TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
+        ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
         goto err;
     }
 
@@ -462,7 +462,7 @@ int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
     return ret;
 }
 
-static int TS_CONF_add_flag(CONF *conf, const char *section,
+static int ts_CONF_add_flag(CONF *conf, const char *section,
                             const char *field, int flag, TS_RESP_CTX *ctx)
 {
     /* Default is false. */
@@ -471,7 +471,7 @@ static int TS_CONF_add_flag(CONF *conf, const char *section,
         if (strcmp(value, ENV_VALUE_YES) == 0)
             TS_RESP_CTX_add_flags(ctx, flag);
         else if (strcmp(value, ENV_VALUE_NO) != 0) {
-            TS_CONF_invalid(section, field);
+            ts_CONF_invalid(section, field);
             return 0;
         }
     }
@@ -481,17 +481,17 @@ static int TS_CONF_add_flag(CONF *conf, const char *section,
 
 int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
 {
-    return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
+    return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
 }
 
 int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
 {
-    return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
+    return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
 }
 
 int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
                                   TS_RESP_CTX *ctx)
 {
-    return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
+    return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
                             TS_ESS_CERT_ID_CHAIN, ctx);
 }
diff --git a/crypto/ts/ts_rsp_print.c b/crypto/ts/ts_rsp_print.c
index 108cd2f..b71985f 100644
--- a/crypto/ts/ts_rsp_print.c
+++ b/crypto/ts/ts_rsp_print.c
@@ -71,9 +71,9 @@ struct status_map_st {
 
 /* Local function declarations. */
 
-static int TS_status_map_print(BIO *bio, const struct status_map_st *a,
+static int ts_status_map_print(BIO *bio, const struct status_map_st *a,
                                const ASN1_BIT_STRING *v);
-static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy);
+static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy);
 
 /* Function definitions. */
 
@@ -149,7 +149,7 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
     /* Printing failure information. */
     BIO_printf(bio, "Failure info: ");
     if (a->failure_info != NULL)
-        lines = TS_status_map_print(bio, failure_map, a->failure_info);
+        lines = ts_status_map_print(bio, failure_map, a->failure_info);
     if (lines == 0)
         BIO_printf(bio, "unspecified");
     BIO_printf(bio, "\n");
@@ -157,7 +157,7 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
     return 1;
 }
 
-static int TS_status_map_print(BIO *bio, const struct status_map_st *a,
+static int ts_status_map_print(BIO *bio, const struct status_map_st *a,
                                const ASN1_BIT_STRING *v)
 {
     int lines = 0;
@@ -219,7 +219,7 @@ int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)
     if (accuracy == NULL)
         BIO_printf(bio, "unspecified");
     else
-        TS_ACCURACY_print_bio(bio, accuracy);
+        ts_ACCURACY_print_bio(bio, accuracy);
     BIO_write(bio, "\n", 1);
 
     /* Print ordering. */
@@ -254,7 +254,7 @@ int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)
     return 1;
 }
 
-static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy)
+static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy)
 {
     const ASN1_INTEGER *seconds = TS_ACCURACY_get_seconds(accuracy);
     const ASN1_INTEGER *millis = TS_ACCURACY_get_millis(accuracy);
diff --git a/crypto/ts/ts_rsp_sign.c b/crypto/ts/ts_rsp_sign.c
index c28d936..d90d33f 100644
--- a/crypto/ts/ts_rsp_sign.c
+++ b/crypto/ts/ts_rsp_sign.c
@@ -73,19 +73,19 @@ static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *);
 static int def_time_cb(struct TS_resp_ctx *, void *, long *sec, long *usec);
 static int def_extension_cb(struct TS_resp_ctx *, X509_EXTENSION *, void *);
 
-static void TS_RESP_CTX_init(TS_RESP_CTX *ctx);
-static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
-static int TS_RESP_check_request(TS_RESP_CTX *ctx);
-static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx);
-static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
+static void ts_RESP_CTX_init(TS_RESP_CTX *ctx);
+static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
+static int ts_RESP_check_request(TS_RESP_CTX *ctx);
+static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx);
+static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
                                             ASN1_OBJECT *policy);
-static int TS_RESP_process_extensions(TS_RESP_CTX *ctx);
-static int TS_RESP_sign(TS_RESP_CTX *ctx);
+static int ts_RESP_process_extensions(TS_RESP_CTX *ctx);
+static int ts_RESP_sign(TS_RESP_CTX *ctx);
 
-static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
+static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
                                                    STACK_OF(X509) *certs);
-static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
-static int TS_TST_INFO_content_new(PKCS7 *p7);
+static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed);
+static int ts_TST_INFO_content_new(PKCS7 *p7);
 static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
 
 static ASN1_GENERALIZEDTIME
@@ -427,7 +427,7 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
     TS_RESP *response;
     int result = 0;
 
-    TS_RESP_CTX_init(ctx);
+    ts_RESP_CTX_init(ctx);
 
     /* Creating the response object. */
     if ((ctx->response = TS_RESP_new()) == NULL) {
@@ -448,23 +448,23 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
         goto end;
 
     /* Checking the request format. */
-    if (!TS_RESP_check_request(ctx))
+    if (!ts_RESP_check_request(ctx))
         goto end;
 
     /* Checking acceptable policies. */
-    if ((policy = TS_RESP_get_policy(ctx)) == NULL)
+    if ((policy = ts_RESP_get_policy(ctx)) == NULL)
         goto end;
 
     /* Creating the TS_TST_INFO object. */
-    if ((ctx->tst_info = TS_RESP_create_tst_info(ctx, policy)) == NULL)
+    if ((ctx->tst_info = ts_RESP_create_tst_info(ctx, policy)) == NULL)
         goto end;
 
     /* Processing extensions. */
-    if (!TS_RESP_process_extensions(ctx))
+    if (!ts_RESP_process_extensions(ctx))
         goto end;
 
     /* Generating the signature. */
-    if (!TS_RESP_sign(ctx))
+    if (!ts_RESP_sign(ctx))
         goto end;
 
     /* Everything was successful. */
@@ -484,12 +484,12 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
     }
     response = ctx->response;
     ctx->response = NULL;       /* Ownership will be returned to caller. */
-    TS_RESP_CTX_cleanup(ctx);
+    ts_RESP_CTX_cleanup(ctx);
     return response;
 }
 
 /* Initializes the variable part of the context. */
-static void TS_RESP_CTX_init(TS_RESP_CTX *ctx)
+static void ts_RESP_CTX_init(TS_RESP_CTX *ctx)
 {
     ctx->request = NULL;
     ctx->response = NULL;
@@ -497,7 +497,7 @@ static void TS_RESP_CTX_init(TS_RESP_CTX *ctx)
 }
 
 /* Cleans up the variable part of the context. */
-static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
+static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
 {
     TS_REQ_free(ctx->request);
     ctx->request = NULL;
@@ -508,7 +508,7 @@ static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
 }
 
 /* Checks the format and content of the request. */
-static int TS_RESP_check_request(TS_RESP_CTX *ctx)
+static int ts_RESP_check_request(TS_RESP_CTX *ctx)
 {
     TS_REQ *request = ctx->request;
     TS_MSG_IMPRINT *msg_imprint;
@@ -564,7 +564,7 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
 }
 
 /* Returns the TSA policy based on the requested and acceptable policies. */
-static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
+static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx)
 {
     ASN1_OBJECT *requested = TS_REQ_get_policy_id(ctx->request);
     ASN1_OBJECT *policy = NULL;
@@ -597,7 +597,7 @@ static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
 }
 
 /* Creates the TS_TST_INFO object based on the settings of the context. */
-static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
+static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
                                             ASN1_OBJECT *policy)
 {
     int result = 0;
@@ -683,7 +683,7 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
 }
 
 /* Processing the extensions of the request. */
-static int TS_RESP_process_extensions(TS_RESP_CTX *ctx)
+static int ts_RESP_process_extensions(TS_RESP_CTX *ctx)
 {
     STACK_OF(X509_EXTENSION) *exts = TS_REQ_get_exts(ctx->request);
     int i;
@@ -704,7 +704,7 @@ static int TS_RESP_process_extensions(TS_RESP_CTX *ctx)
 }
 
 /* Functions for signing the TS_TST_INFO structure of the context. */
-static int TS_RESP_sign(TS_RESP_CTX *ctx)
+static int ts_RESP_sign(TS_RESP_CTX *ctx)
 {
     int ret = 0;
     PKCS7 *p7 = NULL;
@@ -764,7 +764,7 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
      * certificate id and optionally the certificate chain.
      */
     certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
-    if ((sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs)) == NULL)
+    if ((sc = ess_SIGNING_CERT_new_init(ctx->signer_cert, certs)) == NULL)
         goto err;
 
     /* Add SigningCertificate signed attribute to the signer info. */
@@ -774,7 +774,7 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
     }
 
     /* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */
-    if (!TS_TST_INFO_content_new(p7))
+    if (!ts_TST_INFO_content_new(p7))
         goto err;
 
     /* Add the DER encoded tst_info to the PKCS7 structure. */
@@ -812,7 +812,7 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
     return ret;
 }
 
-static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
+static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
                                                    STACK_OF(X509) *certs)
 {
     ESS_CERT_ID *cid;
@@ -827,13 +827,13 @@ static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
         goto err;
 
     /* Adding the signing certificate id. */
-    if ((cid = ESS_CERT_ID_new_init(signcert, 0)) == NULL
+    if ((cid = ess_CERT_ID_new_init(signcert, 0)) == NULL
         || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
         goto err;
     /* Adding the certificate chain ids. */
     for (i = 0; i < sk_X509_num(certs); ++i) {
         X509 *cert = sk_X509_value(certs, i);
-        if ((cid = ESS_CERT_ID_new_init(cert, 1)) == NULL
+        if ((cid = ess_CERT_ID_new_init(cert, 1)) == NULL
             || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
             goto err;
     }
@@ -845,7 +845,7 @@ static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
     return NULL;
 }
 
-static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
+static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed)
 {
     ESS_CERT_ID *cid = NULL;
     GENERAL_NAME *name = NULL;
@@ -889,7 +889,7 @@ static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
     return NULL;
 }
 
-static int TS_TST_INFO_content_new(PKCS7 *p7)
+static int ts_TST_INFO_content_new(PKCS7 *p7)
 {
     PKCS7 *ret = NULL;
     ASN1_OCTET_STRING *octet_string = NULL;
diff --git a/crypto/ts/ts_rsp_verify.c b/crypto/ts/ts_rsp_verify.c
index 116e116..342c524 100644
--- a/crypto/ts/ts_rsp_verify.c
+++ b/crypto/ts/ts_rsp_verify.c
@@ -65,27 +65,27 @@
 
 /* Private function declarations. */
 
-static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
+static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
                           X509 *signer, STACK_OF(X509) **chain);
-static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
+static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
                                   STACK_OF(X509) *chain);
-static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si);
-static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
-static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo);
-static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
+static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si);
+static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
+static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo);
+static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
                                     PKCS7 *token, TS_TST_INFO *tst_info);
-static int TS_check_status_info(TS_RESP *response);
-static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
-static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info);
-static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
+static int ts_check_status_info(TS_RESP *response);
+static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
+static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info);
+static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
                               X509_ALGOR **md_alg,
                               unsigned char **imprint, unsigned *imprint_len);
-static int TS_check_imprints(X509_ALGOR *algor_a,
+static int ts_check_imprints(X509_ALGOR *algor_a,
                              unsigned char *imprint_a, unsigned len_a,
                              TS_TST_INFO *tst_info);
-static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info);
-static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
-static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names,
+static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info);
+static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
+static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names,
                         GENERAL_NAME *name);
 
 /*
@@ -93,7 +93,7 @@ static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names,
  * Don't forget to change TS_STATUS_BUF_SIZE when modifying
  * the elements of this array.
  */
-static const char *TS_status_text[] = { "granted",
+static const char *ts_status_text[] = { "granted",
     "grantedWithMods",
     "rejection",
     "waiting",
@@ -101,7 +101,7 @@ static const char *TS_status_text[] = { "granted",
     "revocationNotification"
 };
 
-#define TS_STATUS_TEXT_SIZE     OSSL_NELEM(TS_status_text)
+#define TS_STATUS_TEXT_SIZE     OSSL_NELEM(ts_status_text)
 
 /*
  * This must be greater or equal to the sum of the strings in TS_status_text
@@ -112,35 +112,18 @@ static const char *TS_status_text[] = { "granted",
 static struct {
     int code;
     const char *text;
-} TS_failure_info[] = {
-    {
-        TS_INFO_BAD_ALG, "badAlg"
-    },
-    {
-        TS_INFO_BAD_REQUEST, "badRequest"
-    },
-    {
-        TS_INFO_BAD_DATA_FORMAT, "badDataFormat"
-    },
-    {
-        TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"
-    },
-    {
-        TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"
-    },
-    {
-        TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"
-    },
-    {
-        TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"
-    },
-    {
-        TS_INFO_SYSTEM_FAILURE, "systemFailure"
-    }
+} ts_failure_info[] = {
+    {TS_INFO_BAD_ALG, "badAlg"},
+    {TS_INFO_BAD_REQUEST, "badRequest"},
+    {TS_INFO_BAD_DATA_FORMAT, "badDataFormat"},
+    {TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"},
+    {TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"},
+    {TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"},
+    {TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"},
+    {TS_INFO_SYSTEM_FAILURE, "systemFailure"}
 };
 
-#define TS_FAILURE_INFO_SIZE    (sizeof(TS_failure_info) / \
-                                sizeof(*TS_failure_info))
+#define TS_FAILURE_INFO_SIZE    OSSL_NELEM(ts_failure_info)
 
 /* Functions for verifying a signed TS_TST_INFO structure. */
 
@@ -204,13 +187,13 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
     signer = sk_X509_value(signers, 0);
 
     /* Now verify the certificate. */
-    if (!TS_verify_cert(store, certs, signer, &chain))
+    if (!ts_verify_cert(store, certs, signer, &chain))
         goto err;
 
     /*
      * Check if the signer certificate is consistent with the ESS extension.
      */
-    if (!TS_check_signing_certs(si, chain))
+    if (!ts_check_signing_certs(si, chain))
         goto err;
 
     /* Creating the message digest. */
@@ -246,7 +229,7 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
  * The certificate chain is returned in chain. Caller is responsible for
  * freeing the vector.
  */
-static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
+static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
                           X509 *signer, STACK_OF(X509) **chain)
 {
     X509_STORE_CTX cert_ctx;
@@ -274,10 +257,10 @@ static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
     return ret;
 }
 
-static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
+static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
                                   STACK_OF(X509) *chain)
 {
-    ESS_SIGNING_CERT *ss = ESS_get_signing_cert(si);
+    ESS_SIGNING_CERT *ss = ess_get_signing_cert(si);
     STACK_OF(ESS_CERT_ID) *cert_ids = NULL;
     X509 *cert;
     int i = 0;
@@ -288,7 +271,7 @@ static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
     cert_ids = ss->cert_ids;
     /* The signer certificate must be the first in cert_ids. */
     cert = sk_X509_value(chain, 0);
-    if (TS_find_cert(cert_ids, cert) != 0)
+    if (ts_find_cert(cert_ids, cert) != 0)
         goto err;
 
     /*
@@ -299,7 +282,7 @@ static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
         /* All the certificates of the chain must be in cert_ids. */
         for (i = 1; i < sk_X509_num(chain); ++i) {
             cert = sk_X509_value(chain, i);
-            if (TS_find_cert(cert_ids, cert) < 0)
+            if (ts_find_cert(cert_ids, cert) < 0)
                 goto err;
         }
     }
@@ -312,7 +295,7 @@ static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
     return ret;
 }
 
-static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si)
+static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si)
 {
     ASN1_TYPE *attr;
     const unsigned char *p;
@@ -324,7 +307,7 @@ static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si)
 }
 
 /* Returns < 0 if certificate is not found, certificate index otherwise. */
-static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
+static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
 {
     int i;
 
@@ -344,7 +327,7 @@ static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
                        sizeof(cert->sha1_hash))) {
             /* Check the issuer/serial as well if specified. */
             ESS_ISSUER_SERIAL *is = cid->issuer_serial;
-            if (!is || !TS_issuer_serial_cmp(is, cert->cert_info))
+            if (!is || !ts_issuer_serial_cmp(is, cert->cert_info))
                 return i;
         }
     }
@@ -352,7 +335,7 @@ static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
     return -1;
 }
 
-static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo)
+static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo)
 {
     GENERAL_NAME *issuer;
 
@@ -385,11 +368,11 @@ int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response)
     int ret = 0;
 
     /* Check if we have a successful TS_TST_INFO object in place. */
-    if (!TS_check_status_info(response))
+    if (!ts_check_status_info(response))
         goto err;
 
     /* Check the contents of the time stamp token. */
-    if (!int_TS_RESP_verify_token(ctx, token, tst_info))
+    if (!int_ts_RESP_verify_token(ctx, token, tst_info))
         goto err;
 
     ret = 1;
@@ -406,7 +389,7 @@ int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
     TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token);
     int ret = 0;
     if (tst_info) {
-        ret = int_TS_RESP_verify_token(ctx, token, tst_info);
+        ret = int_ts_RESP_verify_token(ctx, token, tst_info);
         TS_TST_INFO_free(tst_info);
     }
     return ret;
@@ -424,7 +407,7 @@ int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
  *      - Check if the TSA name matches the signer.
  *      - Check if the TSA name is the expected TSA.
  */
-static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
+static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
                                     PKCS7 *token, TS_TST_INFO *tst_info)
 {
     X509 *signer = NULL;
@@ -448,37 +431,37 @@ static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
 
     /* Check policies. */
     if ((ctx->flags & TS_VFY_POLICY)
-        && !TS_check_policy(ctx->policy, tst_info))
+        && !ts_check_policy(ctx->policy, tst_info))
         goto err;
 
     /* Check message imprints. */
     if ((ctx->flags & TS_VFY_IMPRINT)
-        && !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
+        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
                               tst_info))
         goto err;
 
     /* Compute and check message imprints. */
     if ((ctx->flags & TS_VFY_DATA)
-        && (!TS_compute_imprint(ctx->data, tst_info,
+        && (!ts_compute_imprint(ctx->data, tst_info,
                                 &md_alg, &imprint, &imprint_len)
-            || !TS_check_imprints(md_alg, imprint, imprint_len, tst_info)))
+            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
         goto err;
 
     /* Check nonces. */
     if ((ctx->flags & TS_VFY_NONCE)
-        && !TS_check_nonces(ctx->nonce, tst_info))
+        && !ts_check_nonces(ctx->nonce, tst_info))
         goto err;
 
     /* Check whether TSA name and signer certificate match. */
     if ((ctx->flags & TS_VFY_SIGNER)
-        && tsa_name && !TS_check_signer_name(tsa_name, signer)) {
+        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
         TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
         goto err;
     }
 
     /* Check whether the TSA is the expected one. */
     if ((ctx->flags & TS_VFY_TSA_NAME)
-        && !TS_check_signer_name(ctx->tsa_name, signer)) {
+        && !ts_check_signer_name(ctx->tsa_name, signer)) {
         TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
         goto err;
     }
@@ -491,7 +474,7 @@ static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
     return ret;
 }
 
-static int TS_check_status_info(TS_RESP *response)
+static int ts_check_status_info(TS_RESP *response)
 {
     TS_STATUS_INFO *info = TS_RESP_get_status_info(response);
     long status = ASN1_INTEGER_get(info->status);
@@ -505,13 +488,13 @@ static int TS_check_status_info(TS_RESP *response)
 
     /* There was an error, get the description in status_text. */
     if (0 <= status && status < (long)TS_STATUS_TEXT_SIZE)
-        status_text = TS_status_text[status];
+        status_text = ts_status_text[status];
     else
         status_text = "unknown code";
 
     /* Set the embedded_status_text to the returned description. */
     if (sk_ASN1_UTF8STRING_num(info->text) > 0
-        && (embedded_status_text = TS_get_status_text(info->text)) == NULL)
+        && (embedded_status_text = ts_get_status_text(info->text)) == NULL)
         return 0;
 
     /* Filling in failure_text with the failure information. */
@@ -520,12 +503,12 @@ static int TS_check_status_info(TS_RESP *response)
         int first = 1;
         for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) {
             if (ASN1_BIT_STRING_get_bit(info->failure_info,
-                                        TS_failure_info[i].code)) {
+                                        ts_failure_info[i].code)) {
                 if (!first)
                     strcpy(failure_text, ",");
                 else
                     first = 0;
-                strcat(failure_text, TS_failure_info[i].text);
+                strcat(failure_text, ts_failure_info[i].text);
             }
         }
     }
@@ -544,7 +527,7 @@ static int TS_check_status_info(TS_RESP *response)
     return 0;
 }
 
-static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
+static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
 {
     int i;
     unsigned int length = 0;
@@ -577,7 +560,7 @@ static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
     return result;
 }
 
-static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
+static int ts_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
 {
     ASN1_OBJECT *resp_oid = TS_TST_INFO_get_policy_id(tst_info);
 
@@ -589,7 +572,7 @@ static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
     return 1;
 }
 
-static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
+static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
                               X509_ALGOR **md_alg,
                               unsigned char **imprint, unsigned *imprint_len)
 {
@@ -641,7 +624,7 @@ static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
     return 0;
 }
 
-static int TS_check_imprints(X509_ALGOR *algor_a,
+static int ts_check_imprints(X509_ALGOR *algor_a,
                              unsigned char *imprint_a, unsigned len_a,
                              TS_TST_INFO *tst_info)
 {
@@ -672,7 +655,7 @@ static int TS_check_imprints(X509_ALGOR *algor_a,
     return ret;
 }
 
-static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
+static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
 {
     const ASN1_INTEGER *b = TS_TST_INFO_get_nonce(tst_info);
 
@@ -695,7 +678,7 @@ static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
  * Check if the specified TSA name matches either the subject or one of the
  * subject alternative names of the TSA certificate.
  */
-static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
+static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
 {
     STACK_OF(GENERAL_NAME) *gen_names = NULL;
     int idx = -1;
@@ -709,7 +692,7 @@ static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
     /* Check all the alternative names. */
     gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
     while (gen_names != NULL) {
-        found = TS_find_name(gen_names, tsa_name) >= 0;
+        found = ts_find_name(gen_names, tsa_name) >= 0;
         if (found)
             break;
         /*
@@ -725,7 +708,7 @@ static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
 }
 
 /* Returns 1 if name is in gen_names, 0 otherwise. */
-static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
+static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
 {
     int i, found;
     for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); ++i) {

From kurt at openssl.org  Thu Jun  4 19:11:52 2015
From: kurt at openssl.org (Kurt Roeckx)
Date: Thu, 04 Jun 2015 19:11:52 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433445112.076707.24976.nullmailer@dev.openssl.org>

The branch master has been updated
       via  3c06513f3833d4692f620e2c03d7a840871c08a7 (commit)
      from  9c422b5b1ebc9871a7306f66648aa16c8769082a (commit)


- Log -----------------------------------------------------------------
commit 3c06513f3833d4692f620e2c03d7a840871c08a7
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat May 30 19:20:12 2015 +0200

    Allow all curves when the client doesn't send an supported elliptic curves extension
    
    At least in the case of SSLv3 we can't send an extention.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    MR #811

-----------------------------------------------------------------------

Summary of changes:
 ssl/t1_lib.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index a161dcc..0420fe3 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -555,6 +555,20 @@ int tls1_shared_curve(SSL *s, int nmatch)
         (s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE), &pref,
          &num_pref))
         return nmatch == -1 ? 0 : NID_undef;
+
+    /*
+     * If the client didn't send the elliptic_curves extension all of them
+     * are allowed.
+     */
+    if (num_supp == 0 && (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) != 0) {
+        supp = eccurves_all;
+        num_supp = sizeof(eccurves_all) / 2;
+    } else if (num_pref == 0 &&
+        (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) == 0) {
+        pref = eccurves_all;
+        num_pref = sizeof(eccurves_all) / 2;
+    }
+
     k = 0;
     for (i = 0; i < num_pref; i++, pref += 2) {
         const unsigned char *tsupp = supp;

From kurt at openssl.org  Thu Jun  4 19:25:33 2015
From: kurt at openssl.org (Kurt Roeckx)
Date: Thu, 04 Jun 2015 19:25:33 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433445933.307448.27254.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  ba9d44b28d312138fefcdc5fc0d499d49a4dca41 (commit)
      from  da5fab73255c24e0b6ce8717df2441a03f504939 (commit)


- Log -----------------------------------------------------------------
commit ba9d44b28d312138fefcdc5fc0d499d49a4dca41
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat May 30 19:20:12 2015 +0200

    Allow all curves when the client doesn't send an supported elliptic curves extension
    
    At least in the case of SSLv3 we can't send an extention.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    MR #811
    
    (cherry picked from commit 3c06513f3833d4692f620e2c03d7a840871c08a7)

-----------------------------------------------------------------------

Summary of changes:
 ssl/t1_lib.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index bf11f93..a398501 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -593,6 +593,20 @@ int tls1_shared_curve(SSL *s, int nmatch)
         (s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE), &pref,
          &num_pref))
         return nmatch == -1 ? 0 : NID_undef;
+
+    /*
+     * If the client didn't send the elliptic_curves extension all of them
+     * are allowed.
+     */
+    if (num_supp == 0 && (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) != 0) {
+        supp = eccurves_all;
+        num_supp = sizeof(eccurves_all) / 2;
+    } else if (num_pref == 0 &&
+        (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) == 0) {
+        pref = eccurves_all;
+        num_pref = sizeof(eccurves_all) / 2;
+    }
+
     k = 0;
     for (i = 0; i < num_pref; i++, pref += 2) {
         const unsigned char *tsupp = supp;

From rsalz at openssl.org  Thu Jun  4 22:00:12 2015
From: rsalz at openssl.org (Rich Salz)
Date: Thu, 04 Jun 2015 22:00:12 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433455212.342320.18455.nullmailer@dev.openssl.org>

The branch master has been updated
       via  6c40d469b7eb49f17af24d5ec7cee28f2310c26f (commit)
      from  3c06513f3833d4692f620e2c03d7a840871c08a7 (commit)


- Log -----------------------------------------------------------------
commit 6c40d469b7eb49f17af24d5ec7cee28f2310c26f
Author: Github User <throwaway734892 at igthub.com>
Date:   Wed Jun 3 10:29:10 2015 -0400

    GH293: Typo in CHANGES file.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 6016151..3b0d0b5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5027,7 +5027,7 @@
 	done
 
      To be absolutely sure not to disturb the source tree, a "make clean"
-     is a good thing.  If it isn't successfull, don't worry about it,
+     is a good thing.  If it isn't successful, don't worry about it,
      it probably means the source directory is very clean.
      [Richard Levitte]
 

From rsalz at openssl.org  Thu Jun  4 22:03:40 2015
From: rsalz at openssl.org (Rich Salz)
Date: Thu, 04 Jun 2015 22:03:40 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433455420.288926.26657.nullmailer@dev.openssl.org>

The branch master has been updated
       via  c0cf5b84dd32480965da7ff1e11d11a1ec9c4662 (commit)
      from  6c40d469b7eb49f17af24d5ec7cee28f2310c26f (commit)


- Log -----------------------------------------------------------------
commit c0cf5b84dd32480965da7ff1e11d11a1ec9c4662
Author: Rich Salz <rsalz at akamai.com>
Date:   Thu Jun 4 10:14:28 2015 -0400

    Set error code, no fprintf stderr, on errors.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/ts/ts_conf.c  | 12 +++++++-----
 crypto/ts/ts_err.c   | 11 ++++++++++-
 include/openssl/ts.h |  9 +++++++++
 3 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/crypto/ts/ts_conf.c b/crypto/ts/ts_conf.c
index 4d303f7..27b3df2 100644
--- a/crypto/ts/ts_conf.c
+++ b/crypto/ts/ts_conf.c
@@ -102,7 +102,7 @@ X509 *TS_CONF_load_cert(const char *file)
     x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
  end:
     if (x == NULL)
-        fprintf(stderr, "unable to load certificate: %s\n", file);
+        TSerr(TS_F_TS_CONF_LOAD_CERT, TS_R_CANNOT_LOAD_CERT);
     BIO_free(cert);
     return x;
 }
@@ -129,7 +129,7 @@ STACK_OF(X509) *TS_CONF_load_certs(const char *file)
     }
  end:
     if (othercerts == NULL)
-        fprintf(stderr, "unable to load certificates: %s\n", file);
+        TSerr(TS_F_TS_CONF_LOAD_CERTS, TS_R_CANNOT_LOAD_CERT);
     sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
     BIO_free(certs);
     return othercerts;
@@ -145,7 +145,7 @@ EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
     pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass);
  end:
     if (pkey == NULL)
-        fprintf(stderr, "unable to load private key: %s\n", file);
+        TSerr(TS_F_TS_CONF_LOAD_KEY, TS_R_CANNOT_LOAD_KEY);
     BIO_free(key);
     return pkey;
 }
@@ -154,12 +154,14 @@ EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
 
 static void ts_CONF_lookup_fail(const char *name, const char *tag)
 {
-    fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
+    TSerr(TS_F_TS_CONF_LOOKUP_FAIL, TS_R_VAR_LOOKUP_FAILURE);
+    ERR_add_error_data(3, name, "::", tag);
 }
 
 static void ts_CONF_invalid(const char *name, const char *tag)
 {
-    fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
+    TSerr(TS_F_TS_CONF_INVALID, TS_R_VAR_BAD_VALUE);
+    ERR_add_error_data(3, name, "::", tag);
 }
 
 const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
diff --git a/crypto/ts/ts_err.c b/crypto/ts/ts_err.c
index ff1abf4..3f5b78f 100644
--- a/crypto/ts/ts_err.c
+++ b/crypto/ts/ts_err.c
@@ -1,6 +1,6 @@
 /* crypto/ts/ts_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2015 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -87,6 +87,11 @@ static ERR_STRING_DATA TS_str_functs[] = {
     {ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "TS_CHECK_SIGNING_CERTS"},
     {ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "TS_CHECK_STATUS_INFO"},
     {ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "TS_COMPUTE_IMPRINT"},
+    {ERR_FUNC(TS_F_TS_CONF_INVALID), "ts_CONF_invalid"},
+    {ERR_FUNC(TS_F_TS_CONF_LOAD_CERT), "TS_CONF_load_cert"},
+    {ERR_FUNC(TS_F_TS_CONF_LOAD_CERTS), "TS_CONF_load_certs"},
+    {ERR_FUNC(TS_F_TS_CONF_LOAD_KEY), "TS_CONF_load_key"},
+    {ERR_FUNC(TS_F_TS_CONF_LOOKUP_FAIL), "ts_CONF_lookup_fail"},
     {ERR_FUNC(TS_F_TS_CONF_SET_DEFAULT_ENGINE), "TS_CONF_set_default_engine"},
     {ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "TS_GET_STATUS_TEXT"},
     {ERR_FUNC(TS_F_TS_MSG_IMPRINT_SET_ALGO), "TS_MSG_IMPRINT_set_algo"},
@@ -132,6 +137,8 @@ static ERR_STRING_DATA TS_str_functs[] = {
 static ERR_STRING_DATA TS_str_reasons[] = {
     {ERR_REASON(TS_R_BAD_PKCS7_TYPE), "bad pkcs7 type"},
     {ERR_REASON(TS_R_BAD_TYPE), "bad type"},
+    {ERR_REASON(TS_R_CANNOT_LOAD_CERT), "cannot load certificate"},
+    {ERR_REASON(TS_R_CANNOT_LOAD_KEY), "cannot load private key"},
     {ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"},
     {ERR_REASON(TS_R_COULD_NOT_SET_ENGINE), "could not set engine"},
     {ERR_REASON(TS_R_COULD_NOT_SET_TIME), "could not set time"},
@@ -170,6 +177,8 @@ static ERR_STRING_DATA TS_str_reasons[] = {
     {ERR_REASON(TS_R_UNACCEPTABLE_POLICY), "unacceptable policy"},
     {ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM), "unsupported md algorithm"},
     {ERR_REASON(TS_R_UNSUPPORTED_VERSION), "unsupported version"},
+    {ERR_REASON(TS_R_VAR_BAD_VALUE), "var bad value"},
+    {ERR_REASON(TS_R_VAR_LOOKUP_FAILURE), "cannot find config variable"},
     {ERR_REASON(TS_R_WRONG_CONTENT_TYPE), "wrong content type"},
     {0, NULL}
 };
diff --git a/include/openssl/ts.h b/include/openssl/ts.h
index c6daed2..b983abc 100644
--- a/include/openssl/ts.h
+++ b/include/openssl/ts.h
@@ -775,6 +775,11 @@ void ERR_load_TS_strings(void);
 # define TS_F_TS_CHECK_SIGNING_CERTS                      103
 # define TS_F_TS_CHECK_STATUS_INFO                        104
 # define TS_F_TS_COMPUTE_IMPRINT                          145
+# define TS_F_TS_CONF_INVALID                             151
+# define TS_F_TS_CONF_LOAD_CERT                           153
+# define TS_F_TS_CONF_LOAD_CERTS                          154
+# define TS_F_TS_CONF_LOAD_KEY                            155
+# define TS_F_TS_CONF_LOOKUP_FAIL                         152
 # define TS_F_TS_CONF_SET_DEFAULT_ENGINE                  146
 # define TS_F_TS_GET_STATUS_TEXT                          105
 # define TS_F_TS_MSG_IMPRINT_SET_ALGO                     118
@@ -813,6 +818,8 @@ void ERR_load_TS_strings(void);
 /* Reason codes. */
 # define TS_R_BAD_PKCS7_TYPE                              132
 # define TS_R_BAD_TYPE                                    133
+# define TS_R_CANNOT_LOAD_CERT                            137
+# define TS_R_CANNOT_LOAD_KEY                             138
 # define TS_R_CERTIFICATE_VERIFY_ERROR                    100
 # define TS_R_COULD_NOT_SET_ENGINE                        127
 # define TS_R_COULD_NOT_SET_TIME                          115
@@ -845,6 +852,8 @@ void ERR_load_TS_strings(void);
 # define TS_R_UNACCEPTABLE_POLICY                         125
 # define TS_R_UNSUPPORTED_MD_ALGORITHM                    126
 # define TS_R_UNSUPPORTED_VERSION                         113
+# define TS_R_VAR_BAD_VALUE                               135
+# define TS_R_VAR_LOOKUP_FAILURE                          136
 # define TS_R_WRONG_CONTENT_TYPE                          114
 
 #ifdef  __cplusplus

From ben at openssl.org  Fri Jun  5 10:15:22 2015
From: ben at openssl.org (Ben Laurie)
Date: Fri, 05 Jun 2015 10:15:22 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433499322.595547.4030.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  f877da9cedb95df94105d7292f8e0963175e58dc (commit)
      from  ba9d44b28d312138fefcdc5fc0d499d49a4dca41 (commit)


- Log -----------------------------------------------------------------
commit f877da9cedb95df94105d7292f8e0963175e58dc
Author: Ben Laurie <ben at links.org>
Date:   Fri May 1 15:53:46 2015 +0100

    Use cc instead of gcc so either clang or gcc is used as appropriate. Add clang
    flags needed to keep it happy.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 Configure | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/Configure b/Configure
index 7192677..d99eed7 100755
--- a/Configure
+++ b/Configure
@@ -114,6 +114,16 @@ my $gcc_devteam_warn = "-Wall -pedantic -DPEDANTIC -Wno-long-long -Wsign-compare
 # -Wextended-offsetof
 my $clang_disabled_warnings = "-Wno-unused-parameter -Wno-missing-field-initializers -Wno-language-extension-token  -Wno-extended-offsetof";
 
+# These are used in addition to $gcc_devteam_warn when the compiler is clang.
+# TODO(openssl-team): fix problems and investigate if (at least) the
+# following warnings can also be enabled: -Wconditional-uninitialized,
+# -Wswitch-enum, -Wunused-macros, -Wmissing-field-initializers,
+# -Wmissing-variable-declarations,
+# -Wincompatible-pointer-types-discards-qualifiers, -Wcast-align,
+# -Wunreachable-code -Wunused-parameter -Wlanguage-extension-token
+# -Wextended-offsetof
+my $clang_devteam_warn = "-Wno-unused-parameter -Wno-missing-field-initializers -Wno-language-extension-token -Wno-extended-offsetof -Qunused-arguments";
+
 my $strict_warnings = 0;
 
 my $x86_gcc_des="DES_PTR DES_RISC1 DES_UNROLL";
@@ -469,7 +479,7 @@ my %table=(
 # triggered by RIPEMD160 code.
 "BSD-sparc64",	"gcc:-DB_ENDIAN -O3 -DMD32_REG_T=int -Wall::${BSDthreads}:::BN_LLONG RC2_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC2 BF_PTR:${sparcv9_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "BSD-ia64",	"gcc:-DL_ENDIAN -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"BSD-x86_64",	"gcc:-DL_ENDIAN -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"BSD-x86_64",	"cc:-DL_ENDIAN -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
 "bsdi-elf-gcc",     "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall::(unknown)::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
@@ -1202,6 +1212,7 @@ my $cc = $fields[$idx_cc];
 if($ENV{CC}) {
     $cc = $ENV{CC};
 }
+
 my $cflags = $fields[$idx_cflags];
 my $unistd = $fields[$idx_unistd];
 my $thread_cflag = $fields[$idx_thread_cflag];
@@ -1637,12 +1648,21 @@ if ($shlib_version_number =~ /(^[0-9]*)\.([0-9\.]*)/)
 
 if ($strict_warnings)
 	{
+	my $ecc = $cc;
+	$ecc = "clang" if `$cc --version 2>&1` =~ /clang/;
 	my $wopt;
-	die "ERROR --strict-warnings requires gcc or clang" unless ($cc =~ /gcc$/ or $cc =~ /clang$/);
+	die "ERROR --strict-warnings requires gcc or clang" unless ($ecc =~ /gcc$/ or $ecc =~ /clang$/);
 	foreach $wopt (split /\s+/, $gcc_devteam_warn)
 		{
 		$cflags .= " $wopt" unless ($cflags =~ /$wopt/)
 		}
+	if ($ecc eq "clang")
+		{
+		foreach $wopt (split /\s+/, $clang_devteam_warn)
+			{
+			$cflags .= " $wopt" unless ($cflags =~ /$wopt/)
+			}
+		}
 	}
 
 open(IN,'<Makefile.org') || die "unable to read Makefile.org:$!\n";

From steve at openssl.org  Sat Jun  6 12:18:41 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Sat, 06 Jun 2015 12:18:41 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433593121.787487.10359.nullmailer@dev.openssl.org>

The branch master has been updated
       via  4336de0c6392d98c32bc27717173130d5e7389aa (commit)
      from  c0cf5b84dd32480965da7ff1e11d11a1ec9c4662 (commit)


- Log -----------------------------------------------------------------
commit 4336de0c6392d98c32bc27717173130d5e7389aa
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Fri Jun 5 14:23:27 2015 +0100

    Check ASN1_INTEGER_get for errors.
    
    Check return value when calling ASN1_INTEGER_get to retrieve a certificate
    serial number. If an error occurs (which will be caused by the value being
    out of range) revert to hex dump of serial number.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/asn1/t_x509.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/crypto/asn1/t_x509.c b/crypto/asn1/t_x509.c
index 377be39..12a9ed4 100644
--- a/crypto/asn1/t_x509.c
+++ b/crypto/asn1/t_x509.c
@@ -141,7 +141,13 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
 
         bs = X509_get_serialNumber(x);
         if (bs->length <= (int)sizeof(long)) {
-            l = ASN1_INTEGER_get(bs);
+                ERR_set_mark();
+                l = ASN1_INTEGER_get(bs);
+                ERR_pop_to_mark();
+        } else {
+            l = -1;
+        }
+        if (l != -1) {
             if (bs->type == V_ASN1_NEG_INTEGER) {
                 l = -l;
                 neg = "-";

From steve at openssl.org  Sat Jun  6 13:04:52 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Sat, 06 Jun 2015 13:04:52 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433595892.187687.16775.nullmailer@dev.openssl.org>

The branch master has been updated
       via  9d3356b1186c8449820273aa9ed5d0066f698307 (commit)
      from  4336de0c6392d98c32bc27717173130d5e7389aa (commit)


- Log -----------------------------------------------------------------
commit 9d3356b1186c8449820273aa9ed5d0066f698307
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sat Jun 6 12:51:19 2015 +0100

    Update trace code.
    
    Add extension and ciphersuites to trace code.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/t1_trce.c | 130 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 130 insertions(+)

diff --git a/ssl/t1_trce.c b/ssl/t1_trce.c
index 6596c87..97170cd 100644
--- a/ssl/t1_trce.c
+++ b/ssl/t1_trce.c
@@ -184,6 +184,9 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = {
     {0x0029, "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5"},
     {0x002A, "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5"},
     {0x002B, "TLS_KRB5_EXPORT_WITH_RC4_40_MD5"},
+    {0x002C, "TLS_PSK_WITH_NULL_SHA"},
+    {0x002D, "TLS_DHE_PSK_WITH_NULL_SHA"},
+    {0x002E, "TLS_RSA_PSK_WITH_NULL_SHA"},
     {0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA"},
     {0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA"},
     {0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA"},
@@ -282,6 +285,7 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = {
     {0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256"},
     {0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256"},
     {0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"},
+    {0x5600, "TLS_FALLBACK_SCSV"},
     {0xC001, "TLS_ECDH_ECDSA_WITH_NULL_SHA"},
     {0xC002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"},
     {0xC003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"},
@@ -332,6 +336,131 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = {
     {0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"},
     {0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"},
     {0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"},
+    {0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA"},
+    {0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"},
+    {0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA"},
+    {0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA"},
+    {0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256"},
+    {0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384"},
+    {0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA"},
+    {0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256"},
+    {0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384"},
+    {0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256"},
+    {0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384"},
+    {0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256"},
+    {0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384"},
+    {0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256"},
+    {0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384"},
+    {0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256"},
+    {0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384"},
+    {0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256"},
+    {0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384"},
+    {0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256"},
+    {0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384"},
+    {0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256"},
+    {0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384"},
+    {0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256"},
+    {0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384"},
+    {0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256"},
+    {0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384"},
+    {0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256"},
+    {0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384"},
+    {0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256"},
+    {0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384"},
+    {0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256"},
+    {0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384"},
+    {0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256"},
+    {0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384"},
+    {0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256"},
+    {0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384"},
+    {0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256"},
+    {0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384"},
+    {0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256"},
+    {0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384"},
+    {0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256"},
+    {0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384"},
+    {0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256"},
+    {0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384"},
+    {0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"},
+    {0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"},
+    {0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256"},
+    {0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384"},
+    {0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256"},
+    {0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384"},
+    {0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256"},
+    {0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384"},
+    {0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256"},
+    {0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384"},
+    {0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256"},
+    {0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384"},
+    {0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256"},
+    {0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384"},
+    {0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256"},
+    {0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384"},
+    {0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256"},
+    {0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384"},
+    {0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"},
+    {0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"},
+    {0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"},
+    {0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"},
+    {0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"},
+    {0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"},
+    {0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256"},
+    {0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384"},
+    {0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256"},
+    {0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384"},
+    {0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256"},
+    {0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384"},
+    {0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"},
+    {0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"},
+    {0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256"},
+    {0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384"},
+    {0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"},
+    {0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"},
+    {0xC09C, "TLS_RSA_WITH_AES_128_CCM"},
+    {0xC09D, "TLS_RSA_WITH_AES_256_CCM"},
+    {0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM"},
+    {0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM"},
+    {0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8"},
+    {0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8"},
+    {0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8"},
+    {0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8"},
+    {0xC0A4, "TLS_PSK_WITH_AES_128_CCM"},
+    {0xC0A5, "TLS_PSK_WITH_AES_256_CCM"},
+    {0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM"},
+    {0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM"},
+    {0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8"},
+    {0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8"},
+    {0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8"},
+    {0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8"},
+    {0xC0AC, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM"},
+    {0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM"},
+    {0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8"},
+    {0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8"},
     {0xFEFE, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
     {0xFEFF, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"},
 };
@@ -364,6 +493,7 @@ static ssl_trace_tbl ssl_exts_tbl[] = {
     {TLSEXT_TYPE_renegotiate, "renegotiate"},
     {TLSEXT_TYPE_next_proto_neg, "next_proto_neg"},
     {TLSEXT_TYPE_padding, "padding"},
+    {TLSEXT_TYPE_encrypt_then_mac, "encrypt_then_mac"},
     {TLSEXT_TYPE_extended_master_secret, "extended_master_secret"}
 };
 

From rsalz at openssl.org  Sun Jun  7 02:24:15 2015
From: rsalz at openssl.org (Rich Salz)
Date: Sun, 07 Jun 2015 02:24:15 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433643855.874915.10119.nullmailer@dev.openssl.org>

The branch master has been updated
       via  65d3941f4aa199d0fcd615b074876f8ff2886d11 (commit)
      from  9d3356b1186c8449820273aa9ed5d0066f698307 (commit)


- Log -----------------------------------------------------------------
commit 65d3941f4aa199d0fcd615b074876f8ff2886d11
Author: Rodger Combs <rodger.combs at gmail.com>
Date:   Sat Jun 6 21:55:01 2015 -0400

    Increase buffer size for passwords in pkcs12 CLI
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/pkcs12.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index 9ab7f69..05bb1ad 100644
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -160,7 +160,7 @@ int pkcs12_main(int argc, char **argv)
 {
     char *infile = NULL, *outfile = NULL, *keyname = NULL, *certfile = NULL;
     char *name = NULL, *csp_name = NULL;
-    char pass[50], macpass[50];
+    char pass[2048], macpass[2048];
     int export_cert = 0, options = 0, chain = 0, twopass = 0, keytype = 0;
     int iter = PKCS12_DEFAULT_ITER, maciter = PKCS12_DEFAULT_ITER;
 # ifndef OPENSSL_NO_RC2

From emilia at openssl.org  Mon Jun  8 13:30:39 2015
From: emilia at openssl.org (Emilia Kasper)
Date: Mon, 08 Jun 2015 13:30:39 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433770239.889857.10894.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  ba5693686e7bc408c2fcdb4d258e9410028dcfb4 (commit)
       via  59b5ab4aa72527ce74dbe1a83988f194053293de (commit)
      from  c22ed559bbb6e75d03ce4e8cb3655988fc123d4f (commit)


- Log -----------------------------------------------------------------
commit ba5693686e7bc408c2fcdb4d258e9410028dcfb4
Author: Emilia Kasper <emilia at openssl.org>
Date:   Mon Jun 8 15:04:28 2015 +0200

    Use CRYPTO_memcmp in s3_cbc.c
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 05627d57e55517eae21c251fe287760bd1137218)

commit 59b5ab4aa72527ce74dbe1a83988f194053293de
Author: Emilia Kasper <emilia at openssl.org>
Date:   Wed May 27 17:12:13 2015 +0200

    Use CRYPTO_memcmp when comparing authenticators
    
    Pointed out by Victor Vasiliev (vasilvv at mit.edu) via Adam Langley
    (Google).
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 1e4a355dcabe2f75df5bb8b41b394d37037169d2)
    (cherry picked from commit ac32a77cd69784568090e934a31622ddfee49ca7)

-----------------------------------------------------------------------

Summary of changes:
 crypto/evp/e_aes.c          | 5 +++--
 crypto/evp/e_rc4_hmac_md5.c | 3 ++-
 crypto/modes/gcm128.c       | 2 +-
 crypto/pkcs12/p12_mutl.c    | 3 ++-
 ssl/s3_cbc.c                | 2 +-
 5 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
index bde4804..1ede7bd 100644
--- a/crypto/evp/e_aes.c
+++ b/crypto/evp/e_aes.c
@@ -50,6 +50,7 @@
 
 #include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_AES
+#include <openssl/crypto.h>
 # include <openssl/evp.h>
 # include <openssl/err.h>
 # include <string.h>
@@ -914,7 +915,7 @@ static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
         /* Retrieve tag */
         CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, EVP_GCM_TLS_TAG_LEN);
         /* If tag mismatch wipe buffer */
-        if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) {
+        if (CRYPTO_memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) {
             OPENSSL_cleanse(out, len);
             goto err;
         }
@@ -1259,7 +1260,7 @@ static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
             !CRYPTO_ccm128_decrypt(ccm, in, out, len)) {
             unsigned char tag[16];
             if (CRYPTO_ccm128_tag(ccm, tag, cctx->M)) {
-                if (!memcmp(tag, ctx->buf, cctx->M))
+                if (!CRYPTO_memcmp(tag, ctx->buf, cctx->M))
                     rv = len;
             }
         }
diff --git a/crypto/evp/e_rc4_hmac_md5.c b/crypto/evp/e_rc4_hmac_md5.c
index e6b0cdf..2da1117 100644
--- a/crypto/evp/e_rc4_hmac_md5.c
+++ b/crypto/evp/e_rc4_hmac_md5.c
@@ -54,6 +54,7 @@
 
 #if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_MD5)
 
+# include <openssl/crypto.h>
 # include <openssl/evp.h>
 # include <openssl/objects.h>
 # include <openssl/rc4.h>
@@ -210,7 +211,7 @@ static int rc4_hmac_md5_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
             MD5_Update(&key->md, mac, MD5_DIGEST_LENGTH);
             MD5_Final(mac, &key->md);
 
-            if (memcmp(out + plen, mac, MD5_DIGEST_LENGTH))
+            if (CRYPTO_memcmp(out + plen, mac, MD5_DIGEST_LENGTH))
                 return 0;
         } else {
             MD5_Update(&key->md, out + md5_off, len - md5_off);
diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c
index f69f2c9..0ee569f 100644
--- a/crypto/modes/gcm128.c
+++ b/crypto/modes/gcm128.c
@@ -1622,7 +1622,7 @@ int CRYPTO_gcm128_finish(GCM128_CONTEXT *ctx, const unsigned char *tag,
     ctx->Xi.u[1] ^= ctx->EK0.u[1];
 
     if (tag && len <= sizeof(ctx->Xi))
-        return memcmp(ctx->Xi.c, tag, len);
+        return CRYPTO_memcmp(ctx->Xi.c, tag, len);
     else
         return -1;
 }
diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
index 256b210..5ab4bf2 100644
--- a/crypto/pkcs12/p12_mutl.c
+++ b/crypto/pkcs12/p12_mutl.c
@@ -60,6 +60,7 @@
 #ifndef OPENSSL_NO_HMAC
 # include <stdio.h>
 # include "cryptlib.h"
+# include <openssl/crypto.h>
 # include <openssl/hmac.h>
 # include <openssl/rand.h>
 # include <openssl/pkcs12.h>
@@ -123,7 +124,7 @@ int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen)
         return 0;
     }
     if ((maclen != (unsigned int)p12->mac->dinfo->digest->length)
-        || memcmp(mac, p12->mac->dinfo->digest->data, maclen))
+        || CRYPTO_memcmp(mac, p12->mac->dinfo->digest->data, maclen))
         return 0;
     return 1;
 }
diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index 00b534f..2fb71f2 100644
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -149,7 +149,7 @@ int tls1_cbc_remove_padding(const SSL *s,
      */
     if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
         /* First packet is even in size, so check */
-        if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
+        if ((CRYPTO_memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
             !(padding_length & 1)) {
             s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;
         }

From emilia at openssl.org  Mon Jun  8 13:30:40 2015
From: emilia at openssl.org (Emilia Kasper)
Date: Mon, 08 Jun 2015 13:30:40 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433770240.142080.10939.nullmailer@dev.openssl.org>

The branch master has been updated
       via  2974e3d4641b80c76197e653a016e7c010eaf3a2 (commit)
       via  1e4a355dcabe2f75df5bb8b41b394d37037169d2 (commit)
      from  65d3941f4aa199d0fcd615b074876f8ff2886d11 (commit)


- Log -----------------------------------------------------------------
commit 2974e3d4641b80c76197e653a016e7c010eaf3a2
Author: Emilia Kasper <emilia at openssl.org>
Date:   Fri May 29 13:14:08 2015 +0200

    Use CRYPTO_memcmp in ssl3_record.c
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 1e4a355dcabe2f75df5bb8b41b394d37037169d2
Author: Emilia Kasper <emilia at openssl.org>
Date:   Wed May 27 17:12:13 2015 +0200

    Use CRYPTO_memcmp when comparing authenticators
    
    Pointed out by Victor Vasiliev (vasilvv at mit.edu) via Adam Langley
    (Google).
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/evp/e_aes.c          | 5 +++--
 crypto/evp/e_rc4_hmac_md5.c | 3 ++-
 crypto/modes/gcm128.c       | 2 +-
 crypto/pkcs12/p12_mutl.c    | 3 ++-
 ssl/record/ssl3_record.c    | 3 +--
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
index 0b7838e..895e8ee 100644
--- a/crypto/evp/e_aes.c
+++ b/crypto/evp/e_aes.c
@@ -50,6 +50,7 @@
 
 #include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_AES
+#include <openssl/crypto.h>
 # include <openssl/evp.h>
 # include <openssl/err.h>
 # include <string.h>
@@ -1555,7 +1556,7 @@ static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
         /* Retrieve tag */
         CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, EVP_GCM_TLS_TAG_LEN);
         /* If tag mismatch wipe buffer */
-        if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) {
+        if (CRYPTO_memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) {
             OPENSSL_cleanse(out, len);
             goto err;
         }
@@ -1990,7 +1991,7 @@ static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
             !CRYPTO_ccm128_decrypt(ccm, in, out, len)) {
             unsigned char tag[16];
             if (CRYPTO_ccm128_tag(ccm, tag, cctx->M)) {
-                if (!memcmp(tag, ctx->buf, cctx->M))
+                if (!CRYPTO_memcmp(tag, ctx->buf, cctx->M))
                     rv = len;
             }
         }
diff --git a/crypto/evp/e_rc4_hmac_md5.c b/crypto/evp/e_rc4_hmac_md5.c
index 1ba690d..e3fe918 100644
--- a/crypto/evp/e_rc4_hmac_md5.c
+++ b/crypto/evp/e_rc4_hmac_md5.c
@@ -54,6 +54,7 @@
 
 #if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_MD5)
 
+# include <openssl/crypto.h>
 # include <openssl/evp.h>
 # include <openssl/objects.h>
 # include <openssl/rc4.h>
@@ -209,7 +210,7 @@ static int rc4_hmac_md5_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
             MD5_Update(&key->md, mac, MD5_DIGEST_LENGTH);
             MD5_Final(mac, &key->md);
 
-            if (memcmp(out + plen, mac, MD5_DIGEST_LENGTH))
+            if (CRYPTO_memcmp(out + plen, mac, MD5_DIGEST_LENGTH))
                 return 0;
         } else {
             MD5_Update(&key->md, out + md5_off, len - md5_off);
diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c
index b39cd06..02e8f2e 100644
--- a/crypto/modes/gcm128.c
+++ b/crypto/modes/gcm128.c
@@ -1685,7 +1685,7 @@ int CRYPTO_gcm128_finish(GCM128_CONTEXT *ctx, const unsigned char *tag,
     ctx->Xi.u[1] ^= ctx->EK0.u[1];
 
     if (tag && len <= sizeof(ctx->Xi))
-        return memcmp(ctx->Xi.c, tag, len);
+        return CRYPTO_memcmp(ctx->Xi.c, tag, len);
     else
         return -1;
 }
diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
index 4025e3f..9382b39 100644
--- a/crypto/pkcs12/p12_mutl.c
+++ b/crypto/pkcs12/p12_mutl.c
@@ -59,6 +59,7 @@
 
 # include <stdio.h>
 # include "internal/cryptlib.h"
+#include <openssl/crypto.h>
 # include <openssl/hmac.h>
 # include <openssl/rand.h>
 # include <openssl/pkcs12.h>
@@ -123,7 +124,7 @@ int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen)
         return 0;
     }
     if ((maclen != (unsigned int)p12->mac->dinfo->digest->length)
-        || memcmp(mac, p12->mac->dinfo->digest->data, maclen))
+        || CRYPTO_memcmp(mac, p12->mac->dinfo->digest->data, maclen))
         return 0;
     return 1;
 }
diff --git a/ssl/record/ssl3_record.c b/ssl/record/ssl3_record.c
index bae9490..dbec5f1 100644
--- a/ssl/record/ssl3_record.c
+++ b/ssl/record/ssl3_record.c
@@ -1072,7 +1072,7 @@ int tls1_cbc_remove_padding(const SSL *s,
      */
     if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
         /* First packet is even in size, so check */
-        if ((memcmp(RECORD_LAYER_get_read_sequence(&s->rlayer),
+        if ((CRYPTO_memcmp(RECORD_LAYER_get_read_sequence(&s->rlayer),
                 "\0\0\0\0\0\0\0\0", 8) == 0) &&
             !(padding_length & 1)) {
             s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;
@@ -1578,4 +1578,3 @@ int dtls1_get_record(SSL *s)
     return (1);
 
 }
-

From emilia at openssl.org  Mon Jun  8 13:30:39 2015
From: emilia at openssl.org (Emilia Kasper)
Date: Mon, 08 Jun 2015 13:30:39 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433770239.996623.10917.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  05627d57e55517eae21c251fe287760bd1137218 (commit)
       via  ac32a77cd69784568090e934a31622ddfee49ca7 (commit)
      from  f877da9cedb95df94105d7292f8e0963175e58dc (commit)


- Log -----------------------------------------------------------------
commit 05627d57e55517eae21c251fe287760bd1137218
Author: Emilia Kasper <emilia at openssl.org>
Date:   Mon Jun 8 15:04:28 2015 +0200

    Use CRYPTO_memcmp in s3_cbc.c
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit ac32a77cd69784568090e934a31622ddfee49ca7
Author: Emilia Kasper <emilia at openssl.org>
Date:   Wed May 27 17:12:13 2015 +0200

    Use CRYPTO_memcmp when comparing authenticators
    
    Pointed out by Victor Vasiliev (vasilvv at mit.edu) via Adam Langley
    (Google).
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 1e4a355dcabe2f75df5bb8b41b394d37037169d2)

-----------------------------------------------------------------------

Summary of changes:
 crypto/evp/e_aes.c          | 5 +++--
 crypto/evp/e_rc4_hmac_md5.c | 3 ++-
 crypto/modes/gcm128.c       | 2 +-
 crypto/pkcs12/p12_mutl.c    | 3 ++-
 ssl/s3_cbc.c                | 2 +-
 5 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
index af4aa18..33cbed8 100644
--- a/crypto/evp/e_aes.c
+++ b/crypto/evp/e_aes.c
@@ -50,6 +50,7 @@
 
 #include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_AES
+#include <openssl/crypto.h>
 # include <openssl/evp.h>
 # include <openssl/err.h>
 # include <string.h>
@@ -1455,7 +1456,7 @@ static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
         /* Retrieve tag */
         CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, EVP_GCM_TLS_TAG_LEN);
         /* If tag mismatch wipe buffer */
-        if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) {
+        if (CRYPTO_memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) {
             OPENSSL_cleanse(out, len);
             goto err;
         }
@@ -1895,7 +1896,7 @@ static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
             !CRYPTO_ccm128_decrypt(ccm, in, out, len)) {
             unsigned char tag[16];
             if (CRYPTO_ccm128_tag(ccm, tag, cctx->M)) {
-                if (!memcmp(tag, ctx->buf, cctx->M))
+                if (!CRYPTO_memcmp(tag, ctx->buf, cctx->M))
                     rv = len;
             }
         }
diff --git a/crypto/evp/e_rc4_hmac_md5.c b/crypto/evp/e_rc4_hmac_md5.c
index e6b0cdf..2da1117 100644
--- a/crypto/evp/e_rc4_hmac_md5.c
+++ b/crypto/evp/e_rc4_hmac_md5.c
@@ -54,6 +54,7 @@
 
 #if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_MD5)
 
+# include <openssl/crypto.h>
 # include <openssl/evp.h>
 # include <openssl/objects.h>
 # include <openssl/rc4.h>
@@ -210,7 +211,7 @@ static int rc4_hmac_md5_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
             MD5_Update(&key->md, mac, MD5_DIGEST_LENGTH);
             MD5_Final(mac, &key->md);
 
-            if (memcmp(out + plen, mac, MD5_DIGEST_LENGTH))
+            if (CRYPTO_memcmp(out + plen, mac, MD5_DIGEST_LENGTH))
                 return 0;
         } else {
             MD5_Update(&key->md, out + md5_off, len - md5_off);
diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c
index 24a84a7..881b223 100644
--- a/crypto/modes/gcm128.c
+++ b/crypto/modes/gcm128.c
@@ -1704,7 +1704,7 @@ int CRYPTO_gcm128_finish(GCM128_CONTEXT *ctx, const unsigned char *tag,
     ctx->Xi.u[1] ^= ctx->EK0.u[1];
 
     if (tag && len <= sizeof(ctx->Xi))
-        return memcmp(ctx->Xi.c, tag, len);
+        return CRYPTO_memcmp(ctx->Xi.c, tag, len);
     else
         return -1;
 }
diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
index 256b210..5ab4bf2 100644
--- a/crypto/pkcs12/p12_mutl.c
+++ b/crypto/pkcs12/p12_mutl.c
@@ -60,6 +60,7 @@
 #ifndef OPENSSL_NO_HMAC
 # include <stdio.h>
 # include "cryptlib.h"
+# include <openssl/crypto.h>
 # include <openssl/hmac.h>
 # include <openssl/rand.h>
 # include <openssl/pkcs12.h>
@@ -123,7 +124,7 @@ int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen)
         return 0;
     }
     if ((maclen != (unsigned int)p12->mac->dinfo->digest->length)
-        || memcmp(mac, p12->mac->dinfo->digest->data, maclen))
+        || CRYPTO_memcmp(mac, p12->mac->dinfo->digest->data, maclen))
         return 0;
     return 1;
 }
diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index c43402d..a0edcef 100644
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -149,7 +149,7 @@ int tls1_cbc_remove_padding(const SSL *s,
      */
     if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
         /* First packet is even in size, so check */
-        if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
+        if ((CRYPTO_memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
             !(padding_length & 1)) {
             s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;
         }

From steve at openssl.org  Mon Jun  8 20:46:10 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 08 Jun 2015 20:46:10 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433796370.341328.28569.nullmailer@dev.openssl.org>

The branch master has been updated
       via  0fb9990480919163cc375a2b6c0df1d8d901a77b (commit)
      from  2974e3d4641b80c76197e653a016e7c010eaf3a2 (commit)


- Log -----------------------------------------------------------------
commit 0fb9990480919163cc375a2b6c0df1d8d901a77b
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Mon Jun 8 13:23:00 2015 +0100

    return correct NID for undefined object
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/obj_dat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
index 27d61b3..e8a6b13 100644
--- a/crypto/objects/obj_dat.c
+++ b/crypto/objects/obj_dat.c
@@ -397,6 +397,9 @@ int OBJ_obj2nid(const ASN1_OBJECT *a)
     if (a->nid != 0)
         return (a->nid);
 
+    if (a->length == 0)
+        return NID_undef;
+
     if (added != NULL) {
         ad.type = ADDED_DATA;
         ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */

From steve at openssl.org  Mon Jun  8 20:48:10 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 08 Jun 2015 20:48:10 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1433796490.055568.29872.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  17689e7dc6eb006990c205083c5b07a202f50f7e (commit)
      from  f803a417f7ad13a22d250aeba44ba85911a2b593 (commit)


- Log -----------------------------------------------------------------
commit 17689e7dc6eb006990c205083c5b07a202f50f7e
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Mon Jun 8 13:23:00 2015 +0100

    return correct NID for undefined object
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit 0fb9990480919163cc375a2b6c0df1d8d901a77b)

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/obj_dat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
index 9654775..b7d1b83 100644
--- a/crypto/objects/obj_dat.c
+++ b/crypto/objects/obj_dat.c
@@ -382,6 +382,9 @@ int OBJ_obj2nid(const ASN1_OBJECT *a)
     if (a->nid != 0)
         return (a->nid);
 
+    if (a->length == 0)
+        return NID_undef;
+
     if (added != NULL) {
         ad.type = ADDED_DATA;
         ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */

From steve at openssl.org  Mon Jun  8 20:48:10 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 08 Jun 2015 20:48:10 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433796490.356787.29936.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  34cdff92e97b3d65e8f1b6d60779107c99d3a931 (commit)
      from  05627d57e55517eae21c251fe287760bd1137218 (commit)


- Log -----------------------------------------------------------------
commit 34cdff92e97b3d65e8f1b6d60779107c99d3a931
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Mon Jun 8 13:23:00 2015 +0100

    return correct NID for undefined object
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit 0fb9990480919163cc375a2b6c0df1d8d901a77b)

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/obj_dat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
index 5ff1294..aca382a 100644
--- a/crypto/objects/obj_dat.c
+++ b/crypto/objects/obj_dat.c
@@ -417,6 +417,9 @@ int OBJ_obj2nid(const ASN1_OBJECT *a)
     if (a->nid != 0)
         return (a->nid);
 
+    if (a->length == 0)
+        return NID_undef;
+
     if (added != NULL) {
         ad.type = ADDED_DATA;
         ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */

From steve at openssl.org  Mon Jun  8 20:48:10 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 08 Jun 2015 20:48:10 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433796490.135938.29894.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  228806a4f3c42cfb304b974a267a95f7a12cba87 (commit)
      from  bb82db1c776ec85b9a63f79fa04b001fb7d46fc7 (commit)


- Log -----------------------------------------------------------------
commit 228806a4f3c42cfb304b974a267a95f7a12cba87
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Mon Jun 8 13:23:00 2015 +0100

    return correct NID for undefined object
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit 0fb9990480919163cc375a2b6c0df1d8d901a77b)

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/obj_dat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
index e42a1c1..454733d 100644
--- a/crypto/objects/obj_dat.c
+++ b/crypto/objects/obj_dat.c
@@ -415,6 +415,9 @@ int OBJ_obj2nid(const ASN1_OBJECT *a)
     if (a->nid != 0)
         return (a->nid);
 
+    if (a->length == 0)
+        return NID_undef;
+
     if (added != NULL) {
         ad.type = ADDED_DATA;
         ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */

From steve at openssl.org  Mon Jun  8 20:48:10 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 08 Jun 2015 20:48:10 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433796490.249128.29915.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  3d2c3fa5fc7e1cf119b50c0baf7511d7d75254e1 (commit)
      from  ba5693686e7bc408c2fcdb4d258e9410028dcfb4 (commit)


- Log -----------------------------------------------------------------
commit 3d2c3fa5fc7e1cf119b50c0baf7511d7d75254e1
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Mon Jun 8 13:23:00 2015 +0100

    return correct NID for undefined object
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit 0fb9990480919163cc375a2b6c0df1d8d901a77b)

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/obj_dat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
index 5ff1294..aca382a 100644
--- a/crypto/objects/obj_dat.c
+++ b/crypto/objects/obj_dat.c
@@ -417,6 +417,9 @@ int OBJ_obj2nid(const ASN1_OBJECT *a)
     if (a->nid != 0)
         return (a->nid);
 
+    if (a->length == 0)
+        return NID_undef;
+
     if (added != NULL) {
         ad.type = ADDED_DATA;
         ad.obj = (ASN1_OBJECT *)a; /* XXX: ugly but harmless */

From kurt at openssl.org  Mon Jun  8 22:49:48 2015
From: kurt at openssl.org (Kurt Roeckx)
Date: Mon, 08 Jun 2015 22:49:48 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433803788.438340.19553.nullmailer@dev.openssl.org>

The branch master has been updated
       via  1dece95168a32fb11cc671a7571807e04b47ed11 (commit)
       via  26c79d5641dcc85c666e0594c11663c00ec6c195 (commit)
      from  0fb9990480919163cc375a2b6c0df1d8d901a77b (commit)


- Log -----------------------------------------------------------------
commit 1dece95168a32fb11cc671a7571807e04b47ed11
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Apr 18 19:15:48 2015 +0200

    Only allow a temporary rsa key exchange when they key is larger than 512.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    MR #588

commit 26c79d5641dcc85c666e0594c11663c00ec6c195
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Apr 18 12:23:12 2015 +0200

    Properly check certificate in case of export ciphers.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    MR #588

-----------------------------------------------------------------------

Summary of changes:
 crypto/dh/dh_lib.c      |  5 ++++
 crypto/rsa/rsa_crpt.c   |  5 ++++
 doc/crypto/DH_size.pod  | 20 +++++++++------
 doc/crypto/RSA_size.pod | 19 ++++++++------
 doc/crypto/dh.pod       |  2 --
 doc/crypto/rsa.pod      |  2 --
 include/openssl/dh.h    |  1 +
 include/openssl/rsa.h   |  1 +
 ssl/s3_clnt.c           | 66 ++++++++++++++++++++++++++++++++++++++-----------
 util/libeay.num         |  2 ++
 10 files changed, 90 insertions(+), 33 deletions(-)

diff --git a/crypto/dh/dh_lib.c b/crypto/dh/dh_lib.c
index 4a37adc..cce2514 100644
--- a/crypto/dh/dh_lib.c
+++ b/crypto/dh/dh_lib.c
@@ -237,6 +237,11 @@ void *DH_get_ex_data(DH *d, int idx)
     return (CRYPTO_get_ex_data(&d->ex_data, idx));
 }
 
+int DH_bits(const DH *dh)
+{
+    return BN_num_bits(dh->p);
+}
+
 int DH_size(const DH *dh)
 {
     return (BN_num_bytes(dh->p));
diff --git a/crypto/rsa/rsa_crpt.c b/crypto/rsa/rsa_crpt.c
index 5220b7d..3c4fd67 100644
--- a/crypto/rsa/rsa_crpt.c
+++ b/crypto/rsa/rsa_crpt.c
@@ -64,6 +64,11 @@
 #include <openssl/rsa.h>
 #include <openssl/rand.h>
 
+int RSA_bits(const RSA *r)
+{
+    return (BN_num_bits(r->n));
+}
+
 int RSA_size(const RSA *r)
 {
     return (BN_num_bytes(r->n));
diff --git a/doc/crypto/DH_size.pod b/doc/crypto/DH_size.pod
index 97f26fd..e73f325 100644
--- a/doc/crypto/DH_size.pod
+++ b/doc/crypto/DH_size.pod
@@ -2,32 +2,38 @@
 
 =head1 NAME
 
-DH_size - get Diffie-Hellman prime size
+DH_size, DH_bits - get Diffie-Hellman prime size
 
 =head1 SYNOPSIS
 
- #include <openssl/dh.h>
+#include <openssl/dh.h>
 
- int DH_size(DH *dh);
+int DH_size(const DH *dh);
+
+int DH_bits(const DH *dh);
 
 =head1 DESCRIPTION
 
-This function returns the Diffie-Hellman size in bytes. It can be used
+DH_size() returns the Diffie-Hellman prime size in bytes. It can be used
 to determine how much memory must be allocated for the shared secret
 computed by DH_compute_key().
 
-B<dh-E<gt>p> must not be B<NULL>.
+DH_bits() returns the number of significant bits.
+
+B<dh> and B<dh-E<gt>p> must not be B<NULL>.
 
 =head1 RETURN VALUE
 
-The size in bytes.
+The size.
 
 =head1 SEE ALSO
 
-L<dh(3)|dh(3)>, L<DH_generate_key(3)|DH_generate_key(3)>
+L<dh(3)|dh(3)>, L<DH_generate_key(3)|DH_generate_key(3)>,
+L<BN_num_bits(3)|BN_num_bits(3)>
 
 =head1 HISTORY
 
 DH_size() is available in all versions of SSLeay and OpenSSL.
+DH_bits() was added in OpenSSL 1.1.0.
 
 =cut
diff --git a/doc/crypto/RSA_size.pod b/doc/crypto/RSA_size.pod
index 5b7f835..f68d5e8 100644
--- a/doc/crypto/RSA_size.pod
+++ b/doc/crypto/RSA_size.pod
@@ -2,32 +2,37 @@
 
 =head1 NAME
 
-RSA_size - get RSA modulus size
+RSA_size, RSA_bits - get RSA modulus size
 
 =head1 SYNOPSIS
 
- #include <openssl/rsa.h>
+#include <openssl/rsa.h>
 
- int RSA_size(const RSA *rsa);
+int RSA_size(const RSA *rsa);
+
+int RSA_bits(const RSA *rsa);
 
 =head1 DESCRIPTION
 
-This function returns the RSA modulus size in bytes. It can be used to
+RSA_size() returns the RSA modulus size in bytes. It can be used to
 determine how much memory must be allocated for an RSA encrypted
 value.
 
-B<rsa-E<gt>n> must not be B<NULL>.
+RSA_bits() returns the number of significant bits.
+
+B<rsa> and B<rsa-E<gt>n> must not be B<NULL>.
 
 =head1 RETURN VALUE
 
-The size in bytes.
+The size.
 
 =head1 SEE ALSO
 
-L<rsa(3)|rsa(3)>
+L<rsa(3)|rsa(3)>, L<BN_num_bits(3)|BN_num_bits(3)>
 
 =head1 HISTORY
 
 RSA_size() is available in all versions of SSLeay and OpenSSL.
+RSA_bits() was added in OpenSSL 1.1.0.
 
 =cut
diff --git a/doc/crypto/dh.pod b/doc/crypto/dh.pod
index c3ccd06..1c8a327 100644
--- a/doc/crypto/dh.pod
+++ b/doc/crypto/dh.pod
@@ -12,8 +12,6 @@ dh - Diffie-Hellman key agreement
  DH *	DH_new(void);
  void	DH_free(DH *dh);
 
- int	DH_size(const DH *dh);
-
  DH *	DH_generate_parameters(int prime_len, int generator,
 		void (*callback)(int, int, void *), void *cb_arg);
  int	DH_check(const DH *dh, int *codes);
diff --git a/doc/crypto/rsa.pod b/doc/crypto/rsa.pod
index 45ac53f..743334f 100644
--- a/doc/crypto/rsa.pod
+++ b/doc/crypto/rsa.pod
@@ -26,8 +26,6 @@ rsa - RSA public key cryptosystem
  int RSA_verify(int type, unsigned char *m, unsigned int m_len,
     unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
 
- int RSA_size(const RSA *rsa);
-
  RSA *RSA_generate_key(int num, unsigned long e,
     void (*callback)(int,int,void *), void *cb_arg);
 
diff --git a/include/openssl/dh.h b/include/openssl/dh.h
index 2d7c739..e0f4b57 100644
--- a/include/openssl/dh.h
+++ b/include/openssl/dh.h
@@ -200,6 +200,7 @@ DH *DH_new_method(ENGINE *engine);
 DH *DH_new(void);
 void DH_free(DH *dh);
 int DH_up_ref(DH *dh);
+int DH_bits(const DH *dh);
 int DH_size(const DH *dh);
 int DH_security_bits(const DH *dh);
 int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
diff --git a/include/openssl/rsa.h b/include/openssl/rsa.h
index 9ba6497..727b9df 100644
--- a/include/openssl/rsa.h
+++ b/include/openssl/rsa.h
@@ -319,6 +319,7 @@ struct rsa_st {
 
 RSA *RSA_new(void);
 RSA *RSA_new_method(ENGINE *engine);
+int RSA_bits(const RSA *rsa);
 int RSA_size(const RSA *rsa);
 int RSA_security_bits(const RSA *rsa);
 
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 632d743..935a621 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -334,7 +334,7 @@ int ssl3_connect(SSL *s)
             if (!
                 (s->s3->tmp.
                  new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
-&& !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                    && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
                 ret = ssl3_get_server_certificate(s);
                 if (ret <= 0)
                     goto end;
@@ -1704,6 +1704,13 @@ int ssl3_get_key_exchange(SSL *s)
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto err;
         }
+
+        if (EVP_PKEY_bits(pkey) <= SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+            al = SSL_AD_UNEXPECTED_MESSAGE;
+            SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE);
+            goto f_err;
+        }
+
         s->session->sess_cert->peer_rsa_tmp = rsa;
         rsa = NULL;
     }
@@ -3335,6 +3342,7 @@ int ssl3_check_cert_and_algorithm(SSL *s)
 #ifndef OPENSSL_NO_DH
     DH *dh;
 #endif
+    int al = SSL_AD_HANDSHAKE_FAILURE;
 
     alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
     alg_a = s->s3->tmp.new_cipher->algorithm_auth;
@@ -3395,17 +3403,33 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     }
 #endif
 #ifndef OPENSSL_NO_RSA
-    if ((alg_k & SSL_kRSA) &&
-        !(has_bits(i, EVP_PK_RSA | EVP_PKT_ENC) || (rsa != NULL))) {
-        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
-               SSL_R_MISSING_RSA_ENCRYPTING_CERT);
-        goto f_err;
+    if (alg_k & SSL_kRSA) {
+        if (!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
+            !has_bits(i, EVP_PK_RSA | EVP_PKT_ENC)) {
+            SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                   SSL_R_MISSING_RSA_ENCRYPTING_CERT);
+            goto f_err;
+        } else if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)) {
+            if (pkey_bits <= SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                if (!has_bits(i, EVP_PK_RSA | EVP_PKT_ENC)) {
+                    SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                           SSL_R_MISSING_RSA_ENCRYPTING_CERT);
+                    goto f_err;
+                }
+                if (rsa != NULL) {
+                    /* server key exchange is not allowed. */
+                    al = SSL_AD_INTERNAL_ERROR;
+                    SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
+                    goto f_err;
+                }
+            }
+        }
     }
 #endif
 #ifndef OPENSSL_NO_DH
-    if ((alg_k & SSL_kDHE) &&
-        !(has_bits(i, EVP_PK_DH | EVP_PKT_EXCH) || (dh != NULL))) {
-        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_MISSING_DH_KEY);
+    if ((alg_k & SSL_kDHE) && (dh == NULL)) {
+        al = SSL_AD_INTERNAL_ERROR;
+        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
         goto f_err;
     } else if ((alg_k & SSL_kDHr) && !SSL_USE_SIGALGS(s) &&
                !has_bits(i, EVP_PK_DH | EVP_PKS_RSA)) {
@@ -3427,9 +3451,14 @@ int ssl3_check_cert_and_algorithm(SSL *s)
         pkey_bits > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
 #ifndef OPENSSL_NO_RSA
         if (alg_k & SSL_kRSA) {
-            if (rsa == NULL
-                || RSA_size(rsa) * 8 >
+            if (rsa == NULL) {
+                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                       SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
+                goto f_err;
+            } else if (RSA_bits(rsa) >
                 SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                /* We have a temporary RSA key but it's too large. */
+                al = SSL_AD_EXPORT_RESTRICTION;
                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
                        SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
                 goto f_err;
@@ -3437,14 +3466,21 @@ int ssl3_check_cert_and_algorithm(SSL *s)
         } else
 #endif
 #ifndef OPENSSL_NO_DH
-        if (alg_k & (SSL_kDHE | SSL_kDHr | SSL_kDHd)) {
-            if (dh == NULL
-                || DH_size(dh) * 8 >
+        if (alg_k & SSL_kDHE) {
+            if (DH_bits(dh) >
                 SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                /* We have a temporary DH key but it's too large. */
+                al = SSL_AD_EXPORT_RESTRICTION;
                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
                        SSL_R_MISSING_EXPORT_TMP_DH_KEY);
                 goto f_err;
             }
+        } else if (alg_k & (SSL_kDHr | SSL_kDHd)) {
+            /* The cert should have had an export DH key. */
+            al = SSL_AD_EXPORT_RESTRICTION;
+            SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                   SSL_R_MISSING_EXPORT_TMP_DH_KEY);
+                goto f_err;
         } else
 #endif
         {
@@ -3455,7 +3491,7 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     }
     return (1);
  f_err:
-    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+    ssl3_send_alert(s, SSL3_AL_FATAL, al);
  err:
     return (0);
 }
diff --git a/util/libeay.num b/util/libeay.num
index c297ef7..edeb50d 100755
--- a/util/libeay.num
+++ b/util/libeay.num
@@ -4571,3 +4571,5 @@ ASN1_INTEGER_get_uint64                 4929	EXIST::FUNCTION:
 ASN1_INTEGER_set_uint64                 4930	EXIST::FUNCTION:
 PKCS5_pbe2_set_scrypt                   4931	EXIST::FUNCTION:
 PKCS8_set0_pbe                          4932	EXIST::FUNCTION:
+DH_bits                                 4933	EXIST::FUNCTION:DH
+RSA_bits                                4934	EXIST::FUNCTION:RSA

From rsalz at openssl.org  Tue Jun  9 00:20:33 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 09 Jun 2015 00:20:33 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433809233.350429.9550.nullmailer@dev.openssl.org>

The branch master has been updated
       via  82c4d793181058de9fde5c9088fd400fdb7e01e3 (commit)
      from  1dece95168a32fb11cc671a7571807e04b47ed11 (commit)


- Log -----------------------------------------------------------------
commit 82c4d793181058de9fde5c9088fd400fdb7e01e3
Author: Jeffrey Walton <noloader at gmail.com>
Date:   Sat Jun 6 21:52:56 2015 -0400

    Explicitly mention PKCS5_PBKDF2_HMAC in EVP doc.
    
    Signed-off-by: Rich Salz <rsalz at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 doc/crypto/EVP_BytesToKey.pod | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/crypto/EVP_BytesToKey.pod b/doc/crypto/EVP_BytesToKey.pod
index e6df57d..dca5239 100644
--- a/doc/crypto/EVP_BytesToKey.pod
+++ b/doc/crypto/EVP_BytesToKey.pod
@@ -36,8 +36,8 @@ If the total key and IV length is less than the digest length and
 B<MD5> is used then the derivation algorithm is compatible with PKCS#5 v1.5
 otherwise a non standard extension is used to derive the extra data.
 
-Newer applications should use more standard algorithms such as PBKDF2 as
-defined in PKCS#5v2.1 for key derivation.
+Newer applications should use a more modern algorithm such as PBKDF2 as
+defined in PKCS#5v2.1 and provided by PKCS5_PBKDF2_HMAC.
 
 =head1 KEY DERIVATION ALGORITHM
 

From rsalz at openssl.org  Tue Jun  9 00:21:29 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 09 Jun 2015 00:21:29 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433809289.807642.17064.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  31909e796878a8f546b290916e5bb53fbbfc91f4 (commit)
      from  34cdff92e97b3d65e8f1b6d60779107c99d3a931 (commit)


- Log -----------------------------------------------------------------
commit 31909e796878a8f546b290916e5bb53fbbfc91f4
Author: Jeffrey Walton <noloader at gmail.com>
Date:   Sat Jun 6 21:52:56 2015 -0400

    Explicitly mention PKCS5_PBKDF2_HMAC in EVP doc.
    
    Signed-off-by: Rich Salz <rsalz at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 82c4d793181058de9fde5c9088fd400fdb7e01e3)

-----------------------------------------------------------------------

Summary of changes:
 doc/crypto/EVP_BytesToKey.pod | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/crypto/EVP_BytesToKey.pod b/doc/crypto/EVP_BytesToKey.pod
index 5d60595..a9b6bb0 100644
--- a/doc/crypto/EVP_BytesToKey.pod
+++ b/doc/crypto/EVP_BytesToKey.pod
@@ -36,8 +36,8 @@ If the total key and IV length is less than the digest length and
 B<MD5> is used then the derivation algorithm is compatible with PKCS#5 v1.5
 otherwise a non standard extension is used to derive the extra data.
 
-Newer applications should use more standard algorithms such as PBKDF2 as
-defined in PKCS#5v2.1 for key derivation.
+Newer applications should use a more modern algorithm such as PBKDF2 as
+defined in PKCS#5v2.1 and provided by PKCS5_PBKDF2_HMAC.
 
 =head1 KEY DERIVATION ALGORITHM
 

From rsalz at openssl.org  Tue Jun  9 16:39:18 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 09 Jun 2015 16:39:18 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433867958.449120.23136.nullmailer@dev.openssl.org>

The branch master has been updated
       via  51b04a6117510d8a771f619cb419985f4dec32bb (commit)
      from  82c4d793181058de9fde5c9088fd400fdb7e01e3 (commit)


- Log -----------------------------------------------------------------
commit 51b04a6117510d8a771f619cb419985f4dec32bb
Author: Rich Salz <rsalz at akamai.com>
Date:   Thu Jun 4 12:42:36 2015 -0400

    No fprintf in the txt_db component
    
    Also removed a source file that isn't built, and moved
    another one to test for eventual fixing.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/conf/cnf_save.c                | 104 ----------------------------------
 crypto/txt_db/txt_db.c                |   6 +-
 include/openssl/txt_db.h              |   1 +
 crypto/conf/test.c => test/conftest.c |   6 +-
 4 files changed, 6 insertions(+), 111 deletions(-)
 delete mode 100644 crypto/conf/cnf_save.c
 rename crypto/conf/test.c => test/conftest.c (98%)

diff --git a/crypto/conf/cnf_save.c b/crypto/conf/cnf_save.c
deleted file mode 100644
index 71c4317..0000000
--- a/crypto/conf/cnf_save.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/* crypto/conf/cnf_save.c */
-/* Copyright (C) 1995-1998 Eric Young (eay at cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay at cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh at cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay at cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh at cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <openssl/conf.h>
-
-static void print_conf(CONF_VALUE *cv);
-static IMPLEMENT_LHASH_DOALL_FN(print_conf, CONF_VALUE *);
-
-main()
-{
-    LHASH *conf;
-    long l;
-
-    conf = CONF_load(NULL, "../../apps/openssl.cnf", &l);
-    if (conf == NULL) {
-        fprintf(stderr, "error loading config, line %ld\n", l);
-        exit(1);
-    }
-
-    lh_doall(conf, LHASH_DOALL_FN(print_conf));
-}
-
-static void print_conf(CONF_VALUE *cv)
-{
-    int i;
-    CONF_VALUE *v;
-    char *section;
-    char *name;
-    char *value;
-    STACK *s;
-
-    /* If it is a single entry, return */
-
-    if (cv->name != NULL)
-        return;
-
-    printf("[ %s ]\n", cv->section);
-    s = (STACK *) cv->value;
-
-    for (i = 0; i < sk_num(s); i++) {
-        v = (CONF_VALUE *)sk_value(s, i);
-        section = (v->section == NULL) ? "None" : v->section;
-        name = (v->name == NULL) ? "None" : v->name;
-        value = (v->value == NULL) ? "None" : v->value;
-        printf("%s=%s\n", name, value);
-    }
-    printf("\n");
-}
diff --git a/crypto/txt_db/txt_db.c b/crypto/txt_db/txt_db.c
index 2384917..5b1e592 100644
--- a/crypto/txt_db/txt_db.c
+++ b/crypto/txt_db/txt_db.c
@@ -155,11 +155,7 @@ TXT_DB *TXT_DB_read(BIO *in, int num)
         }
         *(p++) = '\0';
         if ((n != num) || (*f != '\0')) {
-#if !defined(OPENSSL_NO_STDIO)  /* temporary fix :-( */
-            fprintf(stderr,
-                    "wrong number of fields on line %ld (looking for field %d, got %d, '%s' left)\n",
-                    ln, num, n, f);
-#endif
+            ret->error = DB_ERROR_WRONG_NUM_FIELDS;
             goto err;
         }
         pp[n] = p;
diff --git a/include/openssl/txt_db.h b/include/openssl/txt_db.h
index 54b71fc..0e49a54 100644
--- a/include/openssl/txt_db.h
+++ b/include/openssl/txt_db.h
@@ -70,6 +70,7 @@
 # define DB_ERROR_INDEX_OUT_OF_RANGE     3
 # define DB_ERROR_NO_INDEX               4
 # define DB_ERROR_INSERT_INDEX_CLASH     5
+# define DB_ERROR_WRONG_NUM_FIELDS       6
 
 #ifdef  __cplusplus
 extern "C" {
diff --git a/crypto/conf/test.c b/test/conftest.c
similarity index 98%
rename from crypto/conf/test.c
rename to test/conftest.c
index cc1efcc..c303d39 100644
--- a/crypto/conf/test.c
+++ b/test/conftest.c
@@ -58,14 +58,16 @@
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <openssl/lhash.h>
 #include <openssl/conf.h>
 #include <openssl/err.h>
 
+int
 main()
 {
     LHASH *conf;
     long eline;
-    char *s, *s2;
+    char *s;
 
 #ifdef USE_WIN32
     CONF_set_default_method(CONF_WIN32);
@@ -93,5 +95,5 @@ main()
     printf("---------------------------- DUMP ------------------------\n");
     CONF_dump_fp(conf, stdout);
 
-    exit(0);
+    return 0;
 }

From rsalz at openssl.org  Tue Jun  9 16:49:02 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 09 Jun 2015 16:49:02 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433868542.594725.25799.nullmailer@dev.openssl.org>

The branch master has been updated
       via  7768e116dc0f2ad7c8d2241b887fc6c66d03e3bb (commit)
      from  51b04a6117510d8a771f619cb419985f4dec32bb (commit)


- Log -----------------------------------------------------------------
commit 7768e116dc0f2ad7c8d2241b887fc6c66d03e3bb
Author: Rich Salz <rsalz at akamai.com>
Date:   Thu Jun 4 14:26:55 2015 -0400

    Use bio_err not stderr in apps.
    
    Except for VMS startup code.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/openssl.c  | 27 +++++++++++++--------------
 apps/passwd.c   |  4 ++--
 apps/s_cb.c     |  5 +++--
 apps/s_server.c |  8 ++++----
 apps/s_socket.c |  6 ++----
 apps/s_time.c   |  4 ++--
 apps/speed.c    | 12 ++++++------
 7 files changed, 32 insertions(+), 34 deletions(-)

diff --git a/apps/openssl.c b/apps/openssl.c
index 9a152f5..9117726 100644
--- a/apps/openssl.c
+++ b/apps/openssl.c
@@ -264,10 +264,9 @@ static void lock_dbg_cb(int mode, int type, const char *file, int line)
 
  err:
     if (errstr) {
-        /* we cannot use bio_err here */
-        fprintf(stderr,
-                "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
-                errstr, mode, type, file, line);
+        BIO_printf(bio_err,
+                   "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
+                   errstr, mode, type, file, line);
     }
 }
 
@@ -348,6 +347,12 @@ int main(int argc, char *argv[])
     arg.argv = NULL;
     arg.size = 0;
 
+    /* Set up some of the environment. */
+    default_config_file = make_config_name();
+    bio_in = dup_bio_in();
+    bio_out = dup_bio_out();
+    bio_err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+
 #if defined( OPENSSL_SYS_VMS)
     copied_argv = argv = copy_argv(&argc, argv);
 #endif
@@ -369,12 +374,12 @@ int main(int argc, char *argv[])
 #ifdef OPENSSL_FIPS
         if (!FIPS_mode_set(1)) {
             ERR_load_crypto_strings();
-            ERR_print_errors(BIO_new_fp(stderr, BIO_NOCLOSE));
-            EXIT(1);
+            ERR_print_errors(bio_err);
+            return 1;
         }
 #else
-        fprintf(stderr, "FIPS mode not supported.\n");
-        EXIT(1);
+        BIO_printf(bio_err, "FIPS mode not supported.\n");
+        return 1;
 #endif
     }
 
@@ -393,12 +398,6 @@ int main(int argc, char *argv[])
     prog = prog_init();
     pname = opt_progname(argv[0]);
 
-    /* Lets load up our environment a little */
-    default_config_file = make_config_name();
-    bio_in = dup_bio_in();
-    bio_out = dup_bio_out();
-    bio_err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
     /* first check the program name */
     f.name = pname;
     fp = lh_FUNCTION_retrieve(prog, &f);
diff --git a/apps/passwd.c b/apps/passwd.c
index 2e37629..0e168c4 100644
--- a/apps/passwd.c
+++ b/apps/passwd.c
@@ -496,7 +496,7 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
 
 int passwd_main(int argc, char **argv)
 {
-    fputs("Program not available.\n", stderr)
-        return (1);
+    BIO_printf(bio_err, "Program not available.\n");
+    return (1);
 }
 #endif
diff --git a/apps/s_cb.c b/apps/s_cb.c
index 35366c5..44e70f2 100644
--- a/apps/s_cb.c
+++ b/apps/s_cb.c
@@ -931,8 +931,9 @@ static int set_cert_cb(SSL *ssl, void *arg)
     static int retry_cnt;
     if (retry_cnt < 5) {
         retry_cnt++;
-        fprintf(stderr, "Certificate callback retry test: count %d\n",
-                retry_cnt);
+        BIO_printf(bio_err,
+                   "Certificate callback retry test: count %d\n",
+                   retry_cnt);
         return -1;
     }
 #endif
diff --git a/apps/s_server.c b/apps/s_server.c
index 6bd0257..8354386 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -2376,8 +2376,8 @@ static int init_ssl_connection(SSL *con)
     {
         while (i <= 0 && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP
                && SSL_state(con) == SSL3_ST_SR_CLNT_HELLO_C) {
-            fprintf(stderr,
-                    "LOOKUP from certificate callback during accept\n");
+            BIO_printf(bio_err,
+                       "LOOKUP from certificate callback during accept\n");
             i = SSL_accept(con);
         }
     }
@@ -2811,10 +2811,10 @@ static int www_body(char *hostname, int s, int stype, unsigned char *context)
 
 #ifdef RENEG
                 total_bytes += i;
-                fprintf(stderr, "%d\n", i);
+                BIO_printf(bio_err, "%d\n", i);
                 if (total_bytes > 3 * 1024) {
                     total_bytes = 0;
-                    fprintf(stderr, "RENEGOTIATE\n");
+                    BIO_printf(bio_err, "RENEGOTIATE\n");
                     SSL_renegotiate(con);
                 }
 #endif
diff --git a/apps/s_socket.c b/apps/s_socket.c
index 1ca0d3a..c1faffc 100644
--- a/apps/s_socket.c
+++ b/apps/s_socket.c
@@ -539,8 +539,7 @@ static int do_accept(int acc_sock, int *sock, char **host)
              */
             goto redoit;
         }
-        fprintf(stderr, "errno=%d ", errno);
-        perror("accept");
+        BIO_printf(bio_err, "accept errno=%d, %s\n", errno, strerror(errno));
 # endif
         return (0);
     }
@@ -597,8 +596,7 @@ static int do_accept_unix(int acc_sock, int *sock)
              */
             goto redoit;
         }
-        fprintf(stderr, "errno=%d ", errno);
-        perror("accept");
+        BIO_printf(bio_err, "accept errno=%d, %s\n", errno, strerror(errno));
         return (0);
     }
 
diff --git a/apps/s_time.c b/apps/s_time.c
index 4f56174..ef95b5a 100644
--- a/apps/s_time.c
+++ b/apps/s_time.c
@@ -238,7 +238,7 @@ int s_time_main(int argc, char **argv)
     if (cipher == NULL)
         cipher = getenv("SSL_CIPHER");
     if (cipher == NULL) {
-        fprintf(stderr, "No CIPHER specified\n");
+        BIO_printf(bio_err, "No CIPHER specified\n");
         goto end;
     }
 
@@ -336,7 +336,7 @@ int s_time_main(int argc, char **argv)
 
     /* Get an SSL object so we can reuse the session id */
     if ((scon = doConnection(NULL, host, ctx)) == NULL) {
-        fprintf(stderr, "Unable to get connection\n");
+        BIO_printf(bio_err, "Unable to get connection\n");
         goto end;
     }
 
diff --git a/apps/speed.c b/apps/speed.c
index 45a060f..1a3027b 100644
--- a/apps/speed.c
+++ b/apps/speed.c
@@ -1649,7 +1649,7 @@ int speed_main(int argc, char **argv)
             if (!
                 (EVP_CIPHER_flags(evp_cipher) &
                  EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
-                fprintf(stderr, "%s is not multi-block capable\n",
+                BIO_printf(bio_err, "%s is not multi-block capable\n",
                         OBJ_nid2ln(evp_cipher->nid));
                 goto end;
             }
@@ -2290,11 +2290,11 @@ static int do_multi(int multi)
     fds = malloc(sizeof(*fds) * multi);
     for (n = 0; n < multi; ++n) {
         if (pipe(fd) == -1) {
-            fprintf(stderr, "pipe failure\n");
+            BIO_printf(bio_err, "pipe failure\n");
             exit(1);
         }
         fflush(stdout);
-        fflush(stderr);
+        (void)BIO_flush(bio_err);
         if (fork()) {
             close(fd[1]);
             fds[n] = fd[0];
@@ -2302,7 +2302,7 @@ static int do_multi(int multi)
             close(fd[0]);
             close(1);
             if (dup(fd[1]) == -1) {
-                fprintf(stderr, "dup failed\n");
+                BIO_printf(bio_err, "dup failed\n");
                 exit(1);
             }
             close(fd[1]);
@@ -2326,7 +2326,7 @@ static int do_multi(int multi)
             if (p)
                 *p = '\0';
             if (buf[0] != '+') {
-                fprintf(stderr, "Don't understand line '%s' from child %d\n",
+                BIO_printf(bio_err, "Don't understand line '%s' from child %d\n",
                         buf, n);
                 continue;
             }
@@ -2428,7 +2428,7 @@ static int do_multi(int multi)
             else if (strncmp(buf, "+H:", 3) == 0) {
                 ;
             } else
-                fprintf(stderr, "Unknown type '%s' from child %d\n", buf, n);
+                BIO_printf(bio_err, "Unknown type '%s' from child %d\n", buf, n);
         }
 
         fclose(f);

From rsalz at openssl.org  Tue Jun  9 16:50:04 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 09 Jun 2015 16:50:04 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433868604.162864.26762.nullmailer@dev.openssl.org>

The branch master has been updated
       via  121ee399c91789b34898e25eed67802e7a888277 (commit)
      from  7768e116dc0f2ad7c8d2241b887fc6c66d03e3bb (commit)


- Log -----------------------------------------------------------------
commit 121ee399c91789b34898e25eed67802e7a888277
Author: Rich Salz <rsalz at akamai.com>
Date:   Wed May 20 06:56:14 2015 -0400

    Fix -DZLIB build for opaque COMP types
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/comp/c_zlib.c   | 51 +++++++++-----------------------------------------
 crypto/comp/comp_lcl.h |  1 +
 2 files changed, 10 insertions(+), 42 deletions(-)

diff --git a/crypto/comp/c_zlib.c b/crypto/comp/c_zlib.c
index 83773a1..6a57f70 100644
--- a/crypto/comp/c_zlib.c
+++ b/crypto/comp/c_zlib.c
@@ -109,9 +109,7 @@ static COMP_METHOD zlib_stateful_method = {
     zlib_stateful_init,
     zlib_stateful_finish,
     zlib_stateful_compress_block,
-    zlib_stateful_expand_block,
-    NULL,
-    NULL,
+    zlib_stateful_expand_block
 };
 
 /*
@@ -167,8 +165,6 @@ struct zlib_state {
     z_stream ostream;
 };
 
-static int zlib_stateful_ex_idx = -1;
-
 static int zlib_stateful_init(COMP_CTX *ctx)
 {
     int err;
@@ -200,8 +196,7 @@ static int zlib_stateful_init(COMP_CTX *ctx)
     if (err != Z_OK)
         goto err;
 
-    CRYPTO_new_ex_data(CRYPTO_EX_INDEX_COMP, ctx, &ctx->ex_data);
-    CRYPTO_set_ex_data(&ctx->ex_data, zlib_stateful_ex_idx, state);
+    ctx->data = state;
     return 1;
  err:
     OPENSSL_free(state);
@@ -210,13 +205,10 @@ static int zlib_stateful_init(COMP_CTX *ctx)
 
 static void zlib_stateful_finish(COMP_CTX *ctx)
 {
-    struct zlib_state *state =
-        (struct zlib_state *)CRYPTO_get_ex_data(&ctx->ex_data,
-                                                zlib_stateful_ex_idx);
+    struct zlib_state *state = ctx->data;
     inflateEnd(&state->istream);
     deflateEnd(&state->ostream);
     OPENSSL_free(state);
-    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_COMP, ctx, &ctx->ex_data);
 }
 
 static int zlib_stateful_compress_block(COMP_CTX *ctx, unsigned char *out,
@@ -224,9 +216,7 @@ static int zlib_stateful_compress_block(COMP_CTX *ctx, unsigned char *out,
                                         unsigned int ilen)
 {
     int err = Z_OK;
-    struct zlib_state *state =
-        (struct zlib_state *)CRYPTO_get_ex_data(&ctx->ex_data,
-                                                zlib_stateful_ex_idx);
+    struct zlib_state *state = ctx->data;
 
     if (state == NULL)
         return -1;
@@ -252,10 +242,7 @@ static int zlib_stateful_expand_block(COMP_CTX *ctx, unsigned char *out,
                                       unsigned int ilen)
 {
     int err = Z_OK;
-
-    struct zlib_state *state =
-        (struct zlib_state *)CRYPTO_get_ex_data(&ctx->ex_data,
-                                                zlib_stateful_ex_idx);
+    struct zlib_state *state = ctx->data;
 
     if (state == NULL)
         return 0;
@@ -307,33 +294,13 @@ COMP_METHOD *COMP_zlib(void)
                 && p_inflateInit_ && p_deflateEnd
                 && p_deflate && p_deflateInit_ && p_zError)
                 zlib_loaded++;
+            if (zlib_loaded)
+                meth = &zlib_stateful_method;
         }
     }
 #endif
-#ifdef ZLIB_SHARED
-    if (zlib_loaded)
-#endif
-#if defined(ZLIB) || defined(ZLIB_SHARED)
-    {
-        /*
-         * init zlib_stateful_ex_idx here so that in a multi-process
-         * application it's enough to intialize openssl before forking (idx
-         * will be inherited in all the children)
-         */
-        if (zlib_stateful_ex_idx == -1) {
-            CRYPTO_w_lock(CRYPTO_LOCK_COMP);
-            if (zlib_stateful_ex_idx == -1)
-                zlib_stateful_ex_idx =
-                    CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_COMP,
-                                            0, NULL, NULL, NULL, NULL);
-            CRYPTO_w_unlock(CRYPTO_LOCK_COMP);
-            if (zlib_stateful_ex_idx == -1)
-                goto err;
-        }
-
-        meth = &zlib_stateful_method;
-    }
- err:
+#if defined(ZLIB)
+    meth = &zlib_stateful_method;
 #endif
 
     return (meth);
diff --git a/crypto/comp/comp_lcl.h b/crypto/comp/comp_lcl.h
index f1ec8d5..613437e 100644
--- a/crypto/comp/comp_lcl.h
+++ b/crypto/comp/comp_lcl.h
@@ -71,4 +71,5 @@ struct comp_ctx_st {
     unsigned long compress_out;
     unsigned long expand_in;
     unsigned long expand_out;
+    void* data;
 };

From levitte at openssl.org  Wed Jun 10 00:01:56 2015
From: levitte at openssl.org (Richard Levitte)
Date: Wed, 10 Jun 2015 00:01:56 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433894516.825049.10240.nullmailer@dev.openssl.org>

The branch master has been updated
       via  acaff3b797f50a0a0e17a0be45b7fafad962004e (commit)
       via  177b5f9c82e1152d6ce20a83556db629697fff65 (commit)
      from  121ee399c91789b34898e25eed67802e7a888277 (commit)


- Log -----------------------------------------------------------------
commit acaff3b797f50a0a0e17a0be45b7fafad962004e
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Jun 9 23:06:23 2015 +0200

    When making libcrypto from apps or test, make sure to include engines
    
    For librypto to be complete, the stuff in both crypto/ and engines/
    have to be built.  Doing 'make test' or 'make apps' from a clean
    source tree failed to do so.
    Corrected by using the new 'build_libcrypto' in the top Makefile.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

commit 177b5f9c82e1152d6ce20a83556db629697fff65
Author: Richard Levitte <levitte at openssl.org>
Date:   Wed Jun 10 01:34:26 2015 +0200

    Add and rearrange building of libraries
    
    There's a need for a target that will build all of libcrypto, so let's
    add 'build_libcrypto' that does this.  For ortogonality, let's also
    add 'build_libssl'.  Have both also depend on 'libcrypto.pc' and
    'libssl.pc' so those get built together with the libraries.
    This makes 'all' depend on fewer things directly.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 Makefile.org  | 7 +++++--
 apps/Makefile | 4 ++--
 test/Makefile | 4 ++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/Makefile.org b/Makefile.org
index 9f72cdb..e9b49d9 100644
--- a/Makefile.org
+++ b/Makefile.org
@@ -187,7 +187,7 @@ INSTALLDIRS=	\
 		$(INSTALL_PREFIX)$(OPENSSLDIR)/certs \
 		$(INSTALL_PREFIX)$(OPENSSLDIR)/private
 
-all: Makefile build_all openssl.pc libssl.pc libcrypto.pc
+all: Makefile build_all
 
 # as we stick to -e, CLEARENV ensures that local variables in lower
 # Makefiles remain local and variable. $${VAR+VAR} is tribute to Korn
@@ -272,7 +272,10 @@ sub_all: build_all
 
 build_all: build_libs build_apps build_tests build_tools
 
-build_libs: build_crypto build_ssl build_engines
+build_libs: build_libcrypto build_libssl openssl.pc
+
+build_libcrypto: build_crypto build_engines libcrypto.pc
+build_libssl: build_ssl libssl.pc
 
 build_crypto:
 	@dir=crypto; target=all; $(BUILD_ONE_CMD)
diff --git a/apps/Makefile b/apps/Makefile
index 90e6014..bf554ab 100644
--- a/apps/Makefile
+++ b/apps/Makefile
@@ -139,10 +139,10 @@ clean:
 	rm -f req
 
 $(DLIBSSL):
-	(cd ..; $(MAKE) DIRS=ssl all)
+	(cd ..; $(MAKE) build_libssl)
 
 $(DLIBCRYPTO):
-	(cd ..; $(MAKE) DIRS=crypto all)
+	(cd ..; $(MAKE) build_libcrypto)
 
 $(EXE): progs.h $(EXE_OBJ) $(DLIBCRYPTO) $(DLIBSSL)
 	$(RM) $(EXE)
diff --git a/test/Makefile b/test/Makefile
index d37e020..343c21a 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -409,10 +409,10 @@ clean:
 	rm -f .rnd tmp.bntest tmp.bctest *.o *.obj *.dll lib tags core .pure .nfs* *.old *.bak fluff $(EXE) *.ss *.srl log dummytest
 
 $(DLIBSSL):
-	(cd ..; $(MAKE) DIRS=ssl all)
+	(cd ..; $(MAKE) build_libssl)
 
 $(DLIBCRYPTO):
-	(cd ..; $(MAKE) DIRS=crypto all)
+	(cd ..; $(MAKE) build_libcrypto)
 
 BUILD_CMD=shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \
 		shlib_target="$(SHLIB_TARGET)"; \

From levitte at openssl.org  Wed Jun 10 00:03:55 2015
From: levitte at openssl.org (Richard Levitte)
Date: Wed, 10 Jun 2015 00:03:55 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433894635.259844.11251.nullmailer@dev.openssl.org>

The branch master has been updated
       via  e36c5fc4f547ce62280e5a704d1f94189742ec65 (commit)
      from  acaff3b797f50a0a0e17a0be45b7fafad962004e (commit)


- Log -----------------------------------------------------------------
commit e36c5fc4f547ce62280e5a704d1f94189742ec65
Author: Richard Levitte <levitte at openssl.org>
Date:   Wed Jun 10 01:51:23 2015 +0200

    Make sure test/gost2814789test.c can see configuration macros
    
    test/gost2814789test.c needs to include openssl/e_os2.h or it wouldn't
    see the defined OPENSSL_NO_* macros.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 test/gost2814789test.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/gost2814789test.c b/test/gost2814789test.c
index 4569249..b2cd41f 100644
--- a/test/gost2814789test.c
+++ b/test/gost2814789test.c
@@ -8,6 +8,7 @@
  * ====================================================================
  */
 #include <stdio.h>
+#include <openssl/e_os2.h>
 
 #if defined(OPENSSL_NO_ENGINE) || defined(OPENSSL_NO_GOST)
 int main(int argc, char *argv[])

From levitte at openssl.org  Wed Jun 10 00:13:09 2015
From: levitte at openssl.org (Richard Levitte)
Date: Wed, 10 Jun 2015 00:13:09 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433895189.681662.13572.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  cb972a4fe710c3e07300cdd3e3c3d41a42fc9672 (commit)
       via  ee2d14be9411c46242bdbe87c10c3bd58137332a (commit)
      from  3d2c3fa5fc7e1cf119b50c0baf7511d7d75254e1 (commit)


- Log -----------------------------------------------------------------
commit cb972a4fe710c3e07300cdd3e3c3d41a42fc9672
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Jun 9 23:06:23 2015 +0200

    When making libcrypto from apps or test, make sure to include engines
    
    For librypto to be complete, the stuff in both crypto/ and engines/
    have to be built.  Doing 'make test' or 'make apps' from a clean
    source tree failed to do so.
    Corrected by using the new 'build_libcrypto' in the top Makefile.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit acaff3b797f50a0a0e17a0be45b7fafad962004e)

commit ee2d14be9411c46242bdbe87c10c3bd58137332a
Author: Richard Levitte <levitte at openssl.org>
Date:   Wed Jun 10 01:34:26 2015 +0200

    Add and rearrange building of libraries
    
    There's a need for a target that will build all of libcrypto, so let's
    add 'build_libcrypto' that does this.  For ortogonality, let's also
    add 'build_libssl'.  Have both also depend on 'libcrypto.pc' and
    'libssl.pc' so those get built together with the libraries.
    This makes 'all' depend on fewer things directly.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit 177b5f9c82e1152d6ce20a83556db629697fff65)
    
    Conflicts:
    	Makefile.org

-----------------------------------------------------------------------

Summary of changes:
 Makefile.org  | 7 +++++--
 apps/Makefile | 4 ++--
 test/Makefile | 4 ++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/Makefile.org b/Makefile.org
index 8b4de74..cf82487 100644
--- a/Makefile.org
+++ b/Makefile.org
@@ -184,7 +184,7 @@ WTARFILE=       $(NAME)-win.tar
 EXHEADER=       e_os2.h
 HEADER=         e_os.h
 
-all: Makefile build_all openssl.pc libssl.pc libcrypto.pc
+all: Makefile build_all
 
 # as we stick to -e, CLEARENV ensures that local variables in lower
 # Makefiles remain local and variable. $${VAR+VAR} is tribute to Korn
@@ -270,7 +270,10 @@ reflect:
 sub_all: build_all
 build_all: build_libs build_apps build_tests build_tools
 
-build_libs: build_crypto build_ssl build_engines
+build_libs: build_libcrypto build_libssl openssl.pc
+
+build_libcrypto: build_crypto build_engines libcrypto.pc
+build_libssl: build_ssl libssl.pc
 
 build_crypto:
 	@dir=crypto; target=all; $(BUILD_ONE_CMD)
diff --git a/apps/Makefile b/apps/Makefile
index 963780f..a2c1565 100644
--- a/apps/Makefile
+++ b/apps/Makefile
@@ -147,10 +147,10 @@ clean:
 	rm -f req
 
 $(DLIBSSL):
-	(cd ..; $(MAKE) DIRS=ssl all)
+	(cd ..; $(MAKE) build_libssl)
 
 $(DLIBCRYPTO):
-	(cd ..; $(MAKE) DIRS=crypto all)
+	(cd ..; $(MAKE) build_libcrypto)
 
 $(EXE): progs.h $(E_OBJ) $(PROGRAM).o $(DLIBCRYPTO) $(DLIBSSL)
 	$(RM) $(EXE)
diff --git a/test/Makefile b/test/Makefile
index 6205d80..0ee4ec2 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -355,10 +355,10 @@ clean:
 	rm -f .rnd tmp.bntest tmp.bctest *.o *.obj *.dll lib tags core .pure .nfs* *.old *.bak fluff $(EXE) *.ss *.srl log dummytest
 
 $(DLIBSSL):
-	(cd ..; $(MAKE) DIRS=ssl all)
+	(cd ..; $(MAKE) build_libssl)
 
 $(DLIBCRYPTO):
-	(cd ..; $(MAKE) DIRS=crypto all)
+	(cd ..; $(MAKE) build_libcrypto)
 
 BUILD_CMD=shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \
 		shlib_target="$(SHLIB_TARGET)"; \

From levitte at openssl.org  Wed Jun 10 00:13:22 2015
From: levitte at openssl.org (Richard Levitte)
Date: Wed, 10 Jun 2015 00:13:22 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433895202.896809.13811.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  80d586d97f4e8cd80d0f0c4152617250d261948d (commit)
       via  cbfec68a79a327e1ec177f09d960df0fa2e09529 (commit)
      from  31909e796878a8f546b290916e5bb53fbbfc91f4 (commit)


- Log -----------------------------------------------------------------
commit 80d586d97f4e8cd80d0f0c4152617250d261948d
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Jun 9 23:06:23 2015 +0200

    When making libcrypto from apps or test, make sure to include engines
    
    For librypto to be complete, the stuff in both crypto/ and engines/
    have to be built.  Doing 'make test' or 'make apps' from a clean
    source tree failed to do so.
    Corrected by using the new 'build_libcrypto' in the top Makefile.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit acaff3b797f50a0a0e17a0be45b7fafad962004e)

commit cbfec68a79a327e1ec177f09d960df0fa2e09529
Author: Richard Levitte <levitte at openssl.org>
Date:   Wed Jun 10 01:34:26 2015 +0200

    Add and rearrange building of libraries
    
    There's a need for a target that will build all of libcrypto, so let's
    add 'build_libcrypto' that does this.  For ortogonality, let's also
    add 'build_libssl'.  Have both also depend on 'libcrypto.pc' and
    'libssl.pc' so those get built together with the libraries.
    This makes 'all' depend on fewer things directly.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit 177b5f9c82e1152d6ce20a83556db629697fff65)
    
    Conflicts:
    	Makefile.org

-----------------------------------------------------------------------

Summary of changes:
 Makefile.org  | 7 +++++--
 apps/Makefile | 4 ++--
 test/Makefile | 4 ++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/Makefile.org b/Makefile.org
index 0b2b72d..9f4faae 100644
--- a/Makefile.org
+++ b/Makefile.org
@@ -185,7 +185,7 @@ WTARFILE=       $(NAME)-win.tar
 EXHEADER=       e_os2.h
 HEADER=         e_os.h
 
-all: Makefile build_all openssl.pc libssl.pc libcrypto.pc
+all: Makefile build_all
 
 # as we stick to -e, CLEARENV ensures that local variables in lower
 # Makefiles remain local and variable. $${VAR+VAR} is tribute to Korn
@@ -271,7 +271,10 @@ reflect:
 sub_all: build_all
 build_all: build_libs build_apps build_tests build_tools
 
-build_libs: build_crypto build_ssl build_engines
+build_libs: build_libcrypto build_libssl openssl.pc
+
+build_libcrypto: build_crypto build_engines libcrypto.pc
+build_libssl: build_ssl libssl.pc
 
 build_crypto:
 	@dir=crypto; target=all; $(BUILD_ONE_CMD)
diff --git a/apps/Makefile b/apps/Makefile
index a6c9d54..64c3baa 100644
--- a/apps/Makefile
+++ b/apps/Makefile
@@ -147,10 +147,10 @@ clean:
 	rm -f req
 
 $(DLIBSSL):
-	(cd ..; $(MAKE) DIRS=ssl all)
+	(cd ..; $(MAKE) build_libssl)
 
 $(DLIBCRYPTO):
-	(cd ..; $(MAKE) DIRS=crypto all)
+	(cd ..; $(MAKE) build_libcrypto)
 
 $(EXE): progs.h $(E_OBJ) $(PROGRAM).o $(DLIBCRYPTO) $(DLIBSSL)
 	$(RM) $(EXE)
diff --git a/test/Makefile b/test/Makefile
index 1b65d4e..a570fad 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -369,10 +369,10 @@ clean:
 	rm -f .rnd tmp.bntest tmp.bctest *.o *.obj *.dll lib tags core .pure .nfs* *.old *.bak fluff $(EXE) *.ss *.srl log dummytest
 
 $(DLIBSSL):
-	(cd ..; $(MAKE) DIRS=ssl all)
+	(cd ..; $(MAKE) build_libssl)
 
 $(DLIBCRYPTO):
-	(cd ..; $(MAKE) DIRS=crypto all)
+	(cd ..; $(MAKE) build_libcrypto)
 
 BUILD_CMD=shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \
 		shlib_target="$(SHLIB_TARGET)"; \

From matt at openssl.org  Wed Jun 10 09:06:39 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 09:06:39 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433927199.192994.29788.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  dcad51bc13c9b716d9a66248bcc4038c071ff158 (commit)
      from  80d586d97f4e8cd80d0f0c4152617250d261948d (commit)


- Log -----------------------------------------------------------------
commit dcad51bc13c9b716d9a66248bcc4038c071ff158
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 09:32:34 2015 +0100

    Fix Kerberos issue in ssl_session_dup
    
    The fix for CVE-2015-1791 introduced an error in ssl_session_dup for
    Kerberos.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index ca5d2d6..5358f4a 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -242,7 +242,7 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     memcpy(dest, src, sizeof(*dest));
 
 #ifndef OPENSSL_NO_KRB5
-    dest->krb5_client_princ_len = dest->krb5_client_princ_len;
+    dest->krb5_client_princ_len = src->krb5_client_princ_len;
     if (src->krb5_client_princ_len > 0)
         memcpy(dest->krb5_client_princ, src->krb5_client_princ,
                src->krb5_client_princ_len);

From matt at openssl.org  Wed Jun 10 09:07:03 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 09:07:03 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433927223.119833.30254.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  9545eac45bc79496763d2ded02629f88a8629fb9 (commit)
      from  228806a4f3c42cfb304b974a267a95f7a12cba87 (commit)


- Log -----------------------------------------------------------------
commit 9545eac45bc79496763d2ded02629f88a8629fb9
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 09:32:34 2015 +0100

    Fix Kerberos issue in ssl_session_dup
    
    The fix for CVE-2015-1791 introduced an error in ssl_session_dup for
    Kerberos.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit dcad51bc13c9b716d9a66248bcc4038c071ff158)

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 98b9107..1fb682a 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -239,7 +239,7 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     memcpy(dest, src, sizeof(*dest));
 
 #ifndef OPENSSL_NO_KRB5
-    dest->krb5_client_princ_len = dest->krb5_client_princ_len;
+    dest->krb5_client_princ_len = src->krb5_client_princ_len;
     if (src->krb5_client_princ_len > 0)
         memcpy(dest->krb5_client_princ, src->krb5_client_princ,
                src->krb5_client_princ_len);

From matt at openssl.org  Wed Jun 10 09:06:52 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 09:06:52 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433927212.529979.30018.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  106a9a5d7e26e728a654d7424849081bd988d4a5 (commit)
      from  cb972a4fe710c3e07300cdd3e3c3d41a42fc9672 (commit)


- Log -----------------------------------------------------------------
commit 106a9a5d7e26e728a654d7424849081bd988d4a5
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 09:32:34 2015 +0100

    Fix Kerberos issue in ssl_session_dup
    
    The fix for CVE-2015-1791 introduced an error in ssl_session_dup for
    Kerberos.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit dcad51bc13c9b716d9a66248bcc4038c071ff158)

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index e673f9c..8325cb3 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -242,7 +242,7 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     memcpy(dest, src, sizeof(*dest));
 
 #ifndef OPENSSL_NO_KRB5
-    dest->krb5_client_princ_len = dest->krb5_client_princ_len;
+    dest->krb5_client_princ_len = src->krb5_client_princ_len;
     if (src->krb5_client_princ_len > 0)
         memcpy(dest->krb5_client_princ, src->krb5_client_princ,
                src->krb5_client_princ_len);

From matt at openssl.org  Wed Jun 10 09:07:18 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 09:07:18 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1433927238.292687.30518.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  8b4fd12b0d1734d281994000752c771e8cd0a103 (commit)
      from  17689e7dc6eb006990c205083c5b07a202f50f7e (commit)


- Log -----------------------------------------------------------------
commit 8b4fd12b0d1734d281994000752c771e8cd0a103
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 09:32:34 2015 +0100

    Fix Kerberos issue in ssl_session_dup
    
    The fix for CVE-2015-1791 introduced an error in ssl_session_dup for
    Kerberos.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit dcad51bc13c9b716d9a66248bcc4038c071ff158)

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 9baa090..d3bac0b 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -150,7 +150,7 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     memcpy(dest, src, sizeof(*dest));
 
 #ifndef OPENSSL_NO_KRB5
-    dest->krb5_client_princ_len = dest->krb5_client_princ_len;
+    dest->krb5_client_princ_len = src->krb5_client_princ_len;
     if (src->krb5_client_princ_len > 0)
         memcpy(dest->krb5_client_princ, src->krb5_client_princ,
                src->krb5_client_princ_len);

From matt at openssl.org  Wed Jun 10 09:38:58 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 09:38:58 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433929138.494950.3020.nullmailer@dev.openssl.org>

The branch master has been updated
       via  54e3ad003bdf83f189b2bf17fb998c028d39c8eb (commit)
       via  aec54108ef0d469964505ac1f77984f19099ec05 (commit)
       via  5d80fab086fe8849222613e20d7cf61839f94f5f (commit)
      from  e36c5fc4f547ce62280e5a704d1f94189742ec65 (commit)


- Log -----------------------------------------------------------------
commit 54e3ad003bdf83f189b2bf17fb998c028d39c8eb
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 15:20:25 2015 +0100

    Tighten extension handling
    
    This adds additional checks to the processing of extensions in a ClientHello
    to ensure that either no extensions are present, or if they are then they
    take up the exact amount of space expected.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit aec54108ef0d469964505ac1f77984f19099ec05
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 14:51:10 2015 +0100

    Fix memory leaks in BIO_dup_chain()
    
    This fixes a memory leak that can occur whilst duplicating a BIO chain if
    the call to CRYPTO_dup_ex_data() fails. It also fixes a second memory leak
    where if a failure occurs after successfully creating the first BIO in the
    chain, then the beginning of the new chain was not freed.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit 5d80fab086fe8849222613e20d7cf61839f94f5f
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 14:04:30 2015 +0100

    Replace memset with OPENSSL_clear_free()
    
    BUF_MEM_free() attempts to cleanse memory using memset immediately prior
    to a free. This is at risk of being optimised away by the compiler, so
    replace with a call to OPENSSL_clear_free() instead.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bio_lib.c   |   7 ++-
 crypto/buffer/buffer.c |   3 +-
 ssl/t1_lib.c           | 158 ++++++++++++++++++++-----------------------------
 3 files changed, 70 insertions(+), 98 deletions(-)

diff --git a/crypto/bio/bio_lib.c b/crypto/bio/bio_lib.c
index 19cd069..cc859da 100644
--- a/crypto/bio/bio_lib.c
+++ b/crypto/bio/bio_lib.c
@@ -535,8 +535,10 @@ BIO *BIO_dup_chain(BIO *in)
 
         /* copy app data */
         if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_BIO, &new_bio->ex_data,
-                                &bio->ex_data))
+                                &bio->ex_data)) {
+            BIO_free(new_bio);
             goto err;
+        }
 
         if (ret == NULL) {
             eoc = new_bio;
@@ -548,7 +550,8 @@ BIO *BIO_dup_chain(BIO *in)
     }
     return (ret);
  err:
-    BIO_free(ret);
+    BIO_free_all(ret);
+
     return (NULL);
 }
 
diff --git a/crypto/buffer/buffer.c b/crypto/buffer/buffer.c
index 37e5484..2beacce 100644
--- a/crypto/buffer/buffer.c
+++ b/crypto/buffer/buffer.c
@@ -88,8 +88,7 @@ void BUF_MEM_free(BUF_MEM *a)
         return;
 
     if (a->data != NULL) {
-        memset(a->data, 0, (unsigned int)a->max);
-        OPENSSL_free(a->data);
+        OPENSSL_clear_free(a->data, a->max);
     }
     OPENSSL_free(a);
 }
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 0420fe3..f0565a2 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1940,19 +1940,23 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
 
     s->srtp_profile = NULL;
 
-    if (data >= (d + n - 2))
-        goto ri_check;
+    if (data >= (d + n - 2)) {
+        if (data != d + n)
+            goto err;
+        else
+            goto ri_check;
+    }
     n2s(data, len);
 
     if (data > (d + n - len))
-        goto ri_check;
+        goto err;
 
     while (data <= (d + n - 4)) {
         n2s(data, type);
         n2s(data, size);
 
         if (data + size > (d + n))
-            goto ri_check;
+            goto err;
         if (s->tlsext_debug_cb)
             s->tlsext_debug_cb(s, 0, type, data, size, s->tlsext_debug_arg);
         if (type == TLSEXT_TYPE_renegotiate) {
@@ -1991,16 +1995,12 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
             int servname_type;
             int dsize;
 
-            if (size < 2) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size < 2)
+                goto err;
             n2s(data, dsize);
             size -= 2;
-            if (dsize > size) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize > size)
+                goto err;
 
             sdata = data;
             while (dsize > 3) {
@@ -2008,18 +2008,16 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
                 n2s(sdata, len);
                 dsize -= 3;
 
-                if (len > dsize) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (len > dsize)
+                    goto err;
+
                 if (s->servername_done == 0)
                     switch (servname_type) {
                     case TLSEXT_NAMETYPE_host_name:
                         if (!s->hit) {
-                            if (s->session->tlsext_hostname) {
-                                *al = SSL_AD_DECODE_ERROR;
-                                return 0;
-                            }
+                            if (s->session->tlsext_hostname)
+                                goto err;
+
                             if (len > TLSEXT_MAXLEN_host_name) {
                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
                                 return 0;
@@ -2053,31 +2051,23 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
 
                 dsize -= len;
             }
-            if (dsize != 0) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize != 0)
+                goto err;
 
         }
 #ifndef OPENSSL_NO_SRP
         else if (type == TLSEXT_TYPE_srp) {
-            if (size == 0 || ((len = data[0])) != (size - 1)) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
-            if (s->srp_ctx.login != NULL) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size == 0 || ((len = data[0])) != (size - 1))
+                goto err;
+            if (s->srp_ctx.login != NULL)
+                goto err;
             if ((s->srp_ctx.login = OPENSSL_malloc(len + 1)) == NULL)
                 return -1;
             memcpy(s->srp_ctx.login, &data[1], len);
             s->srp_ctx.login[len] = '\0';
 
-            if (strlen(s->srp_ctx.login) != len) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (strlen(s->srp_ctx.login) != len)
+                goto err;
         }
 #endif
 
@@ -2087,10 +2077,8 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
             int ecpointformatlist_length = *(sdata++);
 
             if (ecpointformatlist_length != size - 1 ||
-                ecpointformatlist_length < 1) {
-                *al = TLS1_AD_DECODE_ERROR;
-                return 0;
-            }
+                ecpointformatlist_length < 1)
+                goto err;
             if (!s->hit) {
                 OPENSSL_free(s->session->tlsext_ecpointformatlist);
                 s->session->tlsext_ecpointformatlist = NULL;
@@ -2113,15 +2101,13 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
             if (ellipticcurvelist_length != size - 2 ||
                 ellipticcurvelist_length < 1 ||
                 /* Each NamedCurve is 2 bytes. */
-                ellipticcurvelist_length & 1) {
-                *al = TLS1_AD_DECODE_ERROR;
-                return 0;
-            }
+                ellipticcurvelist_length & 1)
+                    goto err;
+
             if (!s->hit) {
-                if (s->session->tlsext_ellipticcurvelist) {
-                    *al = TLS1_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (s->session->tlsext_ellipticcurvelist)
+                    goto err;
+
                 s->session->tlsext_ellipticcurvelist_length = 0;
                 if ((s->session->tlsext_ellipticcurvelist =
                      OPENSSL_malloc(ellipticcurvelist_length)) == NULL) {
@@ -2145,26 +2131,18 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
             }
         } else if (type == TLSEXT_TYPE_signature_algorithms) {
             int dsize;
-            if (s->s3->tmp.peer_sigalgs || size < 2) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (s->s3->tmp.peer_sigalgs || size < 2)
+                goto err;
             n2s(data, dsize);
             size -= 2;
-            if (dsize != size || dsize & 1 || !dsize) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
-            if (!tls1_save_sigalgs(s, data, dsize)) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize != size || dsize & 1 || !dsize)
+                goto err;
+            if (!tls1_save_sigalgs(s, data, dsize))
+                goto err;
         } else if (type == TLSEXT_TYPE_status_request) {
 
-            if (size < 5) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size < 5)
+                goto err;
 
             s->tlsext_status_type = *data++;
             size--;
@@ -2174,35 +2152,26 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
                 /* Read in responder_id_list */
                 n2s(data, dsize);
                 size -= 2;
-                if (dsize > size) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (dsize > size)
+                    goto err;
                 while (dsize > 0) {
                     OCSP_RESPID *id;
                     int idsize;
-                    if (dsize < 4) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (dsize < 4)
+                        goto err;
                     n2s(data, idsize);
                     dsize -= 2 + idsize;
                     size -= 2 + idsize;
-                    if (dsize < 0) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (dsize < 0)
+                        goto err;
                     sdata = data;
                     data += idsize;
                     id = d2i_OCSP_RESPID(NULL, &sdata, idsize);
-                    if (!id) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (!id)
+                        goto err;
                     if (data != sdata) {
                         OCSP_RESPID_free(id);
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
+                        goto err;
                     }
                     if (!s->tlsext_ocsp_ids
                         && !(s->tlsext_ocsp_ids =
@@ -2219,26 +2188,20 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
                 }
 
                 /* Read in request_extensions */
-                if (size < 2) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (size < 2)
+                    goto err;
                 n2s(data, dsize);
                 size -= 2;
-                if (dsize != size) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (dsize != size)
+                    goto err;
                 sdata = data;
                 if (dsize > 0) {
                     sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
                                                X509_EXTENSION_free);
                     s->tlsext_ocsp_exts =
                         d2i_X509_EXTENSIONS(NULL, &sdata, dsize);
-                    if (!s->tlsext_ocsp_exts || (data + dsize != sdata)) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (!s->tlsext_ocsp_exts || (data + dsize != sdata))
+                        goto err;
                 }
             }
             /*
@@ -2329,6 +2292,10 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
         data += size;
     }
 
+    /* Spurious data on the end */
+    if (data != d + n)
+        goto err;
+
     *p = data;
 
  ri_check:
@@ -2344,6 +2311,9 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
     }
 
     return 1;
+err:
+    *al = SSL_AD_DECODE_ERROR;
+    return 0;
 }
 
 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,

From matt at openssl.org  Wed Jun 10 09:39:20 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 09:39:20 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433929160.760466.4082.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  72df35acf268e21adfe5b90b89f90e35e9db29bf (commit)
       via  f92b1967234fd7926b476768584fa5573eaadd72 (commit)
       via  e94118ae2a6aff6427ade82e843d683d4913bcec (commit)
      from  106a9a5d7e26e728a654d7424849081bd988d4a5 (commit)


- Log -----------------------------------------------------------------
commit 72df35acf268e21adfe5b90b89f90e35e9db29bf
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 15:20:25 2015 +0100

    Tighten extension handling
    
    This adds additional checks to the processing of extensions in a ClientHello
    to ensure that either no extensions are present, or if they are then they
    take up the exact amount of space expected.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>
    
    Conflicts:
    	ssl/t1_lib.c

commit f92b1967234fd7926b476768584fa5573eaadd72
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 14:51:10 2015 +0100

    Fix memory leaks in BIO_dup_chain()
    
    This fixes a memory leak that can occur whilst duplicating a BIO chain if
    the call to CRYPTO_dup_ex_data() fails. It also fixes a second memory leak
    where if a failure occurs after successfully creating the first BIO in the
    chain, then the beginning of the new chain was not freed.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>
    
    Conflicts:
    	crypto/bio/bio_lib.c

commit e94118ae2a6aff6427ade82e843d683d4913bcec
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 14:04:30 2015 +0100

    Replace memset with OPENSSL_cleanse()
    
    BUF_MEM_free() attempts to cleanse memory using memset immediately prior
    to a free. This is at risk of being optimised away by the compiler, so
    replace with a call to OPENSSL_cleanse() instead.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bio_lib.c   |   8 ++-
 crypto/buffer/buffer.c |   2 +-
 ssl/t1_lib.c           | 158 ++++++++++++++++++++-----------------------------
 3 files changed, 70 insertions(+), 98 deletions(-)

diff --git a/crypto/bio/bio_lib.c b/crypto/bio/bio_lib.c
index 5267010..07934f8 100644
--- a/crypto/bio/bio_lib.c
+++ b/crypto/bio/bio_lib.c
@@ -536,8 +536,10 @@ BIO *BIO_dup_chain(BIO *in)
 
         /* copy app data */
         if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_BIO, &new_bio->ex_data,
-                                &bio->ex_data))
+                                &bio->ex_data)) {
+            BIO_free(new_bio);
             goto err;
+        }
 
         if (ret == NULL) {
             eoc = new_bio;
@@ -549,8 +551,8 @@ BIO *BIO_dup_chain(BIO *in)
     }
     return (ret);
  err:
-    if (ret != NULL)
-        BIO_free(ret);
+    BIO_free_all(ret);
+
     return (NULL);
 }
 
diff --git a/crypto/buffer/buffer.c b/crypto/buffer/buffer.c
index d287e34..eff3e08 100644
--- a/crypto/buffer/buffer.c
+++ b/crypto/buffer/buffer.c
@@ -88,7 +88,7 @@ void BUF_MEM_free(BUF_MEM *a)
         return;
 
     if (a->data != NULL) {
-        memset(a->data, 0, (unsigned int)a->max);
+        OPENSSL_cleanse(a->data, a->max);
         OPENSSL_free(a->data);
     }
     OPENSSL_free(a);
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 36ea9b0..c2d7d72 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1016,19 +1016,23 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 
     s->srtp_profile = NULL;
 
-    if (data >= (d + n - 2))
-        goto ri_check;
+    if (data >= (d + n - 2)) {
+        if (data != d + n)
+            goto err;
+        else
+            goto ri_check;
+    }
     n2s(data, len);
 
     if (data > (d + n - len))
-        goto ri_check;
+        goto err;
 
     while (data <= (d + n - 4)) {
         n2s(data, type);
         n2s(data, size);
 
         if (data + size > (d + n))
-            goto ri_check;
+            goto err;
 # if 0
         fprintf(stderr, "Received extension type %d size %d\n", type, size);
 # endif
@@ -1064,16 +1068,12 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
             int servname_type;
             int dsize;
 
-            if (size < 2) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size < 2)
+                goto err;
             n2s(data, dsize);
             size -= 2;
-            if (dsize > size) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize > size)
+                goto err;
 
             sdata = data;
             while (dsize > 3) {
@@ -1081,18 +1081,16 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                 n2s(sdata, len);
                 dsize -= 3;
 
-                if (len > dsize) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (len > dsize)
+                    goto err;
+
                 if (s->servername_done == 0)
                     switch (servname_type) {
                     case TLSEXT_NAMETYPE_host_name:
                         if (!s->hit) {
-                            if (s->session->tlsext_hostname) {
-                                *al = SSL_AD_DECODE_ERROR;
-                                return 0;
-                            }
+                            if (s->session->tlsext_hostname)
+                                goto err;
+
                             if (len > TLSEXT_MAXLEN_host_name) {
                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
                                 return 0;
@@ -1126,31 +1124,23 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 
                 dsize -= len;
             }
-            if (dsize != 0) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize != 0)
+                goto err;
 
         }
 # ifndef OPENSSL_NO_SRP
         else if (type == TLSEXT_TYPE_srp) {
-            if (size == 0 || ((len = data[0])) != (size - 1)) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
-            if (s->srp_ctx.login != NULL) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size == 0 || ((len = data[0])) != (size - 1))
+                goto err;
+            if (s->srp_ctx.login != NULL)
+                goto err;
             if ((s->srp_ctx.login = OPENSSL_malloc(len + 1)) == NULL)
                 return -1;
             memcpy(s->srp_ctx.login, &data[1], len);
             s->srp_ctx.login[len] = '\0';
 
-            if (strlen(s->srp_ctx.login) != len) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (strlen(s->srp_ctx.login) != len)
+                goto err;
         }
 # endif
 
@@ -1159,10 +1149,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
             unsigned char *sdata = data;
             int ecpointformatlist_length = *(sdata++);
 
-            if (ecpointformatlist_length != size - 1) {
-                *al = TLS1_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (ecpointformatlist_length != size - 1)
+                goto err;
             if (!s->hit) {
                 if (s->session->tlsext_ecpointformatlist) {
                     OPENSSL_free(s->session->tlsext_ecpointformatlist);
@@ -1196,15 +1184,13 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
             if (ellipticcurvelist_length != size - 2 ||
                 ellipticcurvelist_length < 1 ||
                 /* Each NamedCurve is 2 bytes. */
-                ellipticcurvelist_length & 1) {
-                *al = TLS1_AD_DECODE_ERROR;
-                return 0;
-            }
+                ellipticcurvelist_length & 1)
+                    goto err;
+
             if (!s->hit) {
-                if (s->session->tlsext_ellipticcurvelist) {
-                    *al = TLS1_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (s->session->tlsext_ellipticcurvelist)
+                    goto err;
+
                 s->session->tlsext_ellipticcurvelist_length = 0;
                 if ((s->session->tlsext_ellipticcurvelist =
                      OPENSSL_malloc(ellipticcurvelist_length)) == NULL) {
@@ -1273,28 +1259,20 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
             renegotiate_seen = 1;
         } else if (type == TLSEXT_TYPE_signature_algorithms) {
             int dsize;
-            if (sigalg_seen || size < 2) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (sigalg_seen || size < 2)
+                goto err;
             sigalg_seen = 1;
             n2s(data, dsize);
             size -= 2;
-            if (dsize != size || dsize & 1) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
-            if (!tls1_process_sigalgs(s, data, dsize)) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize != size || dsize & 1)
+                goto err;
+            if (!tls1_process_sigalgs(s, data, dsize))
+                goto err;
         } else if (type == TLSEXT_TYPE_status_request &&
                    s->version != DTLS1_VERSION) {
 
-            if (size < 5) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size < 5)
+                goto err;
 
             s->tlsext_status_type = *data++;
             size--;
@@ -1304,35 +1282,26 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                 /* Read in responder_id_list */
                 n2s(data, dsize);
                 size -= 2;
-                if (dsize > size) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (dsize > size)
+                    goto err;
                 while (dsize > 0) {
                     OCSP_RESPID *id;
                     int idsize;
-                    if (dsize < 4) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (dsize < 4)
+                        goto err;
                     n2s(data, idsize);
                     dsize -= 2 + idsize;
                     size -= 2 + idsize;
-                    if (dsize < 0) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (dsize < 0)
+                        goto err;
                     sdata = data;
                     data += idsize;
                     id = d2i_OCSP_RESPID(NULL, &sdata, idsize);
-                    if (!id) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (!id)
+                        goto err;
                     if (data != sdata) {
                         OCSP_RESPID_free(id);
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
+                        goto err;
                     }
                     if (!s->tlsext_ocsp_ids
                         && !(s->tlsext_ocsp_ids =
@@ -1349,16 +1318,12 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                 }
 
                 /* Read in request_extensions */
-                if (size < 2) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (size < 2)
+                    goto err;
                 n2s(data, dsize);
                 size -= 2;
-                if (dsize != size) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (dsize != size)
+                    goto err;
                 sdata = data;
                 if (dsize > 0) {
                     if (s->tlsext_ocsp_exts) {
@@ -1368,10 +1333,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 
                     s->tlsext_ocsp_exts =
                         d2i_X509_EXTENSIONS(NULL, &sdata, dsize);
-                    if (!s->tlsext_ocsp_exts || (data + dsize != sdata)) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (!s->tlsext_ocsp_exts || (data + dsize != sdata))
+                        goto err;
                 }
             }
             /*
@@ -1432,6 +1395,10 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
         data += size;
     }
 
+    /* Spurious data on the end */
+    if (data != d + n)
+        goto err;
+
     *p = data;
 
  ri_check:
@@ -1447,6 +1414,9 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
     }
 
     return 1;
+err:
+    *al = SSL_AD_DECODE_ERROR;
+    return 0;
 }
 
 # ifndef OPENSSL_NO_NEXTPROTONEG

From matt at openssl.org  Wed Jun 10 09:39:08 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 09:39:08 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433929148.628933.3764.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  d272599277092d6cd054417cf671453ca5fd0d9b (commit)
       via  b3c02473f7a22b19cbf86d5012d05a9d6a2c5f4d (commit)
       via  23cd01ef61ff9110850ee75c42ccb365ddc8a6ab (commit)
      from  dcad51bc13c9b716d9a66248bcc4038c071ff158 (commit)


- Log -----------------------------------------------------------------
commit d272599277092d6cd054417cf671453ca5fd0d9b
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 15:20:25 2015 +0100

    Tighten extension handling
    
    This adds additional checks to the processing of extensions in a ClientHello
    to ensure that either no extensions are present, or if they are then they
    take up the exact amount of space expected.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>
    
    Conflicts:
    	ssl/t1_lib.c

commit b3c02473f7a22b19cbf86d5012d05a9d6a2c5f4d
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 14:51:10 2015 +0100

    Fix memory leaks in BIO_dup_chain()
    
    This fixes a memory leak that can occur whilst duplicating a BIO chain if
    the call to CRYPTO_dup_ex_data() fails. It also fixes a second memory leak
    where if a failure occurs after successfully creating the first BIO in the
    chain, then the beginning of the new chain was not freed.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>
    
    Conflicts:
    	crypto/bio/bio_lib.c

commit 23cd01ef61ff9110850ee75c42ccb365ddc8a6ab
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Apr 30 14:04:30 2015 +0100

    Replace memset with OPENSSL_cleanse()
    
    BUF_MEM_free() attempts to cleanse memory using memset immediately prior
    to a free. This is at risk of being optimised away by the compiler, so
    replace with a call to OPENSSL_cleanse() instead.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bio_lib.c   |   8 ++-
 crypto/buffer/buffer.c |   2 +-
 ssl/t1_lib.c           | 158 ++++++++++++++++++++-----------------------------
 3 files changed, 70 insertions(+), 98 deletions(-)

diff --git a/crypto/bio/bio_lib.c b/crypto/bio/bio_lib.c
index 5267010..07934f8 100644
--- a/crypto/bio/bio_lib.c
+++ b/crypto/bio/bio_lib.c
@@ -536,8 +536,10 @@ BIO *BIO_dup_chain(BIO *in)
 
         /* copy app data */
         if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_BIO, &new_bio->ex_data,
-                                &bio->ex_data))
+                                &bio->ex_data)) {
+            BIO_free(new_bio);
             goto err;
+        }
 
         if (ret == NULL) {
             eoc = new_bio;
@@ -549,8 +551,8 @@ BIO *BIO_dup_chain(BIO *in)
     }
     return (ret);
  err:
-    if (ret != NULL)
-        BIO_free(ret);
+    BIO_free_all(ret);
+
     return (NULL);
 }
 
diff --git a/crypto/buffer/buffer.c b/crypto/buffer/buffer.c
index d287e34..eff3e08 100644
--- a/crypto/buffer/buffer.c
+++ b/crypto/buffer/buffer.c
@@ -88,7 +88,7 @@ void BUF_MEM_free(BUF_MEM *a)
         return;
 
     if (a->data != NULL) {
-        memset(a->data, 0, (unsigned int)a->max);
+        OPENSSL_cleanse(a->data, a->max);
         OPENSSL_free(a->data);
     }
     OPENSSL_free(a);
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index a398501..d811d3f 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -2016,19 +2016,23 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
 
     s->srtp_profile = NULL;
 
-    if (data >= (d + n - 2))
-        goto ri_check;
+    if (data >= (d + n - 2)) {
+        if (data != d + n)
+            goto err;
+        else
+            goto ri_check;
+    }
     n2s(data, len);
 
     if (data > (d + n - len))
-        goto ri_check;
+        goto err;
 
     while (data <= (d + n - 4)) {
         n2s(data, type);
         n2s(data, size);
 
         if (data + size > (d + n))
-            goto ri_check;
+            goto err;
 # if 0
         fprintf(stderr, "Received extension type %d size %d\n", type, size);
 # endif
@@ -2064,16 +2068,12 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
             int servname_type;
             int dsize;
 
-            if (size < 2) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size < 2)
+                goto err;
             n2s(data, dsize);
             size -= 2;
-            if (dsize > size) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize > size)
+                goto err;
 
             sdata = data;
             while (dsize > 3) {
@@ -2081,18 +2081,16 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
                 n2s(sdata, len);
                 dsize -= 3;
 
-                if (len > dsize) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (len > dsize)
+                    goto err;
+
                 if (s->servername_done == 0)
                     switch (servname_type) {
                     case TLSEXT_NAMETYPE_host_name:
                         if (!s->hit) {
-                            if (s->session->tlsext_hostname) {
-                                *al = SSL_AD_DECODE_ERROR;
-                                return 0;
-                            }
+                            if (s->session->tlsext_hostname)
+                                goto err;
+
                             if (len > TLSEXT_MAXLEN_host_name) {
                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
                                 return 0;
@@ -2126,31 +2124,23 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
 
                 dsize -= len;
             }
-            if (dsize != 0) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize != 0)
+                goto err;
 
         }
 # ifndef OPENSSL_NO_SRP
         else if (type == TLSEXT_TYPE_srp) {
-            if (size == 0 || ((len = data[0])) != (size - 1)) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
-            if (s->srp_ctx.login != NULL) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size == 0 || ((len = data[0])) != (size - 1))
+                goto err;
+            if (s->srp_ctx.login != NULL)
+                goto err;
             if ((s->srp_ctx.login = OPENSSL_malloc(len + 1)) == NULL)
                 return -1;
             memcpy(s->srp_ctx.login, &data[1], len);
             s->srp_ctx.login[len] = '\0';
 
-            if (strlen(s->srp_ctx.login) != len) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (strlen(s->srp_ctx.login) != len)
+                goto err;
         }
 # endif
 
@@ -2160,10 +2150,8 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
             int ecpointformatlist_length = *(sdata++);
 
             if (ecpointformatlist_length != size - 1 ||
-                ecpointformatlist_length < 1) {
-                *al = TLS1_AD_DECODE_ERROR;
-                return 0;
-            }
+                ecpointformatlist_length < 1)
+                goto err;
             if (!s->hit) {
                 if (s->session->tlsext_ecpointformatlist) {
                     OPENSSL_free(s->session->tlsext_ecpointformatlist);
@@ -2197,15 +2185,13 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
             if (ellipticcurvelist_length != size - 2 ||
                 ellipticcurvelist_length < 1 ||
                 /* Each NamedCurve is 2 bytes. */
-                ellipticcurvelist_length & 1) {
-                *al = TLS1_AD_DECODE_ERROR;
-                return 0;
-            }
+                ellipticcurvelist_length & 1)
+                    goto err;
+
             if (!s->hit) {
-                if (s->session->tlsext_ellipticcurvelist) {
-                    *al = TLS1_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (s->session->tlsext_ellipticcurvelist)
+                    goto err;
+
                 s->session->tlsext_ellipticcurvelist_length = 0;
                 if ((s->session->tlsext_ellipticcurvelist =
                      OPENSSL_malloc(ellipticcurvelist_length)) == NULL) {
@@ -2273,26 +2259,18 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
             renegotiate_seen = 1;
         } else if (type == TLSEXT_TYPE_signature_algorithms) {
             int dsize;
-            if (s->cert->peer_sigalgs || size < 2) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (s->cert->peer_sigalgs || size < 2)
+                goto err;
             n2s(data, dsize);
             size -= 2;
-            if (dsize != size || dsize & 1 || !dsize) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
-            if (!tls1_save_sigalgs(s, data, dsize)) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (dsize != size || dsize & 1 || !dsize)
+                goto err;
+            if (!tls1_save_sigalgs(s, data, dsize))
+                goto err;
         } else if (type == TLSEXT_TYPE_status_request) {
 
-            if (size < 5) {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-            }
+            if (size < 5)
+                goto err;
 
             s->tlsext_status_type = *data++;
             size--;
@@ -2302,35 +2280,26 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
                 /* Read in responder_id_list */
                 n2s(data, dsize);
                 size -= 2;
-                if (dsize > size) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (dsize > size)
+                    goto err;
                 while (dsize > 0) {
                     OCSP_RESPID *id;
                     int idsize;
-                    if (dsize < 4) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (dsize < 4)
+                        goto err;
                     n2s(data, idsize);
                     dsize -= 2 + idsize;
                     size -= 2 + idsize;
-                    if (dsize < 0) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (dsize < 0)
+                        goto err;
                     sdata = data;
                     data += idsize;
                     id = d2i_OCSP_RESPID(NULL, &sdata, idsize);
-                    if (!id) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (!id)
+                        goto err;
                     if (data != sdata) {
                         OCSP_RESPID_free(id);
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
+                        goto err;
                     }
                     if (!s->tlsext_ocsp_ids
                         && !(s->tlsext_ocsp_ids =
@@ -2347,16 +2316,12 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
                 }
 
                 /* Read in request_extensions */
-                if (size < 2) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (size < 2)
+                    goto err;
                 n2s(data, dsize);
                 size -= 2;
-                if (dsize != size) {
-                    *al = SSL_AD_DECODE_ERROR;
-                    return 0;
-                }
+                if (dsize != size)
+                    goto err;
                 sdata = data;
                 if (dsize > 0) {
                     if (s->tlsext_ocsp_exts) {
@@ -2366,10 +2331,8 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
 
                     s->tlsext_ocsp_exts =
                         d2i_X509_EXTENSIONS(NULL, &sdata, dsize);
-                    if (!s->tlsext_ocsp_exts || (data + dsize != sdata)) {
-                        *al = SSL_AD_DECODE_ERROR;
-                        return 0;
-                    }
+                    if (!s->tlsext_ocsp_exts || (data + dsize != sdata))
+                        goto err;
                 }
             }
             /*
@@ -2441,6 +2404,10 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
         data += size;
     }
 
+    /* Spurious data on the end */
+    if (data != d + n)
+        goto err;
+
     *p = data;
 
  ri_check:
@@ -2456,6 +2423,9 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
     }
 
     return 1;
+err:
+    *al = SSL_AD_DECODE_ERROR;
+    return 0;
 }
 
 /*

From matt at openssl.org  Wed Jun 10 09:43:09 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 09:43:09 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433929389.848568.5451.nullmailer@dev.openssl.org>

The branch master has been updated
       via  b8b12aadd8edfd3bd327157c8899b1cf3403177f (commit)
      from  54e3ad003bdf83f189b2bf17fb998c028d39c8eb (commit)


- Log -----------------------------------------------------------------
commit b8b12aadd8edfd3bd327157c8899b1cf3403177f
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 10:35:08 2015 +0100

    Change BIO_number_read and BIO_number_written() to be 64 bit
    
    The return type of BIO_number_read() and BIO_number_written() as well as
    the corresponding num_read and num_write members in the BIO structure has
    been changed from unsigned long to uint64_t. On platforms where an unsigned
    long is 32 bits (e.g. Windows) these counters could overflow if >4Gb is
    transferred.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                   |  7 +++++++
 crypto/bio/bio_lib.c      | 10 +++++-----
 demos/easy_tls/easy-tls.c |  2 +-
 include/openssl/bio.h     |  8 ++++----
 4 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index 3b0d0b5..e1b3392 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,13 @@
  _______________
 
  Changes between 1.0.2 and 1.1.0  [xx XXX xxxx]
+  *) The return type of BIO_number_read() and BIO_number_written() as well as
+     the corresponding num_read and num_write members in the BIO structure has
+     changed from unsigned long to uint64_t. On platforms where an unsigned
+     long is 32 bits (e.g. Windows) these counters could overflow if >4Gb is
+     transferred.
+     [Matt Caswell]
+
   *) Given the pervasive nature of TLS extensions it is inadvisable to run
      OpenSSL without support for them. It also means that maintaining
      the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably
diff --git a/crypto/bio/bio_lib.c b/crypto/bio/bio_lib.c
index cc859da..6ab471c 100644
--- a/crypto/bio/bio_lib.c
+++ b/crypto/bio/bio_lib.c
@@ -209,7 +209,7 @@ int BIO_read(BIO *b, void *out, int outl)
     i = b->method->bread(b, out, outl);
 
     if (i > 0)
-        b->num_read += (unsigned long)i;
+        b->num_read += (uint64_t)i;
 
     if (cb != NULL)
         i = (int)cb(b, BIO_CB_READ | BIO_CB_RETURN, out, outl, 0L, (long)i);
@@ -242,7 +242,7 @@ int BIO_write(BIO *b, const void *in, int inl)
     i = b->method->bwrite(b, in, inl);
 
     if (i > 0)
-        b->num_write += (unsigned long)i;
+        b->num_write += (uint64_t)i;
 
     if (cb != NULL)
         i = (int)cb(b, BIO_CB_WRITE | BIO_CB_RETURN, in, inl, 0L, (long)i);
@@ -272,7 +272,7 @@ int BIO_puts(BIO *b, const char *in)
     i = b->method->bputs(b, in);
 
     if (i > 0)
-        b->num_write += (unsigned long)i;
+        b->num_write += (uint64_t)i;
 
     if (cb != NULL)
         i = (int)cb(b, BIO_CB_PUTS | BIO_CB_RETURN, in, 0, 0L, (long)i);
@@ -578,14 +578,14 @@ void *BIO_get_ex_data(BIO *bio, int idx)
     return (CRYPTO_get_ex_data(&(bio->ex_data), idx));
 }
 
-unsigned long BIO_number_read(BIO *bio)
+uint64_t BIO_number_read(BIO *bio)
 {
     if (bio)
         return bio->num_read;
     return 0;
 }
 
-unsigned long BIO_number_written(BIO *bio)
+uint64_t BIO_number_written(BIO *bio)
 {
     if (bio)
         return bio->num_write;
diff --git a/demos/easy_tls/easy-tls.c b/demos/easy_tls/easy-tls.c
index b951290..5b65780 100644
--- a/demos/easy_tls/easy-tls.c
+++ b/demos/easy_tls/easy-tls.c
@@ -1020,7 +1020,7 @@ tls_proxy(int clear_fd, int tls_fd, int info_fd, SSL_CTX *ctx, int client_p)
         int clear_read_select = 0, clear_write_select = 0,
             tls_read_select = 0, tls_write_select = 0, progress = 0;
         int r;
-        unsigned long num_read = BIO_number_read(rbio),
+        uint64_t num_read = BIO_number_read(rbio),
             num_written = BIO_number_written(wbio);
 
         DEBUG_MSG2("loop iteration", ++tls_loop_count);
diff --git a/include/openssl/bio.h b/include/openssl/bio.h
index ab37c87..e224dd9 100644
--- a/include/openssl/bio.h
+++ b/include/openssl/bio.h
@@ -321,8 +321,8 @@ struct bio_st {
     struct bio_st *next_bio;    /* used by filter BIOs */
     struct bio_st *prev_bio;    /* used by filter BIOs */
     int references;
-    unsigned long num_read;
-    unsigned long num_write;
+    uint64_t num_read;
+    uint64_t num_write;
     CRYPTO_EX_DATA ex_data;
 };
 
@@ -618,8 +618,8 @@ int BIO_set_ex_data(BIO *bio, int idx, void *data);
 void *BIO_get_ex_data(BIO *bio, int idx);
 int BIO_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
                          CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
-unsigned long BIO_number_read(BIO *bio);
-unsigned long BIO_number_written(BIO *bio);
+uint64_t BIO_number_read(BIO *bio);
+uint64_t BIO_number_written(BIO *bio);
 
 /* For BIO_f_asn1() */
 int BIO_asn1_set_prefix(BIO *b, asn1_ps_func *prefix,

From matt at openssl.org  Wed Jun 10 10:01:03 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 10:01:03 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433930463.537707.16643.nullmailer@dev.openssl.org>

The branch master has been updated
       via  68886be7e2cd395a759fcd41d2cede461b68843d (commit)
      from  b8b12aadd8edfd3bd327157c8899b1cf3403177f (commit)


- Log -----------------------------------------------------------------
commit 68886be7e2cd395a759fcd41d2cede461b68843d
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 14:22:00 2015 +0100

    EC_POINT_is_on_curve does not return a boolean
    
    The function EC_POINT_is_on_curve does not return a boolean value.
    It returns 1 if the point is on the curve, 0 if it is not, and -1
    on error. Many usages within OpenSSL were incorrectly using this
    function and therefore not correctly handling error conditions.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/ec/ec2_oct.c  |  2 +-
 crypto/ec/ec_check.c |  2 +-
 crypto/ec/ec_key.c   |  2 +-
 crypto/ec/ec_lib.c   |  7 +++++++
 crypto/ec/ecp_oct.c  |  2 +-
 test/ectest.c        | 24 ++++++++++++------------
 6 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/crypto/ec/ec2_oct.c b/crypto/ec/ec2_oct.c
index 821c371..33f703b 100644
--- a/crypto/ec/ec2_oct.c
+++ b/crypto/ec/ec2_oct.c
@@ -384,7 +384,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_check.c b/crypto/ec/ec_check.c
index 1d44ad2..bdbf91c 100644
--- a/crypto/ec/ec_check.c
+++ b/crypto/ec/ec_check.c
@@ -85,7 +85,7 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_GENERATOR);
         goto err;
     }
-    if (!EC_POINT_is_on_curve(group, group->generator, ctx)) {
+    if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index 07c33fe..620860c 100644
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -296,7 +296,7 @@ int EC_KEY_check_key(const EC_KEY *eckey)
         goto err;
 
     /* testing whether the pub_key is on the elliptic curve */
-    if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx)) {
+    if (EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx) <= 0) {
         ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c
index 9156943..3ddaa5d 100644
--- a/crypto/ec/ec_lib.c
+++ b/crypto/ec/ec_lib.c
@@ -949,6 +949,13 @@ int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
     return group->meth->is_at_infinity(group, point);
 }
 
+/*
+ * Check whether an EC_POINT is on the curve or not. Note that the return
+ * value for this function should NOT be treated as a boolean. Return values:
+ *  1: The point is on the curve
+ *  0: The point is not on the curve
+ * -1: An error occurred
+ */
 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
                          BN_CTX *ctx)
 {
diff --git a/crypto/ec/ecp_oct.c b/crypto/ec/ecp_oct.c
index a68b559..8bb7aa3 100644
--- a/crypto/ec/ecp_oct.c
+++ b/crypto/ec/ecp_oct.c
@@ -410,7 +410,7 @@ int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/test/ectest.c b/test/ectest.c
index 977b8d9..c8893f9 100644
--- a/test/ectest.c
+++ b/test/ectest.c
@@ -319,7 +319,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
         if (!EC_POINT_get_affine_coordinates_GFp(group, Q, x, y, ctx))
             ABORT;
         fprintf(stderr, "Point is not on curve: x = 0x");
@@ -439,7 +439,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "0100000000000000000001F4C8F927AED3CA752257"))
         ABORT;
@@ -488,7 +488,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831"))
         ABORT;
@@ -541,7 +541,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn
         (&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D"))
@@ -600,7 +600,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E"
                    "84F3B9CAC2FC632551"))
@@ -656,7 +656,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"))
@@ -715,7 +715,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5"
@@ -759,7 +759,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */
@@ -877,7 +877,7 @@ static void prime_field_tests(void)
 #  define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!EC_POINT_set_compressed_coordinates_GF2m(group, P, x, _y_bit, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -895,7 +895,7 @@ static void prime_field_tests(void)
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!BN_hex2bn(&y, _y)) ABORT; \
         if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1024,7 +1024,7 @@ static void char2_field_tests(void)
     if (!EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx))
         ABORT;
 #  endif
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
 /* Change test based on whether binary point compression is enabled or not. */
 #  ifdef OPENSSL_EC_BIN_PT_COMP
         if (!EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y, ctx))
@@ -1245,7 +1245,7 @@ static void char2_field_tests(void)
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */

From matt at openssl.org  Wed Jun 10 10:01:15 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 10:01:15 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433930475.862844.17354.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  7cb79c7afb043e80eb9a4f7ff36f5a7a80cdd8c9 (commit)
      from  d272599277092d6cd054417cf671453ca5fd0d9b (commit)


- Log -----------------------------------------------------------------
commit 7cb79c7afb043e80eb9a4f7ff36f5a7a80cdd8c9
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 14:22:00 2015 +0100

    EC_POINT_is_on_curve does not return a boolean
    
    The function EC_POINT_is_on_curve does not return a boolean value.
    It returns 1 if the point is on the curve, 0 if it is not, and -1
    on error. Many usages within OpenSSL were incorrectly using this
    function and therefore not correctly handling error conditions.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit 68886be7e2cd395a759fcd41d2cede461b68843d)

-----------------------------------------------------------------------

Summary of changes:
 crypto/ec/ec2_oct.c  |  2 +-
 crypto/ec/ec_check.c |  2 +-
 crypto/ec/ec_key.c   |  2 +-
 crypto/ec/ec_lib.c   |  7 +++++++
 crypto/ec/ecp_oct.c  |  2 +-
 crypto/ec/ectest.c   | 24 ++++++++++++------------
 6 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/crypto/ec/ec2_oct.c b/crypto/ec/ec2_oct.c
index c245d88..0d04cc6 100644
--- a/crypto/ec/ec2_oct.c
+++ b/crypto/ec/ec2_oct.c
@@ -387,7 +387,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_check.c b/crypto/ec/ec_check.c
index d3f5349..dd6f0ac 100644
--- a/crypto/ec/ec_check.c
+++ b/crypto/ec/ec_check.c
@@ -85,7 +85,7 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_GENERATOR);
         goto err;
     }
-    if (!EC_POINT_is_on_curve(group, group->generator, ctx)) {
+    if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index ebdffc8..55ce3fe 100644
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -314,7 +314,7 @@ int EC_KEY_check_key(const EC_KEY *eckey)
         goto err;
 
     /* testing whether the pub_key is on the elliptic curve */
-    if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx)) {
+    if (EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx) <= 0) {
         ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c
index 6ffd9fc..3ffa112 100644
--- a/crypto/ec/ec_lib.c
+++ b/crypto/ec/ec_lib.c
@@ -970,6 +970,13 @@ int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
     return group->meth->is_at_infinity(group, point);
 }
 
+/*
+ * Check whether an EC_POINT is on the curve or not. Note that the return
+ * value for this function should NOT be treated as a boolean. Return values:
+ *  1: The point is on the curve
+ *  0: The point is not on the curve
+ * -1: An error occurred
+ */
 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
                          BN_CTX *ctx)
 {
diff --git a/crypto/ec/ecp_oct.c b/crypto/ec/ecp_oct.c
index e5cec8b..1bc3f39 100644
--- a/crypto/ec/ecp_oct.c
+++ b/crypto/ec/ecp_oct.c
@@ -413,7 +413,7 @@ int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ectest.c b/crypto/ec/ectest.c
index a18b327..fede530 100644
--- a/crypto/ec/ectest.c
+++ b/crypto/ec/ectest.c
@@ -412,7 +412,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
         if (!EC_POINT_get_affine_coordinates_GFp(group, Q, x, y, ctx))
             ABORT;
         fprintf(stderr, "Point is not on curve: x = 0x");
@@ -544,7 +544,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "0100000000000000000001F4C8F927AED3CA752257"))
         ABORT;
@@ -593,7 +593,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831"))
         ABORT;
@@ -646,7 +646,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn
         (&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D"))
@@ -705,7 +705,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E"
                    "84F3B9CAC2FC632551"))
@@ -761,7 +761,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"))
@@ -820,7 +820,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5"
@@ -864,7 +864,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */
@@ -1008,7 +1008,7 @@ static void prime_field_tests(void)
 #  define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!EC_POINT_set_compressed_coordinates_GF2m(group, P, x, _y_bit, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1026,7 +1026,7 @@ static void prime_field_tests(void)
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!BN_hex2bn(&y, _y)) ABORT; \
         if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1157,7 +1157,7 @@ static void char2_field_tests(void)
     if (!EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx))
         ABORT;
 #  endif
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
 /* Change test based on whether binary point compression is enabled or not. */
 #  ifdef OPENSSL_EC_BIN_PT_COMP
         if (!EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y, ctx))
@@ -1378,7 +1378,7 @@ static void char2_field_tests(void)
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */

From matt at openssl.org  Wed Jun 10 10:01:28 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 10:01:28 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433930488.132310.17594.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  d163a2cc46709ba31e91887c65d32743913d3db3 (commit)
      from  72df35acf268e21adfe5b90b89f90e35e9db29bf (commit)


- Log -----------------------------------------------------------------
commit d163a2cc46709ba31e91887c65d32743913d3db3
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 14:22:00 2015 +0100

    EC_POINT_is_on_curve does not return a boolean
    
    The function EC_POINT_is_on_curve does not return a boolean value.
    It returns 1 if the point is on the curve, 0 if it is not, and -1
    on error. Many usages within OpenSSL were incorrectly using this
    function and therefore not correctly handling error conditions.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit 68886be7e2cd395a759fcd41d2cede461b68843d)

-----------------------------------------------------------------------

Summary of changes:
 crypto/ec/ec2_oct.c  |  2 +-
 crypto/ec/ec_check.c |  2 +-
 crypto/ec/ec_key.c   |  2 +-
 crypto/ec/ec_lib.c   |  7 +++++++
 crypto/ec/ecp_oct.c  |  2 +-
 crypto/ec/ectest.c   | 24 ++++++++++++------------
 6 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/crypto/ec/ec2_oct.c b/crypto/ec/ec2_oct.c
index c245d88..0d04cc6 100644
--- a/crypto/ec/ec2_oct.c
+++ b/crypto/ec/ec2_oct.c
@@ -387,7 +387,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_check.c b/crypto/ec/ec_check.c
index d3f5349..dd6f0ac 100644
--- a/crypto/ec/ec_check.c
+++ b/crypto/ec/ec_check.c
@@ -85,7 +85,7 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_GENERATOR);
         goto err;
     }
-    if (!EC_POINT_is_on_curve(group, group->generator, ctx)) {
+    if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index ebdffc8..55ce3fe 100644
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -314,7 +314,7 @@ int EC_KEY_check_key(const EC_KEY *eckey)
         goto err;
 
     /* testing whether the pub_key is on the elliptic curve */
-    if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx)) {
+    if (EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx) <= 0) {
         ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c
index 9a54f41..e227520 100644
--- a/crypto/ec/ec_lib.c
+++ b/crypto/ec/ec_lib.c
@@ -934,6 +934,13 @@ int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
     return group->meth->is_at_infinity(group, point);
 }
 
+/*
+ * Check whether an EC_POINT is on the curve or not. Note that the return
+ * value for this function should NOT be treated as a boolean. Return values:
+ *  1: The point is on the curve
+ *  0: The point is not on the curve
+ * -1: An error occurred
+ */
 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
                          BN_CTX *ctx)
 {
diff --git a/crypto/ec/ecp_oct.c b/crypto/ec/ecp_oct.c
index e5cec8b..1bc3f39 100644
--- a/crypto/ec/ecp_oct.c
+++ b/crypto/ec/ecp_oct.c
@@ -413,7 +413,7 @@ int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ectest.c b/crypto/ec/ectest.c
index a18b327..fede530 100644
--- a/crypto/ec/ectest.c
+++ b/crypto/ec/ectest.c
@@ -412,7 +412,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
         if (!EC_POINT_get_affine_coordinates_GFp(group, Q, x, y, ctx))
             ABORT;
         fprintf(stderr, "Point is not on curve: x = 0x");
@@ -544,7 +544,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "0100000000000000000001F4C8F927AED3CA752257"))
         ABORT;
@@ -593,7 +593,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831"))
         ABORT;
@@ -646,7 +646,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn
         (&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D"))
@@ -705,7 +705,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E"
                    "84F3B9CAC2FC632551"))
@@ -761,7 +761,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"))
@@ -820,7 +820,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5"
@@ -864,7 +864,7 @@ static void prime_field_tests(void)
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */
@@ -1008,7 +1008,7 @@ static void prime_field_tests(void)
 #  define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!EC_POINT_set_compressed_coordinates_GF2m(group, P, x, _y_bit, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1026,7 +1026,7 @@ static void prime_field_tests(void)
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!BN_hex2bn(&y, _y)) ABORT; \
         if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1157,7 +1157,7 @@ static void char2_field_tests(void)
     if (!EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx))
         ABORT;
 #  endif
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
 /* Change test based on whether binary point compression is enabled or not. */
 #  ifdef OPENSSL_EC_BIN_PT_COMP
         if (!EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y, ctx))
@@ -1378,7 +1378,7 @@ static void char2_field_tests(void)
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */

From matt at openssl.org  Wed Jun 10 10:01:41 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 10:01:41 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1433930501.582771.17884.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  cb9f1bc1d118bfe17d7c3004bbf33746df1855bd (commit)
      from  9545eac45bc79496763d2ded02629f88a8629fb9 (commit)


- Log -----------------------------------------------------------------
commit cb9f1bc1d118bfe17d7c3004bbf33746df1855bd
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 14:22:00 2015 +0100

    EC_POINT_is_on_curve does not return a boolean
    
    The function EC_POINT_is_on_curve does not return a boolean value.
    It returns 1 if the point is on the curve, 0 if it is not, and -1
    on error. Many usages within OpenSSL were incorrectly using this
    function and therefore not correctly handling error conditions.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit 68886be7e2cd395a759fcd41d2cede461b68843d)
    
    Conflicts:
    	crypto/ec/ec2_oct.c
    	crypto/ec/ecp_oct.c
    	crypto/ec/ectest.c

-----------------------------------------------------------------------

Summary of changes:
 crypto/ec/ec2_smpl.c |  2 +-
 crypto/ec/ec_check.c |  2 +-
 crypto/ec/ec_key.c   |  2 +-
 crypto/ec/ec_lib.c   |  7 +++++++
 crypto/ec/ecp_smpl.c |  2 +-
 crypto/ec/ectest.c   | 24 ++++++++++++------------
 6 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/crypto/ec/ec2_smpl.c b/crypto/ec/ec2_smpl.c
index 849d20b..5754d6f 100644
--- a/crypto/ec/ec2_smpl.c
+++ b/crypto/ec/ec2_smpl.c
@@ -755,7 +755,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_check.c b/crypto/ec/ec_check.c
index d3f5349..dd6f0ac 100644
--- a/crypto/ec/ec_check.c
+++ b/crypto/ec/ec_check.c
@@ -85,7 +85,7 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_GENERATOR);
         goto err;
     }
-    if (!EC_POINT_is_on_curve(group, group->generator, ctx)) {
+    if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index 7e48015..6104a59 100644
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -304,7 +304,7 @@ int EC_KEY_check_key(const EC_KEY *eckey)
         goto err;
 
     /* testing whether the pub_key is on the elliptic curve */
-    if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx)) {
+    if (EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx) <= 0) {
         ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c
index dd9f4dc..10cda17 100644
--- a/crypto/ec/ec_lib.c
+++ b/crypto/ec/ec_lib.c
@@ -993,6 +993,13 @@ int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
     return group->meth->is_at_infinity(group, point);
 }
 
+/*
+ * Check whether an EC_POINT is on the curve or not. Note that the return
+ * value for this function should NOT be treated as a boolean. Return values:
+ *  1: The point is on the curve
+ *  0: The point is not on the curve
+ * -1: An error occurred
+ */
 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
                          BN_CTX *ctx)
 {
diff --git a/crypto/ec/ecp_smpl.c b/crypto/ec/ecp_smpl.c
index a0c1540..cc924bd 100644
--- a/crypto/ec/ecp_smpl.c
+++ b/crypto/ec/ecp_smpl.c
@@ -985,7 +985,7 @@ int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ectest.c b/crypto/ec/ectest.c
index 005b324..d5789ca 100644
--- a/crypto/ec/ectest.c
+++ b/crypto/ec/ectest.c
@@ -303,7 +303,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
         if (!EC_POINT_get_affine_coordinates_GFp(group, Q, x, y, ctx))
             ABORT;
         fprintf(stderr, "Point is not on curve: x = 0x");
@@ -436,7 +436,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "0100000000000000000001F4C8F927AED3CA752257"))
         ABORT;
@@ -501,7 +501,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831"))
         ABORT;
@@ -570,7 +570,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn
         (&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D"))
@@ -645,7 +645,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E"
                    "84F3B9CAC2FC632551"))
@@ -717,7 +717,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"))
@@ -792,7 +792,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5"
@@ -852,7 +852,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */
@@ -994,7 +994,7 @@ void prime_field_tests()
 #  define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!EC_POINT_set_compressed_coordinates_GF2m(group, P, x, _y_bit, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1012,7 +1012,7 @@ void prime_field_tests()
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!BN_hex2bn(&y, _y)) ABORT; \
         if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1151,7 +1151,7 @@ void char2_field_tests()
     if (!EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx))
         ABORT;
 # endif
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
 /* Change test based on whether binary point compression is enabled or not. */
 # ifdef OPENSSL_EC_BIN_PT_COMP
         if (!EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y, ctx))
@@ -1372,7 +1372,7 @@ void char2_field_tests()
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */

From matt at openssl.org  Wed Jun 10 10:01:52 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 10:01:52 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1433930512.995859.18244.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  50d3049930575f45df11014f6c154e0ae13aa7fe (commit)
      from  8b4fd12b0d1734d281994000752c771e8cd0a103 (commit)


- Log -----------------------------------------------------------------
commit 50d3049930575f45df11014f6c154e0ae13aa7fe
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 4 14:22:00 2015 +0100

    EC_POINT_is_on_curve does not return a boolean
    
    The function EC_POINT_is_on_curve does not return a boolean value.
    It returns 1 if the point is on the curve, 0 if it is not, and -1
    on error. Many usages within OpenSSL were incorrectly using this
    function and therefore not correctly handling error conditions.
    
    With thanks to the Open Crypto Audit Project for reporting this issue.
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit 68886be7e2cd395a759fcd41d2cede461b68843d)
    
    Conflicts:
    	crypto/ec/ec2_oct.c
    	crypto/ec/ecp_oct.c
    	crypto/ec/ectest.c

-----------------------------------------------------------------------

Summary of changes:
 crypto/ec/ec2_smpl.c |  2 +-
 crypto/ec/ec_check.c |  2 +-
 crypto/ec/ec_key.c   |  2 +-
 crypto/ec/ec_lib.c   |  7 +++++++
 crypto/ec/ecp_smpl.c |  2 +-
 crypto/ec/ectest.c   | 24 ++++++++++++------------
 6 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/crypto/ec/ec2_smpl.c b/crypto/ec/ec2_smpl.c
index 5df41e2..df37571 100644
--- a/crypto/ec/ec2_smpl.c
+++ b/crypto/ec/ec2_smpl.c
@@ -677,7 +677,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_check.c b/crypto/ec/ec_check.c
index d3f5349..dd6f0ac 100644
--- a/crypto/ec/ec_check.c
+++ b/crypto/ec/ec_check.c
@@ -85,7 +85,7 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_GENERATOR);
         goto err;
     }
-    if (!EC_POINT_is_on_curve(group, group->generator, ctx)) {
+    if (EC_POINT_is_on_curve(group, group->generator, ctx) <= 0) {
         ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index 7e48015..6104a59 100644
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -304,7 +304,7 @@ int EC_KEY_check_key(const EC_KEY *eckey)
         goto err;
 
     /* testing whether the pub_key is on the elliptic curve */
-    if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx)) {
+    if (EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx) <= 0) {
         ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c
index 8d8b807..33f397b 100644
--- a/crypto/ec/ec_lib.c
+++ b/crypto/ec/ec_lib.c
@@ -993,6 +993,13 @@ int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
     return group->meth->is_at_infinity(group, point);
 }
 
+/*
+ * Check whether an EC_POINT is on the curve or not. Note that the return
+ * value for this function should NOT be treated as a boolean. Return values:
+ *  1: The point is on the curve
+ *  0: The point is not on the curve
+ * -1: An error occurred
+ */
 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
                          BN_CTX *ctx)
 {
diff --git a/crypto/ec/ecp_smpl.c b/crypto/ec/ecp_smpl.c
index a0c1540..cc924bd 100644
--- a/crypto/ec/ecp_smpl.c
+++ b/crypto/ec/ecp_smpl.c
@@ -985,7 +985,7 @@ int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
     }
 
     /* test required by X9.62 */
-    if (!EC_POINT_is_on_curve(group, point, ctx)) {
+    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
         ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
         goto err;
     }
diff --git a/crypto/ec/ectest.c b/crypto/ec/ectest.c
index 2df7f33..0fa7697 100644
--- a/crypto/ec/ectest.c
+++ b/crypto/ec/ectest.c
@@ -303,7 +303,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
         if (!EC_POINT_get_affine_coordinates_GFp(group, Q, x, y, ctx))
             ABORT;
         fprintf(stderr, "Point is not on curve: x = 0x");
@@ -436,7 +436,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "0100000000000000000001F4C8F927AED3CA752257"))
         ABORT;
@@ -501,7 +501,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831"))
         ABORT;
@@ -572,7 +572,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn
         (&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D"))
@@ -649,7 +649,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E"
                    "84F3B9CAC2FC632551"))
@@ -723,7 +723,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"))
@@ -800,7 +800,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!BN_hex2bn(&z, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                    "FFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5"
@@ -862,7 +862,7 @@ void prime_field_tests()
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */
@@ -1004,7 +1004,7 @@ void prime_field_tests()
 #  define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!EC_POINT_set_compressed_coordinates_GF2m(group, P, x, _y_bit, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1022,7 +1022,7 @@ void prime_field_tests()
         if (!BN_hex2bn(&x, _x)) ABORT; \
         if (!BN_hex2bn(&y, _y)) ABORT; \
         if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
-        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (EC_POINT_is_on_curve(group, P, ctx) <= 0) ABORT; \
         if (!BN_hex2bn(&z, _order)) ABORT; \
         if (!BN_hex2bn(&cof, _cof)) ABORT; \
         if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
@@ -1161,7 +1161,7 @@ void char2_field_tests()
     if (!EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx))
         ABORT;
 # endif
-    if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+    if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
 /* Change test based on whether binary point compression is enabled or not. */
 # ifdef OPENSSL_EC_BIN_PT_COMP
         if (!EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y, ctx))
@@ -1382,7 +1382,7 @@ void char2_field_tests()
         ABORT;
     if (!EC_POINT_dbl(group, P, P, ctx))
         ABORT;
-    if (!EC_POINT_is_on_curve(group, P, ctx))
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
         ABORT;
     if (!EC_POINT_invert(group, Q, ctx))
         ABORT;                  /* P = -2Q */

From matt at openssl.org  Wed Jun 10 10:10:28 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 10:10:28 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433931028.956895.19963.nullmailer@dev.openssl.org>

The branch master has been updated
       via  e43a13c807e42688c72c4f3d001112bf0a110464 (commit)
      from  68886be7e2cd395a759fcd41d2cede461b68843d (commit)


- Log -----------------------------------------------------------------
commit e43a13c807e42688c72c4f3d001112bf0a110464
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Jun 8 09:29:56 2015 +0100

    Fix leak in HMAC error path
    
    In the event of an error in the HMAC function, leaks can occur because the
    HMAC_CTX does not get cleaned up.
    
    Thanks to the BoringSSL project for reporting this issue.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/hmac/hmac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
index 572393e..d50fabb 100644
--- a/crypto/hmac/hmac.c
+++ b/crypto/hmac/hmac.c
@@ -219,6 +219,7 @@ unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
     HMAC_CTX_cleanup(&c);
     return md;
  err:
+    HMAC_CTX_cleanup(&c);
     return NULL;
 }
 

From matt at openssl.org  Wed Jun 10 10:10:51 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 10:10:51 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433931051.121647.20897.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  418df5ea232811dc7339380c1aa5e07c28c6c6dc (commit)
      from  d163a2cc46709ba31e91887c65d32743913d3db3 (commit)


- Log -----------------------------------------------------------------
commit 418df5ea232811dc7339380c1aa5e07c28c6c6dc
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Jun 8 09:29:56 2015 +0100

    Fix leak in HMAC error path
    
    In the event of an error in the HMAC function, leaks can occur because the
    HMAC_CTX does not get cleaned up.
    
    Thanks to the BoringSSL project for reporting this issue.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit e43a13c807e42688c72c4f3d001112bf0a110464)

-----------------------------------------------------------------------

Summary of changes:
 crypto/hmac/hmac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
index b1f7317..5925467 100644
--- a/crypto/hmac/hmac.c
+++ b/crypto/hmac/hmac.c
@@ -251,6 +251,7 @@ unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
     HMAC_CTX_cleanup(&c);
     return md;
  err:
+    HMAC_CTX_cleanup(&c);
     return NULL;
 }
 

From matt at openssl.org  Wed Jun 10 10:10:39 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 10:10:39 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433931039.706158.20669.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  3e8f9dc1a07df10dd52544efa269628744a40173 (commit)
      from  7cb79c7afb043e80eb9a4f7ff36f5a7a80cdd8c9 (commit)


- Log -----------------------------------------------------------------
commit 3e8f9dc1a07df10dd52544efa269628744a40173
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Jun 8 09:29:56 2015 +0100

    Fix leak in HMAC error path
    
    In the event of an error in the HMAC function, leaks can occur because the
    HMAC_CTX does not get cleaned up.
    
    Thanks to the BoringSSL project for reporting this issue.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit e43a13c807e42688c72c4f3d001112bf0a110464)

-----------------------------------------------------------------------

Summary of changes:
 crypto/hmac/hmac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
index 5ca3894..15a9a21 100644
--- a/crypto/hmac/hmac.c
+++ b/crypto/hmac/hmac.c
@@ -261,6 +261,7 @@ unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
     HMAC_CTX_cleanup(&c);
     return md;
  err:
+    HMAC_CTX_cleanup(&c);
     return NULL;
 }
 

From matt at openssl.org  Wed Jun 10 11:14:50 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 11:14:50 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433934890.498965.30578.nullmailer@dev.openssl.org>

The branch master has been updated
       via  91d13f1a76216f7d67f7a3068bab2287831ca615 (commit)
       via  b821df5f5b8dbb9bae109ed01076cb4b393b67e0 (commit)
      from  e43a13c807e42688c72c4f3d001112bf0a110464 (commit)


- Log -----------------------------------------------------------------
commit 91d13f1a76216f7d67f7a3068bab2287831ca615
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Jun 1 17:25:29 2015 +0100

    DTLS handshake message fragments musn't span packets
    
    It should not be possible for DTLS message fragments to span multiple
    packets. However previously if the message header fitted exactly into one
    packet, and the fragment body was in the next packet then this would work.
    Obviously this would fail if packets get re-ordered mid-flight.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

commit b821df5f5b8dbb9bae109ed01076cb4b393b67e0
Author: Matt Caswell <matt at openssl.org>
Date:   Tue Jun 2 08:57:02 2015 +0100

    Correct type of RECORD_LAYER_get_rrec_length()
    
    The underlying field returned by RECORD_LAYER_get_rrec_length() is an
    unsigned int. The return type of the function should match that.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/d1_both.c             | 26 ++++++++++++++++++--------
 ssl/record/rec_layer_s3.c |  2 +-
 ssl/record/record.h       |  2 +-
 3 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 569b561..155b8bf 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -868,6 +868,20 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     /* parse the message fragment header */
     dtls1_get_message_header(wire, &msg_hdr);
 
+    len = msg_hdr.msg_len;
+    frag_off = msg_hdr.frag_off;
+    frag_len = msg_hdr.frag_len;
+
+    /*
+     * We must have at least frag_len bytes left in the record to be read.
+     * Fragments must not span records.
+     */
+    if (frag_len > RECORD_LAYER_get_rrec_length(&s->rlayer)) {
+        al = SSL3_AD_ILLEGAL_PARAMETER;
+        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT, SSL_R_BAD_LENGTH);
+        goto f_err;
+    }
+
     /*
      * if this is a future (or stale) message it gets buffered
      * (or dropped)--no further processing at this time
@@ -878,10 +892,6 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
         && !(s->d1->listen && msg_hdr.seq == 1))
         return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
 
-    len = msg_hdr.msg_len;
-    frag_off = msg_hdr.frag_off;
-    frag_len = msg_hdr.frag_len;
-
     if (frag_len && frag_len < len)
         return dtls1_reassemble_fragment(s, &msg_hdr, ok);
 
@@ -912,17 +922,16 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     if ((al = dtls1_preprocess_fragment(s, &msg_hdr, max)))
         goto f_err;
 
-    /* XDTLS:  ressurect this when restart is in place */
-    s->state = stn;
-
     if (frag_len > 0) {
         unsigned char *p =
             (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
 
         i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE,
                                       &p[frag_off], frag_len, 0);
+
         /*
-         * XDTLS: fix this--message fragments cannot span multiple packets
+         * This shouldn't ever fail due to NBIO because we already checked
+         * that we have enough data in the record
          */
         if (i <= 0) {
             s->rwstate = SSL_READING;
@@ -943,6 +952,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     }
 
     *ok = 1;
+    s->state = stn;
 
     /*
      * Note that s->init_num is *not* used as current offset in
diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c
index 47a021d..79d3c21 100644
--- a/ssl/record/rec_layer_s3.c
+++ b/ssl/record/rec_layer_s3.c
@@ -1504,7 +1504,7 @@ int RECORD_LAYER_is_sslv2_record(RECORD_LAYER *rl)
 /*
  * Returns the length in bytes of the current rrec
  */
-int RECORD_LAYER_get_rrec_length(RECORD_LAYER *rl)
+unsigned int RECORD_LAYER_get_rrec_length(RECORD_LAYER *rl)
 {
     return SSL3_RECORD_get_length(&rl->rrec);
 }
diff --git a/ssl/record/record.h b/ssl/record/record.h
index cf1607c..6931bb4 100644
--- a/ssl/record/record.h
+++ b/ssl/record/record.h
@@ -326,7 +326,7 @@ void RECORD_LAYER_reset_read_sequence(RECORD_LAYER *rl);
 void RECORD_LAYER_reset_write_sequence(RECORD_LAYER *rl);
 int RECORD_LAYER_setup_comp_buffer(RECORD_LAYER *rl);
 int RECORD_LAYER_is_sslv2_record(RECORD_LAYER *rl);
-int RECORD_LAYER_get_rrec_length(RECORD_LAYER *rl);
+unsigned int RECORD_LAYER_get_rrec_length(RECORD_LAYER *rl);
 __owur int ssl3_pending(const SSL *s);
 __owur int ssl3_write_bytes(SSL *s, int type, const void *buf, int len);
 __owur int do_ssl3_write(SSL *s, int type, const unsigned char *buf,

From matt at openssl.org  Wed Jun 10 11:15:04 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 11:15:04 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433934904.286912.31327.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  9dcab127e14467733523ff7626da8906e67eedd6 (commit)
      from  3e8f9dc1a07df10dd52544efa269628744a40173 (commit)


- Log -----------------------------------------------------------------
commit 9dcab127e14467733523ff7626da8906e67eedd6
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Jun 1 17:25:29 2015 +0100

    DTLS handshake message fragments musn't span packets
    
    It should not be possible for DTLS message fragments to span multiple
    packets. However previously if the message header fitted exactly into one
    packet, and the fragment body was in the next packet then this would work.
    Obviously this would fail if packets get re-ordered mid-flight.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/d1_both.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index ffd4784..b4ee7ab 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -879,6 +879,20 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     /* parse the message fragment header */
     dtls1_get_message_header(wire, &msg_hdr);
 
+    len = msg_hdr.msg_len;
+    frag_off = msg_hdr.frag_off;
+    frag_len = msg_hdr.frag_len;
+
+    /*
+     * We must have at least frag_len bytes left in the record to be read.
+     * Fragments must not span records.
+     */
+    if (frag_len > s->s3->rrec.length) {
+        al = SSL3_AD_ILLEGAL_PARAMETER;
+        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT, SSL_R_BAD_LENGTH);
+        goto f_err;
+    }
+
     /*
      * if this is a future (or stale) message it gets buffered
      * (or dropped)--no further processing at this time
@@ -889,10 +903,6 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
         && !(s->d1->listen && msg_hdr.seq == 1))
         return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
 
-    len = msg_hdr.msg_len;
-    frag_off = msg_hdr.frag_off;
-    frag_len = msg_hdr.frag_len;
-
     if (frag_len && frag_len < len)
         return dtls1_reassemble_fragment(s, &msg_hdr, ok);
 
@@ -923,17 +933,16 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     if ((al = dtls1_preprocess_fragment(s, &msg_hdr, max)))
         goto f_err;
 
-    /* XDTLS:  ressurect this when restart is in place */
-    s->state = stn;
-
     if (frag_len > 0) {
         unsigned char *p =
             (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
 
         i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE,
                                       &p[frag_off], frag_len, 0);
+
         /*
-         * XDTLS: fix this--message fragments cannot span multiple packets
+         * This shouldn't ever fail due to NBIO because we already checked
+         * that we have enough data in the record
          */
         if (i <= 0) {
             s->rwstate = SSL_READING;
@@ -954,6 +963,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     }
 
     *ok = 1;
+    s->state = stn;
 
     /*
      * Note that s->init_num is *not* used as current offset in

From matt at openssl.org  Wed Jun 10 11:15:19 2015
From: matt at openssl.org (Matt Caswell)
Date: Wed, 10 Jun 2015 11:15:19 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433934919.153215.31636.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  d46de4ce483d684ecbec2aa967618f06865ae74a (commit)
      from  418df5ea232811dc7339380c1aa5e07c28c6c6dc (commit)


- Log -----------------------------------------------------------------
commit d46de4ce483d684ecbec2aa967618f06865ae74a
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Jun 1 17:25:29 2015 +0100

    DTLS handshake message fragments musn't span packets
    
    It should not be possible for DTLS message fragments to span multiple
    packets. However previously if the message header fitted exactly into one
    packet, and the fragment body was in the next packet then this would work.
    Obviously this would fail if packets get re-ordered mid-flight.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/d1_both.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index c5b2e99..8dd8ea3 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -875,6 +875,20 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     /* parse the message fragment header */
     dtls1_get_message_header(wire, &msg_hdr);
 
+    len = msg_hdr.msg_len;
+    frag_off = msg_hdr.frag_off;
+    frag_len = msg_hdr.frag_len;
+
+    /*
+     * We must have at least frag_len bytes left in the record to be read.
+     * Fragments must not span records.
+     */
+    if (frag_len > s->s3->rrec.length) {
+        al = SSL3_AD_ILLEGAL_PARAMETER;
+        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT, SSL_R_BAD_LENGTH);
+        goto f_err;
+    }
+
     /*
      * if this is a future (or stale) message it gets buffered
      * (or dropped)--no further processing at this time
@@ -885,10 +899,6 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
         && !(s->d1->listen && msg_hdr.seq == 1))
         return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
 
-    len = msg_hdr.msg_len;
-    frag_off = msg_hdr.frag_off;
-    frag_len = msg_hdr.frag_len;
-
     if (frag_len && frag_len < len)
         return dtls1_reassemble_fragment(s, &msg_hdr, ok);
 
@@ -919,17 +929,16 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     if ((al = dtls1_preprocess_fragment(s, &msg_hdr, max)))
         goto f_err;
 
-    /* XDTLS:  ressurect this when restart is in place */
-    s->state = stn;
-
     if (frag_len > 0) {
         unsigned char *p =
             (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
 
         i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE,
                                       &p[frag_off], frag_len, 0);
+
         /*
-         * XDTLS: fix this--message fragments cannot span multiple packets
+         * This shouldn't ever fail due to NBIO because we already checked
+         * that we have enough data in the record
          */
         if (i <= 0) {
             s->rwstate = SSL_READING;
@@ -950,6 +959,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
     }
 
     *ok = 1;
+    s->state = stn;
 
     /*
      * Note that s->init_num is *not* used as current offset in

From emilia at openssl.org  Wed Jun 10 11:55:56 2015
From: emilia at openssl.org (Emilia Kasper)
Date: Wed, 10 Jun 2015 11:55:56 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433937356.235120.8944.nullmailer@dev.openssl.org>

The branch master has been updated
       via  a8e4ac6a2fe67c19672ecf0c6aeafa15801ce3a5 (commit)
      from  91d13f1a76216f7d67f7a3068bab2287831ca615 (commit)


- Log -----------------------------------------------------------------
commit a8e4ac6a2fe67c19672ecf0c6aeafa15801ce3a5
Author: Emilia Kasper <emilia at openssl.org>
Date:   Tue Jun 9 14:17:50 2015 +0200

    Remove SSL_OP_TLS_BLOCK_PADDING_BUG
    
    This is a workaround so old that nobody remembers what buggy clients
    it was for. It's also been broken in stable branches for two years and
    nobody noticed (see
    https://boringssl-review.googlesource.com/#/c/1694/).
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                         |  5 +++++
 apps/s_server.c                 |  3 ---
 doc/ssl/SSL_CTX_set_options.pod |  4 ----
 include/openssl/ssl.h           |  3 ++-
 include/openssl/ssl3.h          |  3 ++-
 ssl/record/ssl3_record.c        | 22 ----------------------
 6 files changed, 9 insertions(+), 31 deletions(-)

diff --git a/CHANGES b/CHANGES
index e1b3392..1bd9e1a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,11 @@
  _______________
 
  Changes between 1.0.2 and 1.1.0  [xx XXX xxxx]
+  *) Remove SSL_OP_TLS_BLOCK_PADDING_BUG. This is SSLeay legacy, we're
+     not aware of clients that still exhibit this bug, and the workaround
+     hasn't been working properly for a while.
+     [Emilia K?sper]
+
   *) The return type of BIO_number_read() and BIO_number_written() as well as
      the corresponding num_read and num_write members in the BIO structure has
      changed from unsigned long to uint64_t. On platforms where an unsigned
diff --git a/apps/s_server.c b/apps/s_server.c
index 8354386..072d30d 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -2462,9 +2462,6 @@ static int init_ssl_connection(SSL *con)
 #endif
     if (SSL_cache_hit(con))
         BIO_printf(bio_s_out, "Reused session-id\n");
-    if (SSL_ctrl(con, SSL_CTRL_GET_FLAGS, 0, NULL) &
-        TLS1_FLAGS_TLS_PADDING_BUG)
-        BIO_printf(bio_s_out, "Peer has incorrect TLSv1 block padding\n");
     BIO_printf(bio_s_out, "Secure Renegotiation IS%s supported\n",
                SSL_get_secure_renegotiation_support(con) ? "" : " NOT");
     if (keymatexportlabel != NULL) {
diff --git a/doc/ssl/SSL_CTX_set_options.pod b/doc/ssl/SSL_CTX_set_options.pod
index 1078f09..84dde28 100644
--- a/doc/ssl/SSL_CTX_set_options.pod
+++ b/doc/ssl/SSL_CTX_set_options.pod
@@ -94,10 +94,6 @@ OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
 
 ...
 
-=item SSL_OP_TLS_BLOCK_PADDING_BUG
-
-...
-
 =item SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
 
 Disables a countermeasure against a SSL 3.0/TLS 1.0 protocol
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index 4e18b65..cd932e5 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -360,7 +360,8 @@ typedef int (*custom_ext_parse_cb) (SSL *s, unsigned int ext_type,
 # define SSL_OP_SAFARI_ECDHE_ECDSA_BUG                   0x00000040L
 # define SSL_OP_SSLEAY_080_CLIENT_DH_BUG                 0x00000080L
 # define SSL_OP_TLS_D5_BUG                               0x00000100L
-# define SSL_OP_TLS_BLOCK_PADDING_BUG                    0x00000200L
+/* Removed from OpenSSL 1.1.0 */
+# define SSL_OP_TLS_BLOCK_PADDING_BUG                    0x0L
 
 /* Hasn't done anything since OpenSSL 0.9.7h, retained for compatibility */
 # define SSL_OP_MSIE_SSLV2_RSA_PADDING                   0x0
diff --git a/include/openssl/ssl3.h b/include/openssl/ssl3.h
index 66bc8c6..138b80c 100644
--- a/include/openssl/ssl3.h
+++ b/include/openssl/ssl3.h
@@ -362,7 +362,8 @@ extern "C" {
 # define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS       0x0001
 # define SSL3_FLAGS_DELAY_CLIENT_FINISHED        0x0002
 # define SSL3_FLAGS_POP_BUFFER                   0x0004
-# define TLS1_FLAGS_TLS_PADDING_BUG              0x0008
+/* Removed from OpenSSL 1.1.0 */
+# define TLS1_FLAGS_TLS_PADDING_BUG              0x0
 # define TLS1_FLAGS_SKIP_CERT_VERIFY             0x0010
 # define TLS1_FLAGS_KEEP_HANDSHAKE               0x0020
 /*
diff --git a/ssl/record/ssl3_record.c b/ssl/record/ssl3_record.c
index dbec5f1..1865f24 100644
--- a/ssl/record/ssl3_record.c
+++ b/ssl/record/ssl3_record.c
@@ -748,10 +748,6 @@ int tls1_enc(SSL *s, int send)
 
             /* we need to add 'i' padding bytes of value j */
             j = i - 1;
-            if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) {
-                if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
-                    j++;
-            }
             for (k = (int)l; k < (int)(l + i); k++)
                 rec->input[k] = j;
             l += i;
@@ -1064,24 +1060,6 @@ int tls1_cbc_remove_padding(const SSL *s,
 
     padding_length = rec->data[rec->length - 1];
 
-    /*
-     * NB: if compression is in operation the first packet may not be of even
-     * length so the padding bug check cannot be performed. This bug
-     * workaround has been around since SSLeay so hopefully it is either
-     * fixed now or no buggy implementation supports compression [steve]
-     */
-    if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
-        /* First packet is even in size, so check */
-        if ((CRYPTO_memcmp(RECORD_LAYER_get_read_sequence(&s->rlayer),
-                "\0\0\0\0\0\0\0\0", 8) == 0) &&
-            !(padding_length & 1)) {
-            s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;
-        }
-        if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) && padding_length > 0) {
-            padding_length--;
-        }
-    }
-
     if (EVP_CIPHER_flags(s->enc_read_ctx->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
         /* padding is already verified */
         rec->length -= padding_length + 1;

From steve at openssl.org  Wed Jun 10 21:09:18 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Wed, 10 Jun 2015 21:09:18 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433970558.925514.8566.nullmailer@dev.openssl.org>

The branch master has been updated
       via  633d49c7b486ab7cba9408fd02bcaaad3b8d8f1e (commit)
       via  e1fa652d5ef6e505ce734ca99c8837201b880cc7 (commit)
      from  a8e4ac6a2fe67c19672ecf0c6aeafa15801ce3a5 (commit)


- Log -----------------------------------------------------------------
commit 633d49c7b486ab7cba9408fd02bcaaad3b8d8f1e
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sun Jun 7 21:47:39 2015 +0100

    Tidy disabled algorithm handling.
    
    Determine disabled algorithm masks when algorithms are loaded instead of
    recalculating them each time.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit e1fa652d5ef6e505ce734ca99c8837201b880cc7
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sun Jun 7 21:46:19 2015 +0100

    Restore GOST mac setup.
    
    Restore GOST mac setup which was accidentally removed during cipher
    refactor.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_ciph.c | 173 +++++++++++++++++++++++++--------------------------------
 1 file changed, 77 insertions(+), 96 deletions(-)

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index 39b5a71..7f932b0 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -449,27 +449,91 @@ static int get_optional_pkey_id(const char *pkey_name)
 
 #endif
 
+/* masks of disabled algorithms */
+static unsigned long disabled_enc_mask;
+static unsigned long disabled_mac_mask;
+static unsigned long disabled_mkey_mask;
+static unsigned long disabled_auth_mask;
+
 void ssl_load_ciphers(void)
 {
     size_t i;
     const ssl_cipher_table *t;
+    disabled_enc_mask = 0;
     for (i = 0, t = ssl_cipher_table_cipher; i < SSL_ENC_NUM_IDX; i++, t++) {
-        if (t->nid == NID_undef)
+        if (t->nid == NID_undef) {
             ssl_cipher_methods[i] = NULL;
-        else
-            ssl_cipher_methods[i] = EVP_get_cipherbynid(t->nid);
+        } else {
+            const EVP_CIPHER *cipher = EVP_get_cipherbynid(t->nid);
+            ssl_cipher_methods[i] = cipher;
+            if (cipher == NULL)
+                disabled_enc_mask |= t->mask;
+        }
     }
-
+#ifdef SSL_FORBID_ENULL
+    disabled_enc_mask |= SSL_eNULL;
+#endif
+    disabled_mac_mask = 0;
     for (i = 0, t = ssl_cipher_table_mac; i < SSL_MD_NUM_IDX; i++, t++) {
-        ssl_digest_methods[i] = EVP_get_digestbynid(t->nid);
-        if (ssl_digest_methods[i]) {
-            ssl_mac_secret_size[i] = EVP_MD_size(ssl_digest_methods[i]);
+        const EVP_MD *md = EVP_get_digestbynid(t->nid);
+        ssl_digest_methods[i] = md;
+        if (md == NULL) {
+            disabled_mac_mask |= t->mask;
+        } else {
+            ssl_mac_secret_size[i] = EVP_MD_size(md);
             OPENSSL_assert(ssl_mac_secret_size[i] >= 0);
         }
     }
     /* Make sure we can access MD5 and SHA1 */
     OPENSSL_assert(ssl_digest_methods[SSL_MD_MD5_IDX] != NULL);
     OPENSSL_assert(ssl_digest_methods[SSL_MD_SHA1_IDX] != NULL);
+
+    disabled_mkey_mask = 0;
+    disabled_auth_mask = 0;
+
+#ifdef OPENSSL_NO_RSA
+    disabled_mkey_mask |= SSL_kRSA;
+    disabled_auth_mask |= SSL_aRSA;
+#endif
+#ifdef OPENSSL_NO_DSA
+    disabled_auth_mask |= SSL_aDSS;
+#endif
+#ifdef OPENSSL_NO_DH
+    disabled_mkey_mask |= SSL_kDHr | SSL_kDHd | SSL_kDHE;
+    disabled_auth_mask |= SSL_aDH;
+#endif
+#ifdef OPENSSL_NO_EC
+    disabled_mkey_mask |= SSL_kECDHe | SSL_kECDHr;
+    disabled_auth_mask |= SSL_aECDSA | SSL_aECDH;
+#endif
+#ifdef OPENSSL_NO_PSK
+    disabled_mkey_mask |= SSL_kPSK;
+    disabled_auth_mask |= SSL_aPSK;
+#endif
+#ifdef OPENSSL_NO_SRP
+    disabled_mkey_mask |= SSL_kSRP;
+#endif
+
+    /*
+     * Check for presence of GOST 34.10 algorithms, and if they are not
+     * present, disable appropriate auth and key exchange
+     */
+    ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] = get_optional_pkey_id("gost-mac");
+    if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]) {
+        ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX] = 32;
+    } else {
+        disabled_mac_mask |= SSL_GOST89MAC;
+    }
+
+    if (!get_optional_pkey_id("gost94"))
+        disabled_auth_mask |= SSL_aGOST94;
+    if (!get_optional_pkey_id("gost2001"))
+        disabled_auth_mask |= SSL_aGOST01;
+    /*
+     * Disable GOST key exchange if no GOST signature algs are available *
+     */
+    if ((disabled_auth_mask & (SSL_aGOST94 | SSL_aGOST01)) == (SSL_aGOST94 | SSL_aGOST01))
+        disabled_mkey_mask |= SSL_kGOST;
 }
 
 #ifndef OPENSSL_NO_COMP
@@ -668,93 +732,6 @@ static void ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr,
     *head = curr;
 }
 
-static void ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth,
-                                    unsigned long *enc, unsigned long *mac,
-                                    unsigned long *ssl)
-{
-    *mkey = 0;
-    *auth = 0;
-    *enc = 0;
-    *mac = 0;
-    *ssl = 0;
-
-#ifdef OPENSSL_NO_RSA
-    *mkey |= SSL_kRSA;
-    *auth |= SSL_aRSA;
-#endif
-#ifdef OPENSSL_NO_DSA
-    *auth |= SSL_aDSS;
-#endif
-#ifdef OPENSSL_NO_DH
-    *mkey |= SSL_kDHr | SSL_kDHd | SSL_kDHE;
-    *auth |= SSL_aDH;
-#endif
-#ifdef OPENSSL_NO_EC
-    *mkey |= SSL_kECDHe | SSL_kECDHr;
-    *auth |= SSL_aECDSA | SSL_aECDH;
-#endif
-#ifdef OPENSSL_NO_PSK
-    *mkey |= SSL_kPSK;
-    *auth |= SSL_aPSK;
-#endif
-#ifdef OPENSSL_NO_SRP
-    *mkey |= SSL_kSRP;
-#endif
-    /*
-     * Check for presence of GOST 34.10 algorithms, and if they do not
-     * present, disable appropriate auth and key exchange
-     */
-    if (!get_optional_pkey_id("gost94")) {
-        *auth |= SSL_aGOST94;
-    }
-    if (!get_optional_pkey_id("gost2001")) {
-        *auth |= SSL_aGOST01;
-    }
-    /*
-     * Disable GOST key exchange if no GOST signature algs are available *
-     */
-    if ((*auth & (SSL_aGOST94 | SSL_aGOST01)) == (SSL_aGOST94 | SSL_aGOST01)) {
-        *mkey |= SSL_kGOST;
-    }
-#ifdef SSL_FORBID_ENULL
-    *enc |= SSL_eNULL;
-#endif
-
-    *enc |= (ssl_cipher_methods[SSL_ENC_DES_IDX] == NULL) ? SSL_DES : 0;
-    *enc |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES : 0;
-    *enc |= (ssl_cipher_methods[SSL_ENC_RC4_IDX] == NULL) ? SSL_RC4 : 0;
-    *enc |= (ssl_cipher_methods[SSL_ENC_RC2_IDX] == NULL) ? SSL_RC2 : 0;
-    *enc |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA : 0;
-    *enc |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES128 : 0;
-    *enc |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES256 : 0;
-    *enc |=
-        (ssl_cipher_methods[SSL_ENC_AES128GCM_IDX] ==
-         NULL) ? SSL_AES128GCM : 0;
-    *enc |=
-        (ssl_cipher_methods[SSL_ENC_AES256GCM_IDX] ==
-         NULL) ? SSL_AES256GCM : 0;
-    *enc |=
-        (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] ==
-         NULL) ? SSL_CAMELLIA128 : 0;
-    *enc |=
-        (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] ==
-         NULL) ? SSL_CAMELLIA256 : 0;
-    *enc |=
-        (ssl_cipher_methods[SSL_ENC_GOST89_IDX] ==
-         NULL) ? SSL_eGOST2814789CNT : 0;
-    *enc |= (ssl_cipher_methods[SSL_ENC_SEED_IDX] == NULL) ? SSL_SEED : 0;
-
-    *mac |= (ssl_digest_methods[SSL_MD_MD5_IDX] == NULL) ? SSL_MD5 : 0;
-    *mac |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1 : 0;
-    *mac |= (ssl_digest_methods[SSL_MD_SHA256_IDX] == NULL) ? SSL_SHA256 : 0;
-    *mac |= (ssl_digest_methods[SSL_MD_SHA384_IDX] == NULL) ? SSL_SHA384 : 0;
-    *mac |= (ssl_digest_methods[SSL_MD_GOST94_IDX] == NULL) ? SSL_GOST94 : 0;
-    *mac |= (ssl_digest_methods[SSL_MD_GOST89MAC_IDX] == NULL
-             || ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] ==
-             NID_undef) ? SSL_GOST89MAC : 0;
-
-}
-
 static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
                                        int num_of_ciphers,
                                        unsigned long disabled_mkey,
@@ -1425,8 +1402,12 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK
      * To reduce the work to do we only want to process the compiled
      * in algorithms, so we first get the mask of disabled ciphers.
      */
-    ssl_cipher_get_disabled(&disabled_mkey, &disabled_auth, &disabled_enc,
-                            &disabled_mac, &disabled_ssl);
+
+    disabled_mkey = disabled_mkey_mask;
+    disabled_auth = disabled_auth_mask;
+    disabled_enc = disabled_enc_mask;
+    disabled_mac = disabled_mac_mask;
+    disabled_ssl = 0;
 
     /*
      * Now we have to collect the available ciphers from the compiled

From appro at openssl.org  Wed Jun 10 21:57:36 2015
From: appro at openssl.org (Andy Polyakov)
Date: Wed, 10 Jun 2015 21:57:36 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1433973456.761930.16314.nullmailer@dev.openssl.org>

The branch master has been updated
       via  75c4827dfe6f52ccd687a283e6108a88ba3b8ec4 (commit)
      from  633d49c7b486ab7cba9408fd02bcaaad3b8d8f1e (commit)


- Log -----------------------------------------------------------------
commit 75c4827dfe6f52ccd687a283e6108a88ba3b8ec4
Author: Andy Polyakov <appro at openssl.org>
Date:   Mon Jun 1 22:51:33 2015 +0200

    gcm.c: address linker warning about OPENSSL_ia32cap_P size mismatch.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/modes/gcm128.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c
index 02e8f2e..f28e07c 100644
--- a/crypto/modes/gcm128.c
+++ b/crypto/modes/gcm128.c
@@ -682,7 +682,7 @@ static void gcm_gmult_1bit(u64 Xi[2], const u64 H[2])
          defined(_M_IX86)       || defined(_M_AMD64)    || defined(_M_X64))
 #  define GHASH_ASM_X86_OR_64
 #  define GCM_FUNCREF_4BIT
-extern unsigned int OPENSSL_ia32cap_P[2];
+extern unsigned int OPENSSL_ia32cap_P[];
 
 void gcm_init_clmul(u128 Htable[16], const u64 Xi[2]);
 void gcm_gmult_clmul(u64 Xi[2], const u128 Htable[16]);

From appro at openssl.org  Wed Jun 10 21:58:23 2015
From: appro at openssl.org (Andy Polyakov)
Date: Wed, 10 Jun 2015 21:58:23 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433973503.232818.17036.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  1fdf36f5116f7e31e64e4027874e01eac3f0817d (commit)
      from  9dcab127e14467733523ff7626da8906e67eedd6 (commit)


- Log -----------------------------------------------------------------
commit 1fdf36f5116f7e31e64e4027874e01eac3f0817d
Author: Andy Polyakov <appro at openssl.org>
Date:   Mon Jun 1 22:51:33 2015 +0200

    gcm.c: address linker warning about OPENSSL_ia32cap_P size mismatch.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 75c4827dfe6f52ccd687a283e6108a88ba3b8ec4)

-----------------------------------------------------------------------

Summary of changes:
 crypto/modes/gcm128.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c
index 881b223..e299131 100644
--- a/crypto/modes/gcm128.c
+++ b/crypto/modes/gcm128.c
@@ -694,7 +694,7 @@ static void gcm_gmult_1bit(u64 Xi[2], const u64 H[2])
          defined(_M_IX86)       || defined(_M_AMD64)    || defined(_M_X64))
 #  define GHASH_ASM_X86_OR_64
 #  define GCM_FUNCREF_4BIT
-extern unsigned int OPENSSL_ia32cap_P[2];
+extern unsigned int OPENSSL_ia32cap_P[];
 
 void gcm_init_clmul(u128 Htable[16], const u64 Xi[2]);
 void gcm_gmult_clmul(u64 Xi[2], const u128 Htable[16]);

From kurt at openssl.org  Wed Jun 10 22:09:10 2015
From: kurt at openssl.org (Kurt Roeckx)
Date: Wed, 10 Jun 2015 22:09:10 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1433974150.160277.18982.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  57e477b9ec66542afc8c9c13ae7c4271209fb88f (commit)
       via  39a298a1c0e7a76e301b9f2ebe8d33d90ad0a3b4 (commit)
      from  1fdf36f5116f7e31e64e4027874e01eac3f0817d (commit)


- Log -----------------------------------------------------------------
commit 57e477b9ec66542afc8c9c13ae7c4271209fb88f
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Apr 18 19:15:48 2015 +0200

    Only allow a temporary rsa key exchange when they key is larger than 512.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    MR #838

commit 39a298a1c0e7a76e301b9f2ebe8d33d90ad0a3b4
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Jun 6 13:42:34 2015 +0200

    Properly check certificate in case of export ciphers.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    MR #838

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 49 insertions(+), 12 deletions(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index c495641..2346ce5 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -341,7 +341,7 @@ int ssl3_connect(SSL *s)
             if (!
                 (s->s3->tmp.
                  new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
-&& !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                    && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
                 ret = ssl3_get_server_certificate(s);
                 if (ret <= 0)
                     goto end;
@@ -1671,6 +1671,13 @@ int ssl3_get_key_exchange(SSL *s)
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto err;
         }
+
+        if (EVP_PKEY_bits(pkey) <= SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+            al = SSL_AD_UNEXPECTED_MESSAGE;
+            SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE);
+            goto f_err;
+        }
+
         s->session->sess_cert->peer_rsa_tmp = rsa;
         rsa = NULL;
     }
@@ -3436,6 +3443,7 @@ int ssl3_check_cert_and_algorithm(SSL *s)
 #ifndef OPENSSL_NO_DH
     DH *dh;
 #endif
+    int al = SSL_AD_HANDSHAKE_FAILURE;
 
     alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
     alg_a = s->s3->tmp.new_cipher->algorithm_auth;
@@ -3496,15 +3504,32 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     }
 #endif
 #ifndef OPENSSL_NO_RSA
-    if ((alg_k & SSL_kRSA) &&
-        !(has_bits(i, EVP_PK_RSA | EVP_PKT_ENC) || (rsa != NULL))) {
-        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
-               SSL_R_MISSING_RSA_ENCRYPTING_CERT);
-        goto f_err;
+    if (alg_k & SSL_kRSA) {
+        if (!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
+            !has_bits(i, EVP_PK_RSA | EVP_PKT_ENC)) {
+            SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                   SSL_R_MISSING_RSA_ENCRYPTING_CERT);
+            goto f_err;
+        } else if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)) {
+            if (pkey_bits <= SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                if (!has_bits(i, EVP_PK_RSA | EVP_PKT_ENC)) {
+                    SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                           SSL_R_MISSING_RSA_ENCRYPTING_CERT);
+                    goto f_err;
+                }
+                if (rsa != NULL) {
+                    /* server key exchange is not allowed. */
+                    al = SSL_AD_INTERNAL_ERROR;
+                    SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
+                    goto f_err;
+                }
+            }
+        }
     }
 #endif
 #ifndef OPENSSL_NO_DH
     if ((alg_k & SSL_kEDH) && dh == NULL) {
+        al = SSL_AD_INTERNAL_ERROR;
         SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
         goto f_err;
     }
@@ -3547,9 +3572,14 @@ int ssl3_check_cert_and_algorithm(SSL *s)
         pkey_bits > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
 #ifndef OPENSSL_NO_RSA
         if (alg_k & SSL_kRSA) {
-            if (rsa == NULL
-                || RSA_size(rsa) * 8 >
+            if (rsa == NULL) {
+                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                       SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
+                goto f_err;
+            } else if (BN_num_bits(rsa->n) >
                 SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                /* We have a temporary RSA key but it's too large. */
+                al = SSL_AD_EXPORT_RESTRICTION;
                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
                        SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
                 goto f_err;
@@ -3557,14 +3587,21 @@ int ssl3_check_cert_and_algorithm(SSL *s)
         } else
 #endif
 #ifndef OPENSSL_NO_DH
-        if (alg_k & (SSL_kEDH | SSL_kDHr | SSL_kDHd)) {
-            if (dh == NULL
-                || DH_size(dh) * 8 >
+        if (alg_k & SSL_kDHE) {
+            if (BN_num_bits(dh->p) >
                 SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                /* We have a temporary DH key but it's too large. */
+                al = SSL_AD_EXPORT_RESTRICTION;
                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
                        SSL_R_MISSING_EXPORT_TMP_DH_KEY);
                 goto f_err;
             }
+        } else if (alg_k & (SSL_kDHr | SSL_kDHd)) {
+            /* The cert should have had an export DH key. */
+            al = SSL_AD_EXPORT_RESTRICTION;
+            SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                   SSL_R_MISSING_EXPORT_TMP_DH_KEY);
+                goto f_err;
         } else
 #endif
         {
@@ -3575,7 +3612,7 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     }
     return (1);
  f_err:
-    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+    ssl3_send_alert(s, SSL3_AL_FATAL, al);
  err:
     return (0);
 }

From kurt at openssl.org  Wed Jun 10 22:13:53 2015
From: kurt at openssl.org (Kurt Roeckx)
Date: Wed, 10 Jun 2015 22:13:53 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1433974433.652161.21020.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  f3b355fec3b38e9f345a226d7defab146f446100 (commit)
       via  c4ce10773fc4a8d055fe7643c83e5a1187597838 (commit)
      from  d46de4ce483d684ecbec2aa967618f06865ae74a (commit)


- Log -----------------------------------------------------------------
commit f3b355fec3b38e9f345a226d7defab146f446100
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Apr 18 19:15:48 2015 +0200

    Only allow a temporary rsa key exchange when they key is larger than 512.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    MR #838
    
    (cherry picked from commit 57e477b9ec66542afc8c9c13ae7c4271209fb88f)

commit c4ce10773fc4a8d055fe7643c83e5a1187597838
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Jun 6 13:42:34 2015 +0200

    Properly check certificate in case of export ciphers.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    MR #838
    
    (cherry picked from commit 39a298a1c0e7a76e301b9f2ebe8d33d90ad0a3b4)

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 49 insertions(+), 12 deletions(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index f435899..0879a0f 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -341,7 +341,7 @@ int ssl3_connect(SSL *s)
             if (!
                 (s->s3->tmp.
                  new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
-&& !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                    && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
                 ret = ssl3_get_server_certificate(s);
                 if (ret <= 0)
                     goto end;
@@ -1596,6 +1596,13 @@ int ssl3_get_key_exchange(SSL *s)
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto err;
         }
+
+        if (EVP_PKEY_bits(pkey) <= SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+            al = SSL_AD_UNEXPECTED_MESSAGE;
+            SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE);
+            goto f_err;
+        }
+
         s->session->sess_cert->peer_rsa_tmp = rsa;
         rsa = NULL;
     }
@@ -3266,6 +3273,7 @@ int ssl3_check_cert_and_algorithm(SSL *s)
 #ifndef OPENSSL_NO_DH
     DH *dh;
 #endif
+    int al = SSL_AD_HANDSHAKE_FAILURE;
 
     alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
     alg_a = s->s3->tmp.new_cipher->algorithm_auth;
@@ -3319,15 +3327,32 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     }
 #endif
 #ifndef OPENSSL_NO_RSA
-    if ((alg_k & SSL_kRSA) &&
-        !(has_bits(i, EVP_PK_RSA | EVP_PKT_ENC) || (rsa != NULL))) {
-        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
-               SSL_R_MISSING_RSA_ENCRYPTING_CERT);
-        goto f_err;
+    if (alg_k & SSL_kRSA) {
+        if (!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
+            !has_bits(i, EVP_PK_RSA | EVP_PKT_ENC)) {
+            SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                   SSL_R_MISSING_RSA_ENCRYPTING_CERT);
+            goto f_err;
+        } else if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)) {
+            if (pkey_bits <= SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                if (!has_bits(i, EVP_PK_RSA | EVP_PKT_ENC)) {
+                    SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                           SSL_R_MISSING_RSA_ENCRYPTING_CERT);
+                    goto f_err;
+                }
+                if (rsa != NULL) {
+                    /* server key exchange is not allowed. */
+                    al = SSL_AD_INTERNAL_ERROR;
+                    SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
+                    goto f_err;
+                }
+            }
+        }
     }
 #endif
 #ifndef OPENSSL_NO_DH
     if ((alg_k & SSL_kEDH) && dh == NULL) {
+        al = SSL_AD_INTERNAL_ERROR;
         SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
         goto f_err;
     }
@@ -3359,9 +3384,14 @@ int ssl3_check_cert_and_algorithm(SSL *s)
         pkey_bits > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
 #ifndef OPENSSL_NO_RSA
         if (alg_k & SSL_kRSA) {
-            if (rsa == NULL
-                || RSA_size(rsa) * 8 >
+            if (rsa == NULL) {
+                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                       SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
+                goto f_err;
+            } else if (BN_num_bits(rsa->n) >
                 SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                /* We have a temporary RSA key but it's too large. */
+                al = SSL_AD_EXPORT_RESTRICTION;
                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
                        SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
                 goto f_err;
@@ -3369,14 +3399,21 @@ int ssl3_check_cert_and_algorithm(SSL *s)
         } else
 #endif
 #ifndef OPENSSL_NO_DH
-        if (alg_k & (SSL_kEDH | SSL_kDHr | SSL_kDHd)) {
-            if (dh == NULL
-                || DH_size(dh) * 8 >
+        if (alg_k & SSL_kEDH) {
+            if (BN_num_bits(dh->p) >
                 SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
+                /* We have a temporary DH key but it's too large. */
+                al = SSL_AD_EXPORT_RESTRICTION;
                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
                        SSL_R_MISSING_EXPORT_TMP_DH_KEY);
                 goto f_err;
             }
+        } else if (alg_k & (SSL_kDHr | SSL_kDHd)) {
+            /* The cert should have had an export DH key. */
+            al = SSL_AD_EXPORT_RESTRICTION;
+            SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
+                   SSL_R_MISSING_EXPORT_TMP_DH_KEY);
+                goto f_err;
         } else
 #endif
         {
@@ -3387,7 +3424,7 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     }
     return (1);
  f_err:
-    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+    ssl3_send_alert(s, SSL3_AL_FATAL, al);
  err:
     return (0);
 }

From appro at openssl.org  Thu Jun 11 08:13:25 2015
From: appro at openssl.org (Andy Polyakov)
Date: Thu, 11 Jun 2015 08:13:25 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434010405.004471.17953.nullmailer@dev.openssl.org>

The branch master has been updated
       via  f0fa5c8306236ce742168d664d53b1551649a47b (commit)
      from  75c4827dfe6f52ccd687a283e6108a88ba3b8ec4 (commit)


- Log -----------------------------------------------------------------
commit f0fa5c8306236ce742168d664d53b1551649a47b
Author: Andy Polyakov <appro at openssl.org>
Date:   Thu Jun 11 08:51:53 2015 +0200

    e_aes_cbc_hmac_sha*.c: address linker warning about OPENSSL_ia32cap_P size mismatch.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/evp/e_aes_cbc_hmac_sha1.c   | 2 +-
 crypto/evp/e_aes_cbc_hmac_sha256.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c
index 7f2848e..91eca15 100644
--- a/crypto/evp/e_aes_cbc_hmac_sha1.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha1.c
@@ -94,7 +94,7 @@ typedef struct {
         defined(_M_AMD64)       || defined(_M_X64)      || \
         defined(__INTEL__)      )
 
-extern unsigned int OPENSSL_ia32cap_P[3];
+extern unsigned int OPENSSL_ia32cap_P[];
 #  define AESNI_CAPABLE   (1<<(57-32))
 
 int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
diff --git a/crypto/evp/e_aes_cbc_hmac_sha256.c b/crypto/evp/e_aes_cbc_hmac_sha256.c
index 3b6827a..e83969d 100644
--- a/crypto/evp/e_aes_cbc_hmac_sha256.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha256.c
@@ -94,7 +94,7 @@ typedef struct {
         defined(_M_AMD64)       || defined(_M_X64)      || \
         defined(__INTEL__)      )
 
-extern unsigned int OPENSSL_ia32cap_P[3];
+extern unsigned int OPENSSL_ia32cap_P[];
 #  define AESNI_CAPABLE   (1<<(57-32))
 
 int aesni_set_encrypt_key(const unsigned char *userKey, int bits,

From appro at openssl.org  Thu Jun 11 08:14:19 2015
From: appro at openssl.org (Andy Polyakov)
Date: Thu, 11 Jun 2015 08:14:19 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434010459.763357.18886.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  c35e138a58a90bc302679dbaa0f5eaf8b28ac35a (commit)
      from  57e477b9ec66542afc8c9c13ae7c4271209fb88f (commit)


- Log -----------------------------------------------------------------
commit c35e138a58a90bc302679dbaa0f5eaf8b28ac35a
Author: Andy Polyakov <appro at openssl.org>
Date:   Thu Jun 11 08:51:53 2015 +0200

    e_aes_cbc_hmac_sha*.c: address linker warning about OPENSSL_ia32cap_P size mismatch.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit f0fa5c8306236ce742168d664d53b1551649a47b)

-----------------------------------------------------------------------

Summary of changes:
 crypto/evp/e_aes_cbc_hmac_sha1.c   | 2 +-
 crypto/evp/e_aes_cbc_hmac_sha256.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c
index a277d0f..8330964 100644
--- a/crypto/evp/e_aes_cbc_hmac_sha1.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha1.c
@@ -94,7 +94,7 @@ typedef struct {
         defined(_M_AMD64)       || defined(_M_X64)      || \
         defined(__INTEL__)      )
 
-extern unsigned int OPENSSL_ia32cap_P[3];
+extern unsigned int OPENSSL_ia32cap_P[];
 #  define AESNI_CAPABLE   (1<<(57-32))
 
 int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
diff --git a/crypto/evp/e_aes_cbc_hmac_sha256.c b/crypto/evp/e_aes_cbc_hmac_sha256.c
index b74bd80..b1c586e 100644
--- a/crypto/evp/e_aes_cbc_hmac_sha256.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha256.c
@@ -94,7 +94,7 @@ typedef struct {
         defined(_M_AMD64)       || defined(_M_X64)      || \
         defined(__INTEL__)      )
 
-extern unsigned int OPENSSL_ia32cap_P[3];
+extern unsigned int OPENSSL_ia32cap_P[];
 #  define AESNI_CAPABLE   (1<<(57-32))
 
 int aesni_set_encrypt_key(const unsigned char *userKey, int bits,

From matt at openssl.org  Thu Jun 11 09:20:43 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 09:20:43 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434014443.061740.28384.nullmailer@dev.openssl.org>

The branch master has been updated
       via  708cf593587e2fda67dae9782991ff9fccc781eb (commit)
      from  f0fa5c8306236ce742168d664d53b1551649a47b (commit)


- Log -----------------------------------------------------------------
commit 708cf593587e2fda67dae9782991ff9fccc781eb
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 01:30:06 2015 +0100

    More ssl_session_dup fixes
    
    Fix error handling in ssl_session_dup, as well as incorrect setting up of
    the session ticket. Follow on from CVE-2015-1791.
    
    Thanks to LibreSSL project for reporting these issues.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 72 +++++++++++++++++++++++++++++++---------------------------
 1 file changed, 38 insertions(+), 34 deletions(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index fd94054..c639e53 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -239,39 +239,57 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     }
     memcpy(dest, src, sizeof(*dest));
 
+    /*
+     * Set the various pointers to NULL so that we can call SSL_SESSION_free in
+     * the case of an error whilst halfway through constructing dest
+     */
+#ifndef OPENSSL_NO_PSK
+    dest->psk_identity_hint = NULL;
+    dest->psk_identity = NULL;
+#endif
+    dest->ciphers = NULL;
+    dest->tlsext_hostname = NULL;
+#ifndef OPENSSL_NO_EC
+    dest->tlsext_ecpointformatlist = NULL;
+    dest->tlsext_ellipticcurvelist = NULL;
+#endif
+    dest->tlsext_tick = NULL;
+#ifndef OPENSSL_NO_SRP
+    dest->srp_username = NULL;
+#endif
+    memset(&dest->ex_data, 0, sizeof(dest->ex_data));
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+    dest->references = 1;
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
+
 #ifndef OPENSSL_NO_PSK
     if (src->psk_identity_hint) {
         dest->psk_identity_hint = BUF_strdup(src->psk_identity_hint);
         if (dest->psk_identity_hint == NULL) {
             goto err;
         }
-    } else {
-        dest->psk_identity_hint = NULL;
     }
     if (src->psk_identity) {
         dest->psk_identity = BUF_strdup(src->psk_identity);
         if (dest->psk_identity == NULL) {
             goto err;
         }
-    } else {
-        dest->psk_identity = NULL;
     }
 #endif
 
-    if (src->sess_cert != NULL)
-        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
-
-    if (src->peer != NULL)
-        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
-
-    dest->references = 1;
-
     if(src->ciphers != NULL) {
         dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
         if (dest->ciphers == NULL)
             goto err;
-    } else {
-        dest->ciphers = NULL;
     }
 
     if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
@@ -279,28 +297,19 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         goto err;
     }
 
-    /* We deliberately don't copy the prev and next pointers */
-    dest->prev = NULL;
-    dest->next = NULL;
-
-#ifndef OPENSSL_NO_TLSEXT
     if (src->tlsext_hostname) {
         dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
         if (dest->tlsext_hostname == NULL) {
             goto err;
         }
-    } else {
-        dest->tlsext_hostname = NULL;
     }
-# ifndef OPENSSL_NO_EC
+#ifndef OPENSSL_NO_EC
     if (src->tlsext_ecpointformatlist) {
         dest->tlsext_ecpointformatlist =
             BUF_memdup(src->tlsext_ecpointformatlist,
                        src->tlsext_ecpointformatlist_length);
         if (dest->tlsext_ecpointformatlist == NULL)
             goto err;
-        dest->tlsext_ecpointformatlist_length =
-            src->tlsext_ecpointformatlist_length;
     }
     if (src->tlsext_ellipticcurvelist) {
         dest->tlsext_ellipticcurvelist =
@@ -308,29 +317,24 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
                        src->tlsext_ellipticcurvelist_length);
         if (dest->tlsext_ellipticcurvelist == NULL)
             goto err;
-        dest->tlsext_ellipticcurvelist_length =
-            src->tlsext_ellipticcurvelist_length;
     }
-# endif
 #endif
 
     if (ticket != 0) {
-        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
-        dest->tlsext_ticklen = src->tlsext_ticklen;
-        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+        dest->tlsext_tick = BUF_memdup(src->tlsext_tick, src->tlsext_ticklen);
+        if(dest->tlsext_tick == NULL)
             goto err;
-        }
+    } else {
+        dest->tlsext_tick_lifetime_hint = 0;
+        dest->tlsext_ticklen = 0;
     }
 
 #ifndef OPENSSL_NO_SRP
-    dest->srp_username = NULL;
     if (src->srp_username) {
         dest->srp_username = BUF_strdup(src->srp_username);
         if (dest->srp_username == NULL) {
             goto err;
         }
-    } else {
-        dest->srp_username = NULL;
     }
 #endif
 

From matt at openssl.org  Thu Jun 11 09:20:54 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 09:20:54 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434014454.460863.29124.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  d44f89c990b4c9c41f77e9a0ffd5dc7c4ca07f84 (commit)
      from  c35e138a58a90bc302679dbaa0f5eaf8b28ac35a (commit)


- Log -----------------------------------------------------------------
commit d44f89c990b4c9c41f77e9a0ffd5dc7c4ca07f84
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 01:30:06 2015 +0100

    More ssl_session_dup fixes
    
    Fix error handling in ssl_session_dup, as well as incorrect setting up of
    the session ticket. Follow on from CVE-2015-1791.
    
    Thanks to LibreSSL project for reporting these issues.
    
    Conflicts:
    	ssl/ssl_sess.c
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 73 +++++++++++++++++++++++++++++-----------------------------
 1 file changed, 37 insertions(+), 36 deletions(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 5358f4a..07e7379 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -241,12 +241,39 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     }
     memcpy(dest, src, sizeof(*dest));
 
-#ifndef OPENSSL_NO_KRB5
-    dest->krb5_client_princ_len = src->krb5_client_princ_len;
-    if (src->krb5_client_princ_len > 0)
-        memcpy(dest->krb5_client_princ, src->krb5_client_princ,
-               src->krb5_client_princ_len);
+    /*
+     * Set the various pointers to NULL so that we can call SSL_SESSION_free in
+     * the case of an error whilst halfway through constructing dest
+     */
+#ifndef OPENSSL_NO_PSK
+    dest->psk_identity_hint = NULL;
+    dest->psk_identity = NULL;
+#endif
+    dest->ciphers = NULL;
+#ifndef OPENSSL_NO_TLSEXT
+    dest->tlsext_hostname = NULL;
+# ifndef OPENSSL_NO_EC
+    dest->tlsext_ecpointformatlist = NULL;
+    dest->tlsext_ellipticcurvelist = NULL;
+# endif
+#endif
+    dest->tlsext_tick = NULL;
+#ifndef OPENSSL_NO_SRP
+    dest->srp_username = NULL;
 #endif
+    memset(&dest->ex_data, 0, sizeof(dest->ex_data));
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+    dest->references = 1;
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
 
 #ifndef OPENSSL_NO_PSK
     if (src->psk_identity_hint) {
@@ -254,33 +281,19 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         if (dest->psk_identity_hint == NULL) {
             goto err;
         }
-    } else {
-        dest->psk_identity_hint = NULL;
     }
     if (src->psk_identity) {
         dest->psk_identity = BUF_strdup(src->psk_identity);
         if (dest->psk_identity == NULL) {
             goto err;
         }
-    } else {
-        dest->psk_identity = NULL;
     }
 #endif
 
-    if (src->sess_cert != NULL)
-        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
-
-    if (src->peer != NULL)
-        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
-
-    dest->references = 1;
-
     if(src->ciphers != NULL) {
         dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
         if (dest->ciphers == NULL)
             goto err;
-    } else {
-        dest->ciphers = NULL;
     }
 
     if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
@@ -288,18 +301,12 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         goto err;
     }
 
-    /* We deliberately don't copy the prev and next pointers */
-    dest->prev = NULL;
-    dest->next = NULL;
-
 #ifndef OPENSSL_NO_TLSEXT
     if (src->tlsext_hostname) {
         dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
         if (dest->tlsext_hostname == NULL) {
             goto err;
         }
-    } else {
-        dest->tlsext_hostname = NULL;
     }
 # ifndef OPENSSL_NO_EC
     if (src->tlsext_ecpointformatlist) {
@@ -308,8 +315,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
                        src->tlsext_ecpointformatlist_length);
         if (dest->tlsext_ecpointformatlist == NULL)
             goto err;
-        dest->tlsext_ecpointformatlist_length =
-            src->tlsext_ecpointformatlist_length;
     }
     if (src->tlsext_ellipticcurvelist) {
         dest->tlsext_ellipticcurvelist =
@@ -317,29 +322,25 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
                        src->tlsext_ellipticcurvelist_length);
         if (dest->tlsext_ellipticcurvelist == NULL)
             goto err;
-        dest->tlsext_ellipticcurvelist_length =
-            src->tlsext_ellipticcurvelist_length;
     }
 # endif
 #endif
 
     if (ticket != 0) {
-        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
-        dest->tlsext_ticklen = src->tlsext_ticklen;
-        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+        dest->tlsext_tick = BUF_memdup(src->tlsext_tick, src->tlsext_ticklen);
+        if(dest->tlsext_tick == NULL)
             goto err;
-        }
+    } else {
+        dest->tlsext_tick_lifetime_hint = 0;
+        dest->tlsext_ticklen = 0;
     }
 
 #ifndef OPENSSL_NO_SRP
-    dest->srp_username = NULL;
     if (src->srp_username) {
         dest->srp_username = BUF_strdup(src->srp_username);
         if (dest->srp_username == NULL) {
             goto err;
         }
-    } else {
-        dest->srp_username = NULL;
     }
 #endif
 

From matt at openssl.org  Thu Jun 11 09:21:14 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 09:21:14 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1434014474.987221.29658.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  db96b5ab761fb97633dde9aec62c0032743e88f8 (commit)
      from  cb9f1bc1d118bfe17d7c3004bbf33746df1855bd (commit)


- Log -----------------------------------------------------------------
commit db96b5ab761fb97633dde9aec62c0032743e88f8
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 01:30:06 2015 +0100

    More ssl_session_dup fixes
    
    Fix error handling in ssl_session_dup, as well as incorrect setting up of
    the session ticket. Follow on from CVE-2015-1791.
    
    Thanks to LibreSSL project for reporting these issues.
    
    Conflicts:
    	ssl/ssl_sess.c
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 67 +++++++++++++++++++++++++++++-----------------------------
 1 file changed, 34 insertions(+), 33 deletions(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 1fb682a..9fcb632 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -238,12 +238,36 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     }
     memcpy(dest, src, sizeof(*dest));
 
-#ifndef OPENSSL_NO_KRB5
-    dest->krb5_client_princ_len = src->krb5_client_princ_len;
-    if (src->krb5_client_princ_len > 0)
-        memcpy(dest->krb5_client_princ, src->krb5_client_princ,
-               src->krb5_client_princ_len);
+    /*
+     * Set the various pointers to NULL so that we can call SSL_SESSION_free in
+     * the case of an error whilst halfway through constructing dest
+     */
+#ifndef OPENSSL_NO_PSK
+    dest->psk_identity_hint = NULL;
+    dest->psk_identity = NULL;
+#endif
+    dest->ciphers = NULL;
+#ifndef OPENSSL_NO_TLSEXT
+    dest->tlsext_hostname = NULL;
+# ifndef OPENSSL_NO_EC
+    dest->tlsext_ecpointformatlist = NULL;
+    dest->tlsext_ellipticcurvelist = NULL;
+# endif
 #endif
+    dest->tlsext_tick = NULL;
+    memset(&dest->ex_data, 0, sizeof(dest->ex_data));
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+    dest->references = 1;
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
 
 #ifndef OPENSSL_NO_PSK
     if (src->psk_identity_hint) {
@@ -251,33 +275,19 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         if (dest->psk_identity_hint == NULL) {
             goto err;
         }
-    } else {
-        dest->psk_identity_hint = NULL;
     }
     if (src->psk_identity) {
         dest->psk_identity = BUF_strdup(src->psk_identity);
         if (dest->psk_identity == NULL) {
             goto err;
         }
-    } else {
-        dest->psk_identity = NULL;
     }
 #endif
 
-    if (src->sess_cert != NULL)
-        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
-
-    if (src->peer != NULL)
-        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
-
-    dest->references = 1;
-
     if(src->ciphers != NULL) {
         dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
         if (dest->ciphers == NULL)
             goto err;
-    } else {
-        dest->ciphers = NULL;
     }
 
     if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
@@ -285,18 +295,12 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         goto err;
     }
 
-    /* We deliberately don't copy the prev and next pointers */
-    dest->prev = NULL;
-    dest->next = NULL;
-
 #ifndef OPENSSL_NO_TLSEXT
     if (src->tlsext_hostname) {
         dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
         if (dest->tlsext_hostname == NULL) {
             goto err;
         }
-    } else {
-        dest->tlsext_hostname = NULL;
     }
 # ifndef OPENSSL_NO_EC
     if (src->tlsext_ecpointformatlist) {
@@ -305,8 +309,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
                        src->tlsext_ecpointformatlist_length);
         if (dest->tlsext_ecpointformatlist == NULL)
             goto err;
-        dest->tlsext_ecpointformatlist_length =
-            src->tlsext_ecpointformatlist_length;
     }
     if (src->tlsext_ellipticcurvelist) {
         dest->tlsext_ellipticcurvelist =
@@ -314,18 +316,17 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
                        src->tlsext_ellipticcurvelist_length);
         if (dest->tlsext_ellipticcurvelist == NULL)
             goto err;
-        dest->tlsext_ellipticcurvelist_length =
-            src->tlsext_ellipticcurvelist_length;
     }
 # endif
 #endif
 
     if (ticket != 0) {
-        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
-        dest->tlsext_ticklen = src->tlsext_ticklen;
-        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+        dest->tlsext_tick = BUF_memdup(src->tlsext_tick, src->tlsext_ticklen);
+        if(dest->tlsext_tick == NULL)
             goto err;
-        }
+    } else {
+        dest->tlsext_tick_lifetime_hint = 0;
+        dest->tlsext_ticklen = 0;
     }
 
     return dest;

From matt at openssl.org  Thu Jun 11 09:21:04 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 09:21:04 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434014464.917573.29410.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  907f04a30354615e54beaa2bc0b986083f7793ee (commit)
      from  f3b355fec3b38e9f345a226d7defab146f446100 (commit)


- Log -----------------------------------------------------------------
commit 907f04a30354615e54beaa2bc0b986083f7793ee
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 01:30:06 2015 +0100

    More ssl_session_dup fixes
    
    Fix error handling in ssl_session_dup, as well as incorrect setting up of
    the session ticket. Follow on from CVE-2015-1791.
    
    Thanks to LibreSSL project for reporting these issues.
    
    Conflicts:
    	ssl/ssl_sess.c
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 73 +++++++++++++++++++++++++++++-----------------------------
 1 file changed, 37 insertions(+), 36 deletions(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 8325cb3..1ad9dc7 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -241,12 +241,39 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     }
     memcpy(dest, src, sizeof(*dest));
 
-#ifndef OPENSSL_NO_KRB5
-    dest->krb5_client_princ_len = src->krb5_client_princ_len;
-    if (src->krb5_client_princ_len > 0)
-        memcpy(dest->krb5_client_princ, src->krb5_client_princ,
-               src->krb5_client_princ_len);
+    /*
+     * Set the various pointers to NULL so that we can call SSL_SESSION_free in
+     * the case of an error whilst halfway through constructing dest
+     */
+#ifndef OPENSSL_NO_PSK
+    dest->psk_identity_hint = NULL;
+    dest->psk_identity = NULL;
+#endif
+    dest->ciphers = NULL;
+#ifndef OPENSSL_NO_TLSEXT
+    dest->tlsext_hostname = NULL;
+# ifndef OPENSSL_NO_EC
+    dest->tlsext_ecpointformatlist = NULL;
+    dest->tlsext_ellipticcurvelist = NULL;
+# endif
+#endif
+    dest->tlsext_tick = NULL;
+#ifndef OPENSSL_NO_SRP
+    dest->srp_username = NULL;
 #endif
+    memset(&dest->ex_data, 0, sizeof(dest->ex_data));
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+    dest->references = 1;
+
+    if (src->sess_cert != NULL)
+        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
+
+    if (src->peer != NULL)
+        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
 
 #ifndef OPENSSL_NO_PSK
     if (src->psk_identity_hint) {
@@ -254,33 +281,19 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         if (dest->psk_identity_hint == NULL) {
             goto err;
         }
-    } else {
-        dest->psk_identity_hint = NULL;
     }
     if (src->psk_identity) {
         dest->psk_identity = BUF_strdup(src->psk_identity);
         if (dest->psk_identity == NULL) {
             goto err;
         }
-    } else {
-        dest->psk_identity = NULL;
     }
 #endif
 
-    if (src->sess_cert != NULL)
-        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
-
-    if (src->peer != NULL)
-        CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
-
-    dest->references = 1;
-
     if(src->ciphers != NULL) {
         dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
         if (dest->ciphers == NULL)
             goto err;
-    } else {
-        dest->ciphers = NULL;
     }
 
     if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
@@ -288,18 +301,12 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         goto err;
     }
 
-    /* We deliberately don't copy the prev and next pointers */
-    dest->prev = NULL;
-    dest->next = NULL;
-
 #ifndef OPENSSL_NO_TLSEXT
     if (src->tlsext_hostname) {
         dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
         if (dest->tlsext_hostname == NULL) {
             goto err;
         }
-    } else {
-        dest->tlsext_hostname = NULL;
     }
 # ifndef OPENSSL_NO_EC
     if (src->tlsext_ecpointformatlist) {
@@ -308,8 +315,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
                        src->tlsext_ecpointformatlist_length);
         if (dest->tlsext_ecpointformatlist == NULL)
             goto err;
-        dest->tlsext_ecpointformatlist_length =
-            src->tlsext_ecpointformatlist_length;
     }
     if (src->tlsext_ellipticcurvelist) {
         dest->tlsext_ellipticcurvelist =
@@ -317,29 +322,25 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
                        src->tlsext_ellipticcurvelist_length);
         if (dest->tlsext_ellipticcurvelist == NULL)
             goto err;
-        dest->tlsext_ellipticcurvelist_length =
-            src->tlsext_ellipticcurvelist_length;
     }
 # endif
 #endif
 
     if (ticket != 0) {
-        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
-        dest->tlsext_ticklen = src->tlsext_ticklen;
-        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+        dest->tlsext_tick = BUF_memdup(src->tlsext_tick, src->tlsext_ticklen);
+        if(dest->tlsext_tick == NULL)
             goto err;
-        }
+    } else {
+        dest->tlsext_tick_lifetime_hint = 0;
+        dest->tlsext_ticklen = 0;
     }
 
 #ifndef OPENSSL_NO_SRP
-    dest->srp_username = NULL;
     if (src->srp_username) {
         dest->srp_username = BUF_strdup(src->srp_username);
         if (dest->srp_username == NULL) {
             goto err;
         }
-    } else {
-        dest->srp_username = NULL;
     }
 #endif
 

From matt at openssl.org  Thu Jun 11 09:21:27 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 09:21:27 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1434014487.732016.29917.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  39bcfb129e816de00bf2170c3497e8104767beb7 (commit)
      from  50d3049930575f45df11014f6c154e0ae13aa7fe (commit)


- Log -----------------------------------------------------------------
commit 39bcfb129e816de00bf2170c3497e8104767beb7
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 01:30:06 2015 +0100

    More ssl_session_dup fixes
    
    Fix error handling in ssl_session_dup, as well as incorrect setting up of
    the session ticket. Follow on from CVE-2015-1791.
    
    Thanks to LibreSSL project for reporting these issues.
    
    Conflicts:
    	ssl/ssl_sess.c
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 39 ++++++++++++++++++++-------------------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index d3bac0b..e1695ab 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -149,12 +149,22 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     }
     memcpy(dest, src, sizeof(*dest));
 
-#ifndef OPENSSL_NO_KRB5
-    dest->krb5_client_princ_len = src->krb5_client_princ_len;
-    if (src->krb5_client_princ_len > 0)
-        memcpy(dest->krb5_client_princ, src->krb5_client_princ,
-               src->krb5_client_princ_len);
+    /*
+     * Set the various pointers to NULL so that we can call SSL_SESSION_free in
+     * the case of an error whilst halfway through constructing dest
+     */
+    dest->ciphers = NULL;
+#ifndef OPENSSL_NO_TLSEXT
+    dest->tlsext_hostname = NULL;
 #endif
+    dest->tlsext_tick = NULL;
+    memset(&dest->ex_data, 0, sizeof(dest->ex_data));
+
+    /* We deliberately don't copy the prev and next pointers */
+    dest->prev = NULL;
+    dest->next = NULL;
+
+    dest->references = 1;
 
     if (src->sess_cert != NULL)
         CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
@@ -162,14 +172,10 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     if (src->peer != NULL)
         CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
 
-    dest->references = 1;
-
     if(src->ciphers != NULL) {
         dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
         if (dest->ciphers == NULL)
             goto err;
-    } else {
-        dest->ciphers = NULL;
     }
 
     if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
@@ -177,27 +183,22 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         goto err;
     }
 
-    /* We deliberately don't copy the prev and next pointers */
-    dest->prev = NULL;
-    dest->next = NULL;
-
 #ifndef OPENSSL_NO_TLSEXT
     if (src->tlsext_hostname) {
         dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
         if (dest->tlsext_hostname == NULL) {
             goto err;
         }
-    } else {
-        dest->tlsext_hostname = NULL;
     }
 #endif
 
     if (ticket != 0) {
-        dest->tlsext_tick_lifetime_hint = src->tlsext_tick_lifetime_hint;
-        dest->tlsext_ticklen = src->tlsext_ticklen;
-        if((dest->tlsext_tick = OPENSSL_malloc(src->tlsext_ticklen)) == NULL) {
+        dest->tlsext_tick = BUF_memdup(src->tlsext_tick, src->tlsext_ticklen);
+        if(dest->tlsext_tick == NULL)
             goto err;
-        }
+    } else {
+        dest->tlsext_tick_lifetime_hint = 0;
+        dest->tlsext_ticklen = 0;
     }
 
     return dest;

From levitte at openssl.org  Thu Jun 11 13:51:26 2015
From: levitte at openssl.org (Richard Levitte)
Date: Thu, 11 Jun 2015 13:51:26 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434030686.708201.17153.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  8aa556e1c3b49274ccae579cb584eb5b702a3b0e (commit)
       via  5ef5b9ffa91ad6061c42291564a1dc786300ebdd (commit)
      from  d44f89c990b4c9c41f77e9a0ffd5dc7c4ca07f84 (commit)


- Log -----------------------------------------------------------------
commit 8aa556e1c3b49274ccae579cb584eb5b702a3b0e
Author: Richard Levitte <levitte at openssl.org>
Date:   Thu Jun 11 15:42:42 2015 +0200

    make update
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit 5ef5b9ffa91ad6061c42291564a1dc786300ebdd
Author: Richard Levitte <levitte at openssl.org>
Date:   Thu Jun 11 15:41:25 2015 +0200

    Correction of make depend merge error
    
    $(PROGS) was mistakenly removed, adding it back.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/Makefile | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/apps/Makefile b/apps/Makefile
index 64c3baa..cafe554 100644
--- a/apps/Makefile
+++ b/apps/Makefile
@@ -135,7 +135,7 @@ update: openssl-vms.cnf local_depend
 depend: local_depend
 	@if [ -z "$(THIS)" ]; then $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; fi
 local_depend:
-	@[ -z "$(THIS)" ] || $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(SRC); \
+	@[ -z "$(THIS)" ] || $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(SRC); \
 
 dclean:
 	$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
@@ -567,6 +567,28 @@ ocsp.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
 ocsp.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h
 ocsp.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
 ocsp.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h ocsp.c
+openssl.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
+openssl.o: ../include/openssl/buffer.h ../include/openssl/comp.h
+openssl.o: ../include/openssl/conf.h ../include/openssl/crypto.h
+openssl.o: ../include/openssl/dtls1.h ../include/openssl/e_os2.h
+openssl.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
+openssl.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
+openssl.o: ../include/openssl/err.h ../include/openssl/evp.h
+openssl.o: ../include/openssl/hmac.h ../include/openssl/kssl.h
+openssl.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+openssl.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
+openssl.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+openssl.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
+openssl.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
+openssl.o: ../include/openssl/pqueue.h ../include/openssl/rand.h
+openssl.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+openssl.o: ../include/openssl/srtp.h ../include/openssl/ssl.h
+openssl.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
+openssl.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
+openssl.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h
+openssl.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
+openssl.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h
+openssl.o: openssl.c progs.h s_apps.h
 passwd.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 passwd.o: ../include/openssl/buffer.h ../include/openssl/conf.h
 passwd.o: ../include/openssl/crypto.h ../include/openssl/des.h

From levitte at openssl.org  Thu Jun 11 13:53:19 2015
From: levitte at openssl.org (Richard Levitte)
Date: Thu, 11 Jun 2015 13:53:19 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434030799.205516.17749.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  176b59d157d1cbfd0b10f9f7be12eaf9896410f2 (commit)
      from  907f04a30354615e54beaa2bc0b986083f7793ee (commit)


- Log -----------------------------------------------------------------
commit 176b59d157d1cbfd0b10f9f7be12eaf9896410f2
Author: Richard Levitte <levitte at openssl.org>
Date:   Thu Jun 11 15:41:25 2015 +0200

    Correction of make depend merge error
    
    $(PROGS) was mistakenly removed, adding it back.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 5ef5b9ffa91ad6061c42291564a1dc786300ebdd)

-----------------------------------------------------------------------

Summary of changes:
 apps/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/Makefile b/apps/Makefile
index a2c1565..cafe554 100644
--- a/apps/Makefile
+++ b/apps/Makefile
@@ -135,7 +135,7 @@ update: openssl-vms.cnf local_depend
 depend: local_depend
 	@if [ -z "$(THIS)" ]; then $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; fi
 local_depend:
-	@[ -z "$(THIS)" ] || $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(SRC); \
+	@[ -z "$(THIS)" ] || $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(SRC); \
 
 dclean:
 	$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new

From levitte at openssl.org  Thu Jun 11 13:55:02 2015
From: levitte at openssl.org (Richard Levitte)
Date: Thu, 11 Jun 2015 13:55:02 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1434030902.153099.18057.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  809bf2eab7b46e2fd768fec0c28127991c927b19 (commit)
      from  db96b5ab761fb97633dde9aec62c0032743e88f8 (commit)


- Log -----------------------------------------------------------------
commit 809bf2eab7b46e2fd768fec0c28127991c927b19
Author: Richard Levitte <levitte at openssl.org>
Date:   Thu Jun 11 15:41:25 2015 +0200

    Correction of make depend merge error
    
    $(PROGS) was mistakenly removed, adding it back.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 5ef5b9ffa91ad6061c42291564a1dc786300ebdd)

-----------------------------------------------------------------------

Summary of changes:
 apps/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/Makefile b/apps/Makefile
index 863144c..636f2eb 100644
--- a/apps/Makefile
+++ b/apps/Makefile
@@ -135,7 +135,7 @@ update: openssl-vms.cnf local_depend
 depend: local_depend
 	@if [ -z "$(THIS)" ]; then $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; fi
 local_depend:
-	@[ -z "$(THIS)" ] || $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(SRC); \
+	@[ -z "$(THIS)" ] || $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(SRC); \
 
 dclean:
 	$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new

From matt at openssl.org  Thu Jun 11 14:39:07 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:39:07 +0000
Subject: [openssl-commits] [web]  master update
Message-ID: <1434033547.695143.29945.nullmailer@dev.openssl.org>

The branch master has been updated
       via  ad1b4eeeeb7c92e089bb0e7db0ef9041433f5a28 (commit)
      from  f7dd814fc51f0d7968805efb5f0df4ffbe546ab3 (commit)


- Log -----------------------------------------------------------------
commit ad1b4eeeeb7c92e089bb0e7db0ef9041433f5a28
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 15:33:28 2015 +0100

    Updates for new release

-----------------------------------------------------------------------

Summary of changes:
 news/newsflash.txt       |   5 +
 news/secadv_20150611.txt | 186 +++++++++++++++++++
 news/vulnerabilities.xml | 467 ++++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 657 insertions(+), 1 deletion(-)
 create mode 100644 news/secadv_20150611.txt

diff --git a/news/newsflash.txt b/news/newsflash.txt
index 889b480..72c9804 100644
--- a/news/newsflash.txt
+++ b/news/newsflash.txt
@@ -1,3 +1,8 @@
+11-Jun-2015: <a href="ROOT/news/secadv_20150611.txt">Security Advisory</a>: five security fixes
+11-Jun-2015: OpenSSL 1.0.2b is now <a href="ROOT/source/">available</a>, including bug and security fixes
+11-Jun-2015: OpenSSL 1.0.1n is now <a href="ROOT/source/">available</a>, including bug and security fixes
+11-Jun-2015: OpenSSL 1.0.0s is now <a href="ROOT/source/">available</a>, including bug and security fixes
+11-Jun-2015: OpenSSL 0.9.8zg is now <a href="ROOT/source/">available</a>, including bug and security fixes
 19-Mar-2015: <a href="ROOT/news/secadv_20150319.txt">Security Advisory</a>: twelve security fixes
 19-Mar-2015: OpenSSL 1.0.2a is now <a href="ROOT/source/">available</a>, including bug and security fixes
 19-Mar-2015: OpenSSL 1.0.1m is now <a href="ROOT/source/">available</a>, including bug and security fixes
diff --git a/news/secadv_20150611.txt b/news/secadv_20150611.txt
new file mode 100644
index 0000000..2b23648
--- /dev/null
+++ b/news/secadv_20150611.txt
@@ -0,0 +1,186 @@
+OpenSSL Security Advisory [11 Jun 2015]
+=======================================
+
+DHE man-in-the-middle protection (Logjam)
+====================================================================
+
+A vulnerability in the TLS protocol allows a man-in-the-middle
+attacker to downgrade vulnerable TLS connections using ephemeral
+Diffie-Hellman key exchange to 512-bit export-grade cryptography. This
+vulnerability is known as Logjam (CVE-2015-4000).
+
+OpenSSL has added protection for TLS clients by rejecting handshakes
+with DH parameters shorter than 768 bits. This limit will be increased
+to 1024 bits in a future release.
+
+OpenSSL 1.0.2 users should upgrade to 1.0.2b
+OpenSSL 1.0.1 users should upgrade to 1.0.1n
+
+Fixes for this issue were developed by Emilia K?sper and Kurt Roeckx
+of the OpenSSL development team.
+
+Malformed ECParameters causes infinite loop (CVE-2015-1788)
+===========================================================
+
+Severity: Moderate
+
+When processing an ECParameters structure OpenSSL enters an infinite loop if
+the curve specified is over a specially malformed binary polynomial field.
+
+This can be used to perform denial of service against any
+system which processes public keys, certificate requests or
+certificates.  This includes TLS clients and TLS servers with
+client authentication enabled.
+
+This issue affects OpenSSL versions: 1.0.2 and 1.0.1. Recent
+1.0.0 and 0.9.8 versions are not affected. 1.0.0d and 0.9.8r and below are
+affected.
+
+OpenSSL 1.0.2 users should upgrade to 1.0.2b
+OpenSSL 1.0.1 users should upgrade to 1.0.1n
+OpenSSL 1.0.0d (and below) users should upgrade to 1.0.0s
+OpenSSL 0.9.8r (and below) users should upgrade to 0.9.8zg
+
+This issue was reported to OpenSSL on 6th April 2015 by Joseph Birr-Pixton. The
+fix was developed by Andy Polyakov of the OpenSSL development team.
+
+Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
+===============================================================
+
+Severity: Moderate
+
+X509_cmp_time does not properly check the length of the ASN1_TIME
+string and can read a few bytes out of bounds. In addition,
+X509_cmp_time accepts an arbitrary number of fractional seconds in the
+time string.
+
+An attacker can use this to craft malformed certificates and CRLs of
+various sizes and potentially cause a segmentation fault, resulting in
+a DoS on applications that verify certificates or CRLs. TLS clients
+that verify CRLs are affected. TLS clients and servers with client
+authentication enabled may be affected if they use custom verification
+callbacks.
+
+This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
+
+OpenSSL 1.0.2 users should upgrade to 1.0.2b
+OpenSSL 1.0.1 users should upgrade to 1.0.1n
+OpenSSL 1.0.0 users should upgrade to 1.0.0s
+OpenSSL 0.9.8 users should upgrade to 0.9.8zg
+
+This issue was reported to OpenSSL on 8th April 2015 by Robert Swiecki
+(Google), and independently on 11th April 2015 by Hanno B?ck. The fix
+was developed by Emilia K?sper of the OpenSSL development team.
+
+PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
+=========================================================
+
+Severity: Moderate
+
+The PKCS#7 parsing code does not handle missing inner EncryptedContent
+correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
+with missing content and trigger a NULL pointer dereference on parsing.
+
+Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
+structures from untrusted sources are affected. OpenSSL clients and
+servers are not affected.
+
+This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
+
+OpenSSL 1.0.2 users should upgrade to 1.0.2b
+OpenSSL 1.0.1 users should upgrade to 1.0.1n
+OpenSSL 1.0.0 users should upgrade to 1.0.0s
+OpenSSL 0.9.8 users should upgrade to 0.9.8zg
+
+This issue was reported to OpenSSL on 18th April 2015 by  Michal
+Zalewski (Google). The fix was developed by Emilia K?sper of the
+OpenSSL development team.
+
+CMS verify infinite loop with unknown hash function (CVE-2015-1792)
+===================================================================
+
+Severity: Moderate
+
+When verifying a signedData message the CMS code can enter an infinite loop
+if presented with an unknown hash function OID.
+
+This can be used to perform denial of service against any system which
+verifies signedData messages using the CMS code.
+
+This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
+
+OpenSSL 1.0.2 users should upgrade to 1.0.2b
+OpenSSL 1.0.1 users should upgrade to 1.0.1n
+OpenSSL 1.0.0 users should upgrade to 1.0.0s
+OpenSSL 0.9.8 users should upgrade to 0.9.8zg
+
+This issue was reported to OpenSSL on 31st March 2015 by Johannes Bauer. The
+fix was developed by Dr. Stephen Henson of the OpenSSL development team.
+
+Race condition handling NewSessionTicket (CVE-2015-1791)
+========================================================
+
+Severity: Low
+
+If a NewSessionTicket is received by a multi-threaded client when attempting to
+reuse a previous ticket then a race condition can occur potentially leading to
+a double free of the ticket data.
+
+This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
+
+OpenSSL 1.0.2 users should upgrade to 1.0.2b
+OpenSSL 1.0.1 users should upgrade to 1.0.1n
+OpenSSL 1.0.0 users should upgrade to 1.0.0s
+OpenSSL 0.9.8 users should upgrade to 0.9.8zg
+
+This issue was discovered by Emilia K?sper of the OpenSSL development team. The
+fix was developed by Matt Caswell of the OpenSSL development team.
+
+Invalid free in DTLS (CVE-2014-8176)
+====================================
+
+Severity: Moderate
+
+This vulnerability does not affect current versions of OpenSSL. It
+existed in previous OpenSSL versions and was fixed in June 2014.
+
+If a DTLS peer receives application data between the ChangeCipherSpec
+and Finished messages, buffering of such data may cause an invalid
+free, resulting in a segmentation fault or potentially, memory
+corruption.
+
+This issue affected older OpenSSL versions 1.0.1, 1.0.0 and 0.9.8.
+
+OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8za
+OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0m.
+OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1h.
+
+This issue was originally reported on March 28th 2014 in
+https://rt.openssl.org/Ticket/Display.html?id=3286 by Praveen
+Kariyanahalli, and subsequently by Ivan Fratric and Felix Groebert
+(Google). A fix was developed by zhu qun-ying.
+
+The fix for this issue can be identified by commits bcc31166 (1.0.1),
+b79e6e3a (1.0.0) and 4b258e73 (0.9.8).
+
+Note
+====
+
+As per our previous announcements and our Release Strategy
+(https://www.openssl.org/about/releasestrat.html), support for OpenSSL versions
+1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these
+releases will be provided after that date. Users of these releases are advised
+to upgrade.
+
+References
+==========
+
+URL for this Security Advisory:
+https://www.openssl.org/news/secadv_20150611.txt
+
+Note: the online version of the advisory may be updated with additional
+details over time.
+
+For details of OpenSSL severity classifications please see:
+https://www.openssl.org/about/secpolicy.html
+
diff --git a/news/vulnerabilities.xml b/news/vulnerabilities.xml
index 2c907c9..a222fba 100644
--- a/news/vulnerabilities.xml
+++ b/news/vulnerabilities.xml
@@ -5,7 +5,472 @@
      1.0.0 on 20100329
 -->
 
-<security updated="20150319">
+<security updated="20150611">
+  <issue public="20150611">
+    <cve name="CVE-2015-1788"/>
+    <affects base="0.9.8" version="0.9.8"/>
+    <affects base="0.9.8" version="0.9.8a"/>
+    <affects base="0.9.8" version="0.9.8b"/>
+    <affects base="0.9.8" version="0.9.8c"/>
+    <affects base="0.9.8" version="0.9.8d"/>
+    <affects base="0.9.8" version="0.9.8e"/>
+    <affects base="0.9.8" version="0.9.8f"/>
+    <affects base="0.9.8" version="0.9.8g"/>
+    <affects base="0.9.8" version="0.9.8h"/>
+    <affects base="0.9.8" version="0.9.8i"/>
+    <affects base="0.9.8" version="0.9.8j"/>
+    <affects base="0.9.8" version="0.9.8k"/>
+    <affects base="0.9.8" version="0.9.8l"/>
+    <affects base="0.9.8" version="0.9.8m"/>
+    <affects base="0.9.8" version="0.9.8n"/>
+    <affects base="0.9.8" version="0.9.8o"/>
+    <affects base="0.9.8" version="0.9.8p"/>
+    <affects base="0.9.8" version="0.9.8q"/>
+    <affects base="0.9.8" version="0.9.8r"/>
+    <affects base="1.0.0" version="1.0.0"/>
+    <affects base="1.0.0" version="1.0.0a"/>
+    <affects base="1.0.0" version="1.0.0b"/>
+    <affects base="1.0.0" version="1.0.0c"/>
+    <affects base="1.0.0" version="1.0.0d"/>
+    <affects base="1.0.1" version="1.0.1"/>
+    <affects base="1.0.1" version="1.0.1a"/>
+    <affects base="1.0.1" version="1.0.1b"/>
+    <affects base="1.0.1" version="1.0.1c"/>
+    <affects base="1.0.1" version="1.0.1d"/>
+    <affects base="1.0.1" version="1.0.1e"/>
+    <affects base="1.0.1" version="1.0.1f"/>
+    <affects base="1.0.1" version="1.0.1g"/>
+    <affects base="1.0.1" version="1.0.1h"/>
+    <affects base="1.0.1" version="1.0.1i"/>
+    <affects base="1.0.1" version="1.0.1j"/>
+    <affects base="1.0.1" version="1.0.1k"/>
+    <affects base="1.0.1" version="1.0.1l"/>
+    <affects base="1.0.1" version="1.0.1m"/>
+    <affects base="1.0.2" version="1.0.2"/>
+    <affects base="1.0.2" version="1.0.2a"/>
+    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
+    <fixed base="1.0.0" version="1.0.0e" date="20110906"/>
+    <fixed base="0.9.8" version="0.9.8s" date="20120104"/>
+
+    <description>
+      When processing an ECParameters structure OpenSSL enters an infinite loop if
+      the curve specified is over a specially malformed binary polynomial field.
+
+      This can be used to perform denial of service against any
+      system which processes public keys, certificate requests or
+      certificates.  This includes TLS clients and TLS servers with
+      client authentication enabled.
+    </description>
+    <advisory url="http://www.openssl.org/news/secadv_20150611.txt"/>
+    <reported source="Joseph Birr-Pixton"/>
+  </issue>
+
+  <issue public="20150611">
+    <cve name="CVE-2015-1789"/>
+    <affects base="0.9.8" version="0.9.8"/>
+    <affects base="0.9.8" version="0.9.8a"/>
+    <affects base="0.9.8" version="0.9.8b"/>
+    <affects base="0.9.8" version="0.9.8c"/>
+    <affects base="0.9.8" version="0.9.8d"/>
+    <affects base="0.9.8" version="0.9.8e"/>
+    <affects base="0.9.8" version="0.9.8f"/>
+    <affects base="0.9.8" version="0.9.8g"/>
+    <affects base="0.9.8" version="0.9.8h"/>
+    <affects base="0.9.8" version="0.9.8i"/>
+    <affects base="0.9.8" version="0.9.8j"/>
+    <affects base="0.9.8" version="0.9.8k"/>
+    <affects base="0.9.8" version="0.9.8l"/>
+    <affects base="0.9.8" version="0.9.8m"/>
+    <affects base="0.9.8" version="0.9.8n"/>
+    <affects base="0.9.8" version="0.9.8o"/>
+    <affects base="0.9.8" version="0.9.8p"/>
+    <affects base="0.9.8" version="0.9.8q"/>
+    <affects base="0.9.8" version="0.9.8r"/>
+    <affects base="0.9.8" version="0.9.8s"/>
+    <affects base="0.9.8" version="0.9.8t"/>
+    <affects base="0.9.8" version="0.9.8u"/>
+    <affects base="0.9.8" version="0.9.8v"/>
+    <affects base="0.9.8" version="0.9.8w"/>
+    <affects base="0.9.8" version="0.9.8x"/>
+    <affects base="0.9.8" version="0.9.8y"/>
+    <affects base="0.9.8" version="0.9.8za"/>
+    <affects base="0.9.8" version="0.9.8zb"/>
+    <affects base="0.9.8" version="0.9.8zc"/>
+    <affects base="0.9.8" version="0.9.8zd"/>
+    <affects base="0.9.8" version="0.9.8ze"/>
+    <affects base="0.9.8" version="0.9.8zf"/>
+    <affects base="1.0.0" version="1.0.0"/>
+    <affects base="1.0.0" version="1.0.0a"/>
+    <affects base="1.0.0" version="1.0.0b"/>
+    <affects base="1.0.0" version="1.0.0c"/>
+    <affects base="1.0.0" version="1.0.0d"/>
+    <affects base="1.0.0" version="1.0.0e"/>
+    <affects base="1.0.0" version="1.0.0f"/>
+    <affects base="1.0.0" version="1.0.0g"/>
+    <affects base="1.0.0" version="1.0.0i"/>
+    <affects base="1.0.0" version="1.0.0j"/>
+    <affects base="1.0.0" version="1.0.0k"/>
+    <affects base="1.0.0" version="1.0.0l"/>
+    <affects base="1.0.0" version="1.0.0m"/>
+    <affects base="1.0.0" version="1.0.0n"/>
+    <affects base="1.0.0" version="1.0.0o"/>
+    <affects base="1.0.0" version="1.0.0p"/>
+    <affects base="1.0.0" version="1.0.0q"/>
+    <affects base="1.0.0" version="1.0.0r"/>
+    <affects base="1.0.1" version="1.0.1"/>
+    <affects base="1.0.1" version="1.0.1a"/>
+    <affects base="1.0.1" version="1.0.1b"/>
+    <affects base="1.0.1" version="1.0.1c"/>
+    <affects base="1.0.1" version="1.0.1d"/>
+    <affects base="1.0.1" version="1.0.1e"/>
+    <affects base="1.0.1" version="1.0.1f"/>
+    <affects base="1.0.1" version="1.0.1g"/>
+    <affects base="1.0.1" version="1.0.1h"/>
+    <affects base="1.0.1" version="1.0.1i"/>
+    <affects base="1.0.1" version="1.0.1j"/>
+    <affects base="1.0.1" version="1.0.1k"/>
+    <affects base="1.0.1" version="1.0.1l"/>
+    <affects base="1.0.1" version="1.0.1m"/>
+    <affects base="1.0.2" version="1.0.2"/>
+    <affects base="1.0.2" version="1.0.2a"/>
+    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
+    <fixed base="1.0.0" version="1.0.0s" date="20150611"/>
+    <fixed base="0.9.8" version="0.9.8zg" date="20150611"/>
+
+    <description>
+      X509_cmp_time does not properly check the length of the ASN1_TIME
+      string and can read a few bytes out of bounds. In addition,
+      X509_cmp_time accepts an arbitrary number of fractional seconds in the
+      time string.
+
+      An attacker can use this to craft malformed certificates and CRLs of
+      various sizes and potentially cause a segmentation fault, resulting in
+      a DoS on applications that verify certificates or CRLs. TLS clients
+      that verify CRLs are affected. TLS clients and servers with client
+      authentication enabled may be affected if they use custom verification
+      callbacks.
+    </description>
+    <advisory url="http://www.openssl.org/news/secadv_20150611.txt"/>
+    <reported source="Robert Swiecki (Google) and (independently) Hanno B?ck"/>
+  </issue>
+
+  <issue public="20150611">
+    <cve name="CVE-2015-1790"/>
+    <affects base="0.9.8" version="0.9.8"/>
+    <affects base="0.9.8" version="0.9.8a"/>
+    <affects base="0.9.8" version="0.9.8b"/>
+    <affects base="0.9.8" version="0.9.8c"/>
+    <affects base="0.9.8" version="0.9.8d"/>
+    <affects base="0.9.8" version="0.9.8e"/>
+    <affects base="0.9.8" version="0.9.8f"/>
+    <affects base="0.9.8" version="0.9.8g"/>
+    <affects base="0.9.8" version="0.9.8h"/>
+    <affects base="0.9.8" version="0.9.8i"/>
+    <affects base="0.9.8" version="0.9.8j"/>
+    <affects base="0.9.8" version="0.9.8k"/>
+    <affects base="0.9.8" version="0.9.8l"/>
+    <affects base="0.9.8" version="0.9.8m"/>
+    <affects base="0.9.8" version="0.9.8n"/>
+    <affects base="0.9.8" version="0.9.8o"/>
+    <affects base="0.9.8" version="0.9.8p"/>
+    <affects base="0.9.8" version="0.9.8q"/>
+    <affects base="0.9.8" version="0.9.8r"/>
+    <affects base="0.9.8" version="0.9.8s"/>
+    <affects base="0.9.8" version="0.9.8t"/>
+    <affects base="0.9.8" version="0.9.8u"/>
+    <affects base="0.9.8" version="0.9.8v"/>
+    <affects base="0.9.8" version="0.9.8w"/>
+    <affects base="0.9.8" version="0.9.8x"/>
+    <affects base="0.9.8" version="0.9.8y"/>
+    <affects base="0.9.8" version="0.9.8za"/>
+    <affects base="0.9.8" version="0.9.8zb"/>
+    <affects base="0.9.8" version="0.9.8zc"/>
+    <affects base="0.9.8" version="0.9.8zd"/>
+    <affects base="0.9.8" version="0.9.8ze"/>
+    <affects base="0.9.8" version="0.9.8zf"/>
+    <affects base="1.0.0" version="1.0.0"/>
+    <affects base="1.0.0" version="1.0.0a"/>
+    <affects base="1.0.0" version="1.0.0b"/>
+    <affects base="1.0.0" version="1.0.0c"/>
+    <affects base="1.0.0" version="1.0.0d"/>
+    <affects base="1.0.0" version="1.0.0e"/>
+    <affects base="1.0.0" version="1.0.0f"/>
+    <affects base="1.0.0" version="1.0.0g"/>
+    <affects base="1.0.0" version="1.0.0i"/>
+    <affects base="1.0.0" version="1.0.0j"/>
+    <affects base="1.0.0" version="1.0.0k"/>
+    <affects base="1.0.0" version="1.0.0l"/>
+    <affects base="1.0.0" version="1.0.0m"/>
+    <affects base="1.0.0" version="1.0.0n"/>
+    <affects base="1.0.0" version="1.0.0o"/>
+    <affects base="1.0.0" version="1.0.0p"/>
+    <affects base="1.0.0" version="1.0.0q"/>
+    <affects base="1.0.0" version="1.0.0r"/>
+    <affects base="1.0.1" version="1.0.1"/>
+    <affects base="1.0.1" version="1.0.1a"/>
+    <affects base="1.0.1" version="1.0.1b"/>
+    <affects base="1.0.1" version="1.0.1c"/>
+    <affects base="1.0.1" version="1.0.1d"/>
+    <affects base="1.0.1" version="1.0.1e"/>
+    <affects base="1.0.1" version="1.0.1f"/>
+    <affects base="1.0.1" version="1.0.1g"/>
+    <affects base="1.0.1" version="1.0.1h"/>
+    <affects base="1.0.1" version="1.0.1i"/>
+    <affects base="1.0.1" version="1.0.1j"/>
+    <affects base="1.0.1" version="1.0.1k"/>
+    <affects base="1.0.1" version="1.0.1l"/>
+    <affects base="1.0.1" version="1.0.1m"/>
+    <affects base="1.0.2" version="1.0.2"/>
+    <affects base="1.0.2" version="1.0.2a"/>
+    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
+    <fixed base="1.0.0" version="1.0.0s" date="20150611"/>
+    <fixed base="0.9.8" version="0.9.8zg" date="20150611"/>
+
+    <description>
+      The PKCS#7 parsing code does not handle missing inner EncryptedContent
+      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
+      with missing content and trigger a NULL pointer dereference on parsing.
+
+      Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
+      structures from untrusted sources are affected. OpenSSL clients and
+      servers are not affected.
+    </description>
+    <advisory url="http://www.openssl.org/news/secadv_20150611.txt"/>
+    <reported source="Michal Zalewski (Google)"/>
+  </issue>
+
+  <issue public="20150611">
+    <cve name="CVE-2015-1792"/>
+    <affects base="0.9.8" version="0.9.8"/>
+    <affects base="0.9.8" version="0.9.8a"/>
+    <affects base="0.9.8" version="0.9.8b"/>
+    <affects base="0.9.8" version="0.9.8c"/>
+    <affects base="0.9.8" version="0.9.8d"/>
+    <affects base="0.9.8" version="0.9.8e"/>
+    <affects base="0.9.8" version="0.9.8f"/>
+    <affects base="0.9.8" version="0.9.8g"/>
+    <affects base="0.9.8" version="0.9.8h"/>
+    <affects base="0.9.8" version="0.9.8i"/>
+    <affects base="0.9.8" version="0.9.8j"/>
+    <affects base="0.9.8" version="0.9.8k"/>
+    <affects base="0.9.8" version="0.9.8l"/>
+    <affects base="0.9.8" version="0.9.8m"/>
+    <affects base="0.9.8" version="0.9.8n"/>
+    <affects base="0.9.8" version="0.9.8o"/>
+    <affects base="0.9.8" version="0.9.8p"/>
+    <affects base="0.9.8" version="0.9.8q"/>
+    <affects base="0.9.8" version="0.9.8r"/>
+    <affects base="0.9.8" version="0.9.8s"/>
+    <affects base="0.9.8" version="0.9.8t"/>
+    <affects base="0.9.8" version="0.9.8u"/>
+    <affects base="0.9.8" version="0.9.8v"/>
+    <affects base="0.9.8" version="0.9.8w"/>
+    <affects base="0.9.8" version="0.9.8x"/>
+    <affects base="0.9.8" version="0.9.8y"/>
+    <affects base="0.9.8" version="0.9.8za"/>
+    <affects base="0.9.8" version="0.9.8zb"/>
+    <affects base="0.9.8" version="0.9.8zc"/>
+    <affects base="0.9.8" version="0.9.8zd"/>
+    <affects base="0.9.8" version="0.9.8ze"/>
+    <affects base="0.9.8" version="0.9.8zf"/>
+    <affects base="1.0.0" version="1.0.0"/>
+    <affects base="1.0.0" version="1.0.0a"/>
+    <affects base="1.0.0" version="1.0.0b"/>
+    <affects base="1.0.0" version="1.0.0c"/>
+    <affects base="1.0.0" version="1.0.0d"/>
+    <affects base="1.0.0" version="1.0.0e"/>
+    <affects base="1.0.0" version="1.0.0f"/>
+    <affects base="1.0.0" version="1.0.0g"/>
+    <affects base="1.0.0" version="1.0.0i"/>
+    <affects base="1.0.0" version="1.0.0j"/>
+    <affects base="1.0.0" version="1.0.0k"/>
+    <affects base="1.0.0" version="1.0.0l"/>
+    <affects base="1.0.0" version="1.0.0m"/>
+    <affects base="1.0.0" version="1.0.0n"/>
+    <affects base="1.0.0" version="1.0.0o"/>
+    <affects base="1.0.0" version="1.0.0p"/>
+    <affects base="1.0.0" version="1.0.0q"/>
+    <affects base="1.0.0" version="1.0.0r"/>
+    <affects base="1.0.1" version="1.0.1"/>
+    <affects base="1.0.1" version="1.0.1a"/>
+    <affects base="1.0.1" version="1.0.1b"/>
+    <affects base="1.0.1" version="1.0.1c"/>
+    <affects base="1.0.1" version="1.0.1d"/>
+    <affects base="1.0.1" version="1.0.1e"/>
+    <affects base="1.0.1" version="1.0.1f"/>
+    <affects base="1.0.1" version="1.0.1g"/>
+    <affects base="1.0.1" version="1.0.1h"/>
+    <affects base="1.0.1" version="1.0.1i"/>
+    <affects base="1.0.1" version="1.0.1j"/>
+    <affects base="1.0.1" version="1.0.1k"/>
+    <affects base="1.0.1" version="1.0.1l"/>
+    <affects base="1.0.1" version="1.0.1m"/>
+    <affects base="1.0.2" version="1.0.2"/>
+    <affects base="1.0.2" version="1.0.2a"/>
+    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
+    <fixed base="1.0.0" version="1.0.0s" date="20150611"/>
+    <fixed base="0.9.8" version="0.9.8zg" date="20150611"/>
+
+    <description>
+      When verifying a signedData message the CMS code can enter an infinite loop
+      if presented with an unknown hash function OID.
+
+      This can be used to perform denial of service against any system which
+      verifies signedData messages using the CMS code.
+    </description>
+    <advisory url="http://www.openssl.org/news/secadv_20150611.txt"/>
+    <reported source="Johannes Bauer"/>
+  </issue>
+
+  <issue public="20150602">
+    <cve name="CVE-2015-1791"/>
+    <affects base="0.9.8" version="0.9.8"/>
+    <affects base="0.9.8" version="0.9.8a"/>
+    <affects base="0.9.8" version="0.9.8b"/>
+    <affects base="0.9.8" version="0.9.8c"/>
+    <affects base="0.9.8" version="0.9.8d"/>
+    <affects base="0.9.8" version="0.9.8e"/>
+    <affects base="0.9.8" version="0.9.8f"/>
+    <affects base="0.9.8" version="0.9.8g"/>
+    <affects base="0.9.8" version="0.9.8h"/>
+    <affects base="0.9.8" version="0.9.8i"/>
+    <affects base="0.9.8" version="0.9.8j"/>
+    <affects base="0.9.8" version="0.9.8k"/>
+    <affects base="0.9.8" version="0.9.8l"/>
+    <affects base="0.9.8" version="0.9.8m"/>
+    <affects base="0.9.8" version="0.9.8n"/>
+    <affects base="0.9.8" version="0.9.8o"/>
+    <affects base="0.9.8" version="0.9.8p"/>
+    <affects base="0.9.8" version="0.9.8q"/>
+    <affects base="0.9.8" version="0.9.8r"/>
+    <affects base="0.9.8" version="0.9.8s"/>
+    <affects base="0.9.8" version="0.9.8t"/>
+    <affects base="0.9.8" version="0.9.8u"/>
+    <affects base="0.9.8" version="0.9.8v"/>
+    <affects base="0.9.8" version="0.9.8w"/>
+    <affects base="0.9.8" version="0.9.8x"/>
+    <affects base="0.9.8" version="0.9.8y"/>
+    <affects base="0.9.8" version="0.9.8za"/>
+    <affects base="0.9.8" version="0.9.8zb"/>
+    <affects base="0.9.8" version="0.9.8zc"/>
+    <affects base="0.9.8" version="0.9.8zd"/>
+    <affects base="0.9.8" version="0.9.8ze"/>
+    <affects base="0.9.8" version="0.9.8zf"/>
+    <affects base="1.0.0" version="1.0.0"/>
+    <affects base="1.0.0" version="1.0.0a"/>
+    <affects base="1.0.0" version="1.0.0b"/>
+    <affects base="1.0.0" version="1.0.0c"/>
+    <affects base="1.0.0" version="1.0.0d"/>
+    <affects base="1.0.0" version="1.0.0e"/>
+    <affects base="1.0.0" version="1.0.0f"/>
+    <affects base="1.0.0" version="1.0.0g"/>
+    <affects base="1.0.0" version="1.0.0i"/>
+    <affects base="1.0.0" version="1.0.0j"/>
+    <affects base="1.0.0" version="1.0.0k"/>
+    <affects base="1.0.0" version="1.0.0l"/>
+    <affects base="1.0.0" version="1.0.0m"/>
+    <affects base="1.0.0" version="1.0.0n"/>
+    <affects base="1.0.0" version="1.0.0o"/>
+    <affects base="1.0.0" version="1.0.0p"/>
+    <affects base="1.0.0" version="1.0.0q"/>
+    <affects base="1.0.0" version="1.0.0r"/>
+    <affects base="1.0.1" version="1.0.1"/>
+    <affects base="1.0.1" version="1.0.1a"/>
+    <affects base="1.0.1" version="1.0.1b"/>
+    <affects base="1.0.1" version="1.0.1c"/>
+    <affects base="1.0.1" version="1.0.1d"/>
+    <affects base="1.0.1" version="1.0.1e"/>
+    <affects base="1.0.1" version="1.0.1f"/>
+    <affects base="1.0.1" version="1.0.1g"/>
+    <affects base="1.0.1" version="1.0.1h"/>
+    <affects base="1.0.1" version="1.0.1i"/>
+    <affects base="1.0.1" version="1.0.1j"/>
+    <affects base="1.0.1" version="1.0.1k"/>
+    <affects base="1.0.1" version="1.0.1l"/>
+    <affects base="1.0.1" version="1.0.1m"/>
+    <affects base="1.0.2" version="1.0.2"/>
+    <affects base="1.0.2" version="1.0.2a"/>
+    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
+    <fixed base="1.0.0" version="1.0.0s" date="20150611"/>
+    <fixed base="0.9.8" version="0.9.8zg" date="20150611"/>
+
+    <description>
+      If a NewSessionTicket is received by a multi-threaded client when attempting to
+      reuse a previous ticket then a race condition can occur potentially leading to
+      a double free of the ticket data.
+    </description>
+    <advisory url="http://www.openssl.org/news/secadv_20150611.txt"/>
+    <reported source="Emilia K?sper (OpenSSL)"/>
+  </issue>
+
+  <issue public="20150611">
+    <cve name="CVE-2014-8176"/>
+    <affects base="0.9.8" version="0.9.8"/>
+    <affects base="0.9.8" version="0.9.8a"/>
+    <affects base="0.9.8" version="0.9.8b"/>
+    <affects base="0.9.8" version="0.9.8c"/>
+    <affects base="0.9.8" version="0.9.8d"/>
+    <affects base="0.9.8" version="0.9.8e"/>
+    <affects base="0.9.8" version="0.9.8f"/>
+    <affects base="0.9.8" version="0.9.8g"/>
+    <affects base="0.9.8" version="0.9.8h"/>
+    <affects base="0.9.8" version="0.9.8i"/>
+    <affects base="0.9.8" version="0.9.8j"/>
+    <affects base="0.9.8" version="0.9.8k"/>
+    <affects base="0.9.8" version="0.9.8l"/>
+    <affects base="0.9.8" version="0.9.8m"/>
+    <affects base="0.9.8" version="0.9.8n"/>
+    <affects base="0.9.8" version="0.9.8o"/>
+    <affects base="0.9.8" version="0.9.8p"/>
+    <affects base="0.9.8" version="0.9.8q"/>
+    <affects base="0.9.8" version="0.9.8r"/>
+    <affects base="0.9.8" version="0.9.8s"/>
+    <affects base="0.9.8" version="0.9.8t"/>
+    <affects base="0.9.8" version="0.9.8u"/>
+    <affects base="0.9.8" version="0.9.8v"/>
+    <affects base="0.9.8" version="0.9.8w"/>
+    <affects base="0.9.8" version="0.9.8x"/>
+    <affects base="0.9.8" version="0.9.8y"/>
+    <affects base="1.0.0" version="1.0.0"/>
+    <affects base="1.0.0" version="1.0.0a"/>
+    <affects base="1.0.0" version="1.0.0b"/>
+    <affects base="1.0.0" version="1.0.0c"/>
+    <affects base="1.0.0" version="1.0.0d"/>
+    <affects base="1.0.0" version="1.0.0e"/>
+    <affects base="1.0.0" version="1.0.0f"/>
+    <affects base="1.0.0" version="1.0.0g"/>
+    <affects base="1.0.0" version="1.0.0i"/>
+    <affects base="1.0.0" version="1.0.0j"/>
+    <affects base="1.0.0" version="1.0.0k"/>
+    <affects base="1.0.0" version="1.0.0l"/>
+    <affects base="1.0.1" version="1.0.1"/>
+    <affects base="1.0.1" version="1.0.1a"/>
+    <affects base="1.0.1" version="1.0.1b"/>
+    <affects base="1.0.1" version="1.0.1c"/>
+    <affects base="1.0.1" version="1.0.1d"/>
+    <affects base="1.0.1" version="1.0.1e"/>
+    <affects base="1.0.1" version="1.0.1f"/>
+    <affects base="1.0.1" version="1.0.1g"/>
+    <fixed base="1.0.1" version="1.0.1h" date="20140605"/>
+    <fixed base="1.0.0" version="1.0.0m" date="20140605"/>
+    <fixed base="0.9.8" version="0.9.8za" date="20140605"/>
+    <description>
+      This vulnerability does not affect current versions of OpenSSL. It
+      existed in previous OpenSSL versions and was fixed in June 2014.
+
+      If a DTLS peer receives application data between the ChangeCipherSpec
+      and Finished messages, buffering of such data may cause an invalid
+      free, resulting in a segmentation fault or potentially, memory
+      corruption.
+    </description>
+    <advisory url="http://www.openssl.org/news/secadv_20150611.txt"/>
+    <reported source="Praveen Kariyanahalli, and subsequently by Ivan Fratric and Felix Groebert (Google)"/>
+  </issue>
   <issue public="20150319">
     <impact severity="High"/>
     <cve name="2015-0291"/>

From matt at openssl.org  Thu Jun 11 14:43:35 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:43:35 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434033815.948998.6926.nullmailer@dev.openssl.org>

The branch master has been updated
       via  063dccd027033401912d8c5e3f0f25b1f13de64b (commit)
       via  4924b37ee01f71ae19c94a8934b80eeb2f677932 (commit)
       via  59302b600e8d5b77ef144e447bb046fd7ab72686 (commit)
       via  f48b83b4fb7d6689584cf25f61ca63a4891f5b11 (commit)
      from  708cf593587e2fda67dae9782991ff9fccc781eb (commit)


- Log -----------------------------------------------------------------
commit 063dccd027033401912d8c5e3f0f25b1f13de64b
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 11:49:31 2015 +0100

    Update CHANGES and NEWS
    
    Updates to CHANGES and NEWS to take account of the latest security fixes.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 4924b37ee01f71ae19c94a8934b80eeb2f677932
Author: Andy Polyakov <appro at openssl.org>
Date:   Thu Jun 11 00:18:01 2015 +0200

    bn/bn_gf2m.c: avoid infinite loop wich malformed ECParamters.
    
    CVE-2015-1788
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit 59302b600e8d5b77ef144e447bb046fd7ab72686
Author: Emilia Kasper <emilia at openssl.org>
Date:   Tue May 12 19:00:30 2015 +0200

    PKCS#7: Fix NULL dereference with missing EncryptedContent.
    
    CVE-2015-1790
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit f48b83b4fb7d6689584cf25f61ca63a4891f5b11
Author: Emilia Kasper <emilia at openssl.org>
Date:   Wed Apr 8 16:56:43 2015 +0200

    Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
    
    Also tighten X509_cmp_time to reject more than three fractional
    seconds in the time; and to reject trailing garbage after the offset.
    
    CVE-2015-1789
    
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                 | 66 +++++++++++++++++++++++++++++++++++++++++++++++++
 NEWS                    | 10 +++++++-
 crypto/bn/bn_gf2m.c     | 15 +++++++----
 crypto/pkcs7/pk7_doit.c | 16 +++++++++++-
 crypto/x509/x509_vfy.c  | 57 ++++++++++++++++++++++++++++++++++--------
 5 files changed, 147 insertions(+), 17 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1bd9e1a..6faf644 100644
--- a/CHANGES
+++ b/CHANGES
@@ -423,6 +423,72 @@
 
  Changes between 1.0.2a and 1.0.2b [xx XXX xxxx]
 
+  *) Malformed ECParameters causes infinite loop
+
+     When processing an ECParameters structure OpenSSL enters an infinite loop
+     if the curve specified is over a specially malformed binary polynomial
+     field.
+
+     This can be used to perform denial of service against any
+     system which processes public keys, certificate requests or
+     certificates.  This includes TLS clients and TLS servers with
+     client authentication enabled.
+
+     This issue was reported to OpenSSL by Joseph Barr-Pixton.
+     (CVE-2015-1788)
+     [Andy Polyakov]
+
+  *) Exploitable out-of-bounds read in X509_cmp_time
+
+     X509_cmp_time does not properly check the length of the ASN1_TIME
+     string and can read a few bytes out of bounds. In addition,
+     X509_cmp_time accepts an arbitrary number of fractional seconds in the
+     time string.
+
+     An attacker can use this to craft malformed certificates and CRLs of
+     various sizes and potentially cause a segmentation fault, resulting in
+     a DoS on applications that verify certificates or CRLs. TLS clients
+     that verify CRLs are affected. TLS clients and servers with client
+     authentication enabled may be affected if they use custom verification
+     callbacks.
+
+     This issue was reported to OpenSSL by Robert Swiecki (Google), and
+     independently by Hanno B?ck.
+     (CVE-2015-1789)
+     [Emilia K?sper]
+
+  *) PKCS7 crash with missing EnvelopedContent
+
+     The PKCS#7 parsing code does not handle missing inner EncryptedContent
+     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
+     with missing content and trigger a NULL pointer dereference on parsing.
+
+     Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
+     structures from untrusted sources are affected. OpenSSL clients and
+     servers are not affected.
+
+     This issue was reported to OpenSSL by Michal Zalewski (Google).
+     (CVE-2015-1790)
+     [Emilia K?sper]
+
+  *) CMS verify infinite loop with unknown hash function
+
+     When verifying a signedData message the CMS code can enter an infinite loop
+     if presented with an unknown hash function OID. This can be used to perform
+     denial of service against any system which verifies signedData messages using
+     the CMS code.
+     This issue was reported to OpenSSL by Johannes Bauer.
+     (CVE-2015-1792)
+     [Stephen Henson]
+
+  *) Race condition handling NewSessionTicket
+
+     If a NewSessionTicket is received by a multi-threaded client when attempting to
+     reuse a previous ticket then a race condition can occur potentially leading to
+     a double free of the ticket data.
+     (CVE-2015-1791)
+     [Matt Caswell]
+
   *) Only support 256-bit or stronger elliptic curves with the
      'ecdh_auto' setting (server) or by default (client). Of supported
      curves, prefer P-256 (both).
diff --git a/NEWS b/NEWS
index cbf847a..beb2dd3 100644
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,15 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.2 and OpenSSL 1.0.2a [under development]
+  Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [under development]
+
+      o Malformed ECParameters causes infinite loop (CVE-2015-1788)
+      o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
+      o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
+      o CMS verify infinite loop with unknown hash function (CVE-2015-1792)
+      o Race condition handling NewSessionTicket (CVE-2015-1791)
+
+  Major changes between OpenSSL 1.0.2 and OpenSSL 1.0.2a [19 Mar 2015]
 
       o OpenSSL 1.0.2 ClientHello sigalgs DoS fix (CVE-2015-0291)
       o Multiblock corrupted pointer fix (CVE-2015-0290)
diff --git a/crypto/bn/bn_gf2m.c b/crypto/bn/bn_gf2m.c
index 73e1e8f..cd137c3 100644
--- a/crypto/bn/bn_gf2m.c
+++ b/crypto/bn/bn_gf2m.c
@@ -691,9 +691,10 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
     }
 # else
     {
-        int i, ubits = BN_num_bits(u), vbits = BN_num_bits(v), /* v is copy
-                                                                * of p */
-            top = p->top;
+        int i;
+        int ubits = BN_num_bits(u);
+        int vbits = BN_num_bits(v); /* v is copy of p */
+        int top = p->top;
         BN_ULONG *udp, *bdp, *vdp, *cdp;
 
         bn_wexpand(u, top);
@@ -737,8 +738,12 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 ubits--;
             }
 
-            if (ubits <= BN_BITS2 && udp[0] == 1)
-                break;
+            if (ubits <= BN_BITS2) {
+                if (udp[0] == 0) /* poly was reducible */
+                    goto err;
+                if (udp[0] == 1)
+                    break;
+            }
 
             if (ubits < vbits) {
                 i = ubits;
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 2c8dd87..cc2f3be 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -432,6 +432,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
     switch (i) {
     case NID_pkcs7_signed:
+        /*
+         * p7->d.sign->contents is a PKCS7 structure consisting of a contentType
+         * field and optional content.
+         * data_body is NULL if that structure has no (=detached) content
+         * or if the contentType is wrong (i.e., not "data").
+         */
         data_body = PKCS7_get_octet_string(p7->d.sign->contents);
         if (!PKCS7_is_detached(p7) && data_body == NULL) {
             PKCS7err(PKCS7_F_PKCS7_DATADECODE,
@@ -443,6 +449,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_signedAndEnveloped:
         rsk = p7->d.signed_and_enveloped->recipientinfo;
         md_sk = p7->d.signed_and_enveloped->md_algs;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.signed_and_enveloped->enc_data->enc_data;
         enc_alg = p7->d.signed_and_enveloped->enc_data->algorithm;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
@@ -455,6 +462,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_enveloped:
         rsk = p7->d.enveloped->recipientinfo;
         enc_alg = p7->d.enveloped->enc_data->algorithm;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.enveloped->enc_data->enc_data;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
         if (evp_cipher == NULL) {
@@ -468,6 +476,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         goto err;
     }
 
+    /* Detached content must be supplied via in_bio instead. */
+    if (data_body == NULL && in_bio == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT);
+        goto err;
+    }
+
     /* We will be checking the signature */
     if (md_sk != NULL) {
         for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
@@ -593,7 +607,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
             BIO_push(out, etmp);
         etmp = NULL;
     }
-    if (PKCS7_is_detached(p7) || (in_bio != NULL)) {
+    if (in_bio != NULL) {
         bio = in_bio;
     } else {
         if (data_body->length > 0)
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 7e00436..a920ea7 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -1808,47 +1808,84 @@ int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
     ASN1_TIME atm;
     long offset;
     char buff1[24], buff2[24], *p;
-    int i, j;
+    int i, j, remaining;
 
     p = buff1;
-    i = ctm->length;
+    remaining = ctm->length;
     str = (char *)ctm->data;
+    /*
+     * Note that the following (historical) code allows much more slack in the
+     * time format than RFC5280. In RFC5280, the representation is fixed:
+     * UTCTime: YYMMDDHHMMSSZ
+     * GeneralizedTime: YYYYMMDDHHMMSSZ
+     */
     if (ctm->type == V_ASN1_UTCTIME) {
-        if ((i < 11) || (i > 17))
+        /* YYMMDDHHMM[SS]Z or YYMMDDHHMM[SS](+-)hhmm */
+        int min_length = sizeof("YYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYMMDDHHMMSS+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 10);
         p += 10;
         str += 10;
+        remaining -= 10;
     } else {
-        if (i < 13)
+        /* YYYYMMDDHHMM[SS[.fff]]Z or YYYYMMDDHHMM[SS[.f[f[f]]]](+-)hhmm */
+        int min_length = sizeof("YYYYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYYYMMDDHHMMSS.fff+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 12);
         p += 12;
         str += 12;
+        remaining -= 12;
     }
 
     if ((*str == 'Z') || (*str == '-') || (*str == '+')) {
         *(p++) = '0';
         *(p++) = '0';
     } else {
+        /* SS (seconds) */
+        if (remaining < 2)
+            return 0;
         *(p++) = *(str++);
         *(p++) = *(str++);
-        /* Skip any fractional seconds... */
-        if (*str == '.') {
+        remaining -= 2;
+        /*
+         * Skip any (up to three) fractional seconds...
+         * TODO(emilia): in RFC5280, fractional seconds are forbidden.
+         * Can we just kill them altogether?
+         */
+        if (remaining && *str == '.') {
             str++;
-            while ((*str >= '0') && (*str <= '9'))
-                str++;
+            remaining--;
+            for (i = 0; i < 3 && remaining; i++, str++, remaining--) {
+                if (*str < '0' || *str > '9')
+                    break;
+            }
         }
 
     }
     *(p++) = 'Z';
     *(p++) = '\0';
 
-    if (*str == 'Z')
+    /* We now need either a terminating 'Z' or an offset. */
+    if (!remaining)
+        return 0;
+    if (*str == 'Z') {
+        if (remaining != 1)
+            return 0;
         offset = 0;
-    else {
+    } else {
+        /* (+-)HHMM */
         if ((*str != '+') && (*str != '-'))
             return 0;
+        /* Historical behaviour: the (+-)hhmm offset is forbidden in RFC5280. */
+        if (remaining != 5)
+            return 0;
+        if (str[1] < '0' || str[1] > '9' || str[2] < '0' || str[2] > '9' ||
+            str[3] < '0' || str[3] > '9' || str[4] < '0' || str[4] > '9')
+            return 0;
         offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60;
         offset += (str[3] - '0') * 10 + (str[4] - '0');
         if (*str == '-')

From matt at openssl.org  Thu Jun 11 14:43:48 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:43:48 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434033828.752388.8513.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  b6ed9917314145d1133a3d571daa06f7d2fb66d2 (commit)
       via  7b560c174dcd569795f5be66e0c091d1be440614 (commit)
       via  c26bfada81c7c884bda409ce191e687c1760aa89 (commit)
       via  40b8eb792d591d19751afc4d056c8e84260bdeb8 (commit)
       via  ab17f6b746b99bab3d9d3728a2ad067b2cf4970e (commit)
       via  7bc2aee4f196f9b049416dfb08fc3a271755c0d8 (commit)
       via  9bc3665ac9e3c36f7762acd3691e1115d250b030 (commit)
       via  aa5ab40860deb3dc6d4d4c98a4efea99f7040a46 (commit)
      from  8aa556e1c3b49274ccae579cb584eb5b702a3b0e (commit)


- Log -----------------------------------------------------------------
commit b6ed9917314145d1133a3d571daa06f7d2fb66d2
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 14:59:37 2015 +0100

    Prepare for 1.0.2c-dev
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit 7b560c174dcd569795f5be66e0c091d1be440614
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 14:55:38 2015 +0100

    Prepare for 1.0.2b release
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit c26bfada81c7c884bda409ce191e687c1760aa89
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 14:55:38 2015 +0100

    make update
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit 40b8eb792d591d19751afc4d056c8e84260bdeb8
Author: Andy Polyakov <appro at openssl.org>
Date:   Thu Jun 11 00:18:01 2015 +0200

    bn/bn_gf2m.c: avoid infinite loop wich malformed ECParamters.
    
    CVE-2015-1788
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 4924b37ee01f71ae19c94a8934b80eeb2f677932)

commit ab17f6b746b99bab3d9d3728a2ad067b2cf4970e
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 11:49:31 2015 +0100

    Update CHANGES and NEWS
    
    Updates to CHANGES and NEWS to take account of the latest security fixes.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 7bc2aee4f196f9b049416dfb08fc3a271755c0d8
Author: Emilia Kasper <emilia at openssl.org>
Date:   Tue May 12 19:00:30 2015 +0200

    PKCS#7: Fix NULL dereference with missing EncryptedContent.
    
    CVE-2015-1790
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 9bc3665ac9e3c36f7762acd3691e1115d250b030
Author: Emilia Kasper <emilia at openssl.org>
Date:   Wed Apr 8 16:56:43 2015 +0200

    Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
    
    Also tighten X509_cmp_time to reject more than three fractional
    seconds in the time; and to reject trailing garbage after the offset.
    
    CVE-2015-1789
    
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit aa5ab40860deb3dc6d4d4c98a4efea99f7040a46
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Fri Jun 5 12:11:25 2015 +0100

    Fix infinite loop in CMS
    
    Fix loop in do_free_upto if cmsbio is NULL: this will happen when attempting
    to verify and a digest is not recognised. Reported by Johannes Bauer.
    
    CVE-2015-1792
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                 | 72 ++++++++++++++++++++++++++++++++++++++++++++++++-
 NEWS                    | 10 ++++++-
 README                  |  2 +-
 crypto/bn/Makefile      |  1 -
 crypto/bn/bn_gf2m.c     | 15 +++++++----
 crypto/cms/cms_smime.c  |  2 +-
 crypto/opensslv.h       |  6 ++---
 crypto/pkcs7/pk7_doit.c | 16 ++++++++++-
 crypto/x509/x509_vfy.c  | 57 ++++++++++++++++++++++++++++++++-------
 openssl.spec            |  2 +-
 10 files changed, 158 insertions(+), 25 deletions(-)

diff --git a/CHANGES b/CHANGES
index c65ce82..2ec8b7b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,77 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.2a and 1.0.2b [xx XXX xxxx]
+ Changes between 1.0.2b and 1.0.2c [xx XXX xxxx]
+
+  *)
+
+ Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
+
+  *) Malformed ECParameters causes infinite loop
+
+     When processing an ECParameters structure OpenSSL enters an infinite loop
+     if the curve specified is over a specially malformed binary polynomial
+     field.
+
+     This can be used to perform denial of service against any
+     system which processes public keys, certificate requests or
+     certificates.  This includes TLS clients and TLS servers with
+     client authentication enabled.
+
+     This issue was reported to OpenSSL by Joseph Barr-Pixton.
+     (CVE-2015-1788)
+     [Andy Polyakov]
+
+  *) Exploitable out-of-bounds read in X509_cmp_time
+
+     X509_cmp_time does not properly check the length of the ASN1_TIME
+     string and can read a few bytes out of bounds. In addition,
+     X509_cmp_time accepts an arbitrary number of fractional seconds in the
+     time string.
+
+     An attacker can use this to craft malformed certificates and CRLs of
+     various sizes and potentially cause a segmentation fault, resulting in
+     a DoS on applications that verify certificates or CRLs. TLS clients
+     that verify CRLs are affected. TLS clients and servers with client
+     authentication enabled may be affected if they use custom verification
+     callbacks.
+
+     This issue was reported to OpenSSL by Robert Swiecki (Google), and
+     independently by Hanno B?ck.
+     (CVE-2015-1789)
+     [Emilia K?sper]
+
+  *) PKCS7 crash with missing EnvelopedContent
+
+     The PKCS#7 parsing code does not handle missing inner EncryptedContent
+     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
+     with missing content and trigger a NULL pointer dereference on parsing.
+
+     Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
+     structures from untrusted sources are affected. OpenSSL clients and
+     servers are not affected.
+
+     This issue was reported to OpenSSL by Michal Zalewski (Google).
+     (CVE-2015-1790)
+     [Emilia K?sper]
+
+  *) CMS verify infinite loop with unknown hash function
+
+     When verifying a signedData message the CMS code can enter an infinite loop
+     if presented with an unknown hash function OID. This can be used to perform
+     denial of service against any system which verifies signedData messages using
+     the CMS code.
+     This issue was reported to OpenSSL by Johannes Bauer.
+     (CVE-2015-1792)
+     [Stephen Henson]
+
+  *) Race condition handling NewSessionTicket
+
+     If a NewSessionTicket is received by a multi-threaded client when attempting to
+     reuse a previous ticket then a race condition can occur potentially leading to
+     a double free of the ticket data.
+     (CVE-2015-1791)
+     [Matt Caswell]
 
   *) Removed support for the two export grade static DH ciphersuites
      EXP-DH-RSA-DES-CBC-SHA and EXP-DH-DSS-DES-CBC-SHA. These two ciphersuites
diff --git a/NEWS b/NEWS
index 6eefc32..8750b03 100644
--- a/NEWS
+++ b/NEWS
@@ -5,10 +5,18 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [under development]
+  Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [under development]
 
       o
 
+  Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [11 Jun 2015]
+
+      o Malformed ECParameters causes infinite loop (CVE-2015-1788)
+      o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
+      o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
+      o CMS verify infinite loop with unknown hash function (CVE-2015-1792)
+      o Race condition handling NewSessionTicket (CVE-2015-1791)
+
   Major changes between OpenSSL 1.0.2 and OpenSSL 1.0.2a [19 Mar 2015]
 
       o OpenSSL 1.0.2 ClientHello sigalgs DoS fix (CVE-2015-0291)
diff --git a/README b/README
index ad27d98..0bd70de 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
 
- OpenSSL 1.0.2b-dev
+ OpenSSL 1.0.2c-dev
 
  Copyright (c) 1998-2011 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/crypto/bn/Makefile b/crypto/bn/Makefile
index 215855e..61dce05 100644
--- a/crypto/bn/Makefile
+++ b/crypto/bn/Makefile
@@ -253,7 +253,6 @@ bn_exp.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
 bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 bn_exp.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bn_exp.o: ../../include/openssl/symhacks.h ../cryptlib.h bn_exp.c bn_lcl.h
-bn_exp.o: rsaz_exp.h
 bn_exp2.o: ../../e_os.h ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_exp2.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_exp2.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
diff --git a/crypto/bn/bn_gf2m.c b/crypto/bn/bn_gf2m.c
index 1981f16..cfa1c7c 100644
--- a/crypto/bn/bn_gf2m.c
+++ b/crypto/bn/bn_gf2m.c
@@ -693,9 +693,10 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
     }
 # else
     {
-        int i, ubits = BN_num_bits(u), vbits = BN_num_bits(v), /* v is copy
-                                                                * of p */
-            top = p->top;
+        int i;
+        int ubits = BN_num_bits(u);
+        int vbits = BN_num_bits(v); /* v is copy of p */
+        int top = p->top;
         BN_ULONG *udp, *bdp, *vdp, *cdp;
 
         bn_wexpand(u, top);
@@ -739,8 +740,12 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 ubits--;
             }
 
-            if (ubits <= BN_BITS2 && udp[0] == 1)
-                break;
+            if (ubits <= BN_BITS2) {
+                if (udp[0] == 0) /* poly was reducible */
+                    goto err;
+                if (udp[0] == 1)
+                    break;
+            }
 
             if (ubits < vbits) {
                 i = ubits;
diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c
index 8729e3f..b39ed48 100644
--- a/crypto/cms/cms_smime.c
+++ b/crypto/cms/cms_smime.c
@@ -132,7 +132,7 @@ static void do_free_upto(BIO *f, BIO *upto)
             BIO_free(f);
             f = tbio;
         }
-        while (f != upto);
+        while (f && f != upto);
     } else
         BIO_free_all(f);
 }
diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index 654f72d..d6df194 100644
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -30,11 +30,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x10002020L
+# define OPENSSL_VERSION_NUMBER  0x10002030L
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2b-fips-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2c-fips-dev xx XXX xxxx"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2b-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2c-dev xx XXX xxxx"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 31a1b98..c8d7db0 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -445,6 +445,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
     switch (i) {
     case NID_pkcs7_signed:
+        /*
+         * p7->d.sign->contents is a PKCS7 structure consisting of a contentType
+         * field and optional content.
+         * data_body is NULL if that structure has no (=detached) content
+         * or if the contentType is wrong (i.e., not "data").
+         */
         data_body = PKCS7_get_octet_string(p7->d.sign->contents);
         if (!PKCS7_is_detached(p7) && data_body == NULL) {
             PKCS7err(PKCS7_F_PKCS7_DATADECODE,
@@ -456,6 +462,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_signedAndEnveloped:
         rsk = p7->d.signed_and_enveloped->recipientinfo;
         md_sk = p7->d.signed_and_enveloped->md_algs;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.signed_and_enveloped->enc_data->enc_data;
         enc_alg = p7->d.signed_and_enveloped->enc_data->algorithm;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
@@ -468,6 +475,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_enveloped:
         rsk = p7->d.enveloped->recipientinfo;
         enc_alg = p7->d.enveloped->enc_data->algorithm;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.enveloped->enc_data->enc_data;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
         if (evp_cipher == NULL) {
@@ -481,6 +489,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         goto err;
     }
 
+    /* Detached content must be supplied via in_bio instead. */
+    if (data_body == NULL && in_bio == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT);
+        goto err;
+    }
+
     /* We will be checking the signature */
     if (md_sk != NULL) {
         for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
@@ -623,7 +637,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         etmp = NULL;
     }
 #if 1
-    if (PKCS7_is_detached(p7) || (in_bio != NULL)) {
+    if (in_bio != NULL) {
         bio = in_bio;
     } else {
 # if 0
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index b4e7983..8ce41f9 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -1788,47 +1788,84 @@ int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
     ASN1_TIME atm;
     long offset;
     char buff1[24], buff2[24], *p;
-    int i, j;
+    int i, j, remaining;
 
     p = buff1;
-    i = ctm->length;
+    remaining = ctm->length;
     str = (char *)ctm->data;
+    /*
+     * Note that the following (historical) code allows much more slack in the
+     * time format than RFC5280. In RFC5280, the representation is fixed:
+     * UTCTime: YYMMDDHHMMSSZ
+     * GeneralizedTime: YYYYMMDDHHMMSSZ
+     */
     if (ctm->type == V_ASN1_UTCTIME) {
-        if ((i < 11) || (i > 17))
+        /* YYMMDDHHMM[SS]Z or YYMMDDHHMM[SS](+-)hhmm */
+        int min_length = sizeof("YYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYMMDDHHMMSS+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 10);
         p += 10;
         str += 10;
+        remaining -= 10;
     } else {
-        if (i < 13)
+        /* YYYYMMDDHHMM[SS[.fff]]Z or YYYYMMDDHHMM[SS[.f[f[f]]]](+-)hhmm */
+        int min_length = sizeof("YYYYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYYYMMDDHHMMSS.fff+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 12);
         p += 12;
         str += 12;
+        remaining -= 12;
     }
 
     if ((*str == 'Z') || (*str == '-') || (*str == '+')) {
         *(p++) = '0';
         *(p++) = '0';
     } else {
+        /* SS (seconds) */
+        if (remaining < 2)
+            return 0;
         *(p++) = *(str++);
         *(p++) = *(str++);
-        /* Skip any fractional seconds... */
-        if (*str == '.') {
+        remaining -= 2;
+        /*
+         * Skip any (up to three) fractional seconds...
+         * TODO(emilia): in RFC5280, fractional seconds are forbidden.
+         * Can we just kill them altogether?
+         */
+        if (remaining && *str == '.') {
             str++;
-            while ((*str >= '0') && (*str <= '9'))
-                str++;
+            remaining--;
+            for (i = 0; i < 3 && remaining; i++, str++, remaining--) {
+                if (*str < '0' || *str > '9')
+                    break;
+            }
         }
 
     }
     *(p++) = 'Z';
     *(p++) = '\0';
 
-    if (*str == 'Z')
+    /* We now need either a terminating 'Z' or an offset. */
+    if (!remaining)
+        return 0;
+    if (*str == 'Z') {
+        if (remaining != 1)
+            return 0;
         offset = 0;
-    else {
+    } else {
+        /* (+-)HHMM */
         if ((*str != '+') && (*str != '-'))
             return 0;
+        /* Historical behaviour: the (+-)hhmm offset is forbidden in RFC5280. */
+        if (remaining != 5)
+            return 0;
+        if (str[1] < '0' || str[1] > '9' || str[2] < '0' || str[2] > '9' ||
+            str[3] < '0' || str[3] > '9' || str[4] < '0' || str[4] > '9')
+            return 0;
         offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60;
         offset += (str[3] - '0') * 10 + (str[4] - '0');
         if (*str == '-')
diff --git a/openssl.spec b/openssl.spec
index 01f0617..e6c7584 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -6,7 +6,7 @@ Release: 1
 
 Summary: Secure Sockets Layer and cryptography libraries and tools
 Name: openssl
-Version: 1.0.2b
+Version: 1.0.2c
 Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
 License: OpenSSL
 Group: System Environment/Libraries

From matt at openssl.org  Thu Jun 11 14:43:59 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:43:59 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434033839.852375.9737.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  3adca975dc1175e76bc079306896a09692ed4c15 (commit)
       via  517899e6c8af47d4972dcf9b375386631f6c93f1 (commit)
       via  f61bbf8da532038ed0eae16a9a11771f3da22d30 (commit)
       via  1f31458a77c1e35e9ac80a43c55e7ed78ac248c2 (commit)
       via  5fbc59cac60db4d7c3172152b8bdafe0c675fabd (commit)
       via  370ac320301e28bb615cee80124c042649c95d14 (commit)
       via  dd90a91d8771fd1ad5083fd46a2b3da16a587757 (commit)
      from  176b59d157d1cbfd0b10f9f7be12eaf9896410f2 (commit)


- Log -----------------------------------------------------------------
commit 3adca975dc1175e76bc079306896a09692ed4c15
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 15:08:34 2015 +0100

    Prepare for 1.0.1o-dev
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit 517899e6c8af47d4972dcf9b375386631f6c93f1
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 15:05:11 2015 +0100

    Prepare for 1.0.1n release
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit f61bbf8da532038ed0eae16a9a11771f3da22d30
Author: Andy Polyakov <appro at openssl.org>
Date:   Thu Jun 11 00:18:01 2015 +0200

    bn/bn_gf2m.c: avoid infinite loop wich malformed ECParamters.
    
    CVE-2015-1788
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 4924b37ee01f71ae19c94a8934b80eeb2f677932)

commit 1f31458a77c1e35e9ac80a43c55e7ed78ac248c2
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 11:49:31 2015 +0100

    Update CHANGES and NEWS
    
    Updates to CHANGES and NEWS to take account of the latest security fixes.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 5fbc59cac60db4d7c3172152b8bdafe0c675fabd
Author: Emilia Kasper <emilia at openssl.org>
Date:   Tue May 12 19:00:30 2015 +0200

    PKCS#7: Fix NULL dereference with missing EncryptedContent.
    
    CVE-2015-1790
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 370ac320301e28bb615cee80124c042649c95d14
Author: Emilia Kasper <emilia at openssl.org>
Date:   Wed Apr 8 16:56:43 2015 +0200

    Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
    
    Also tighten X509_cmp_time to reject more than three fractional
    seconds in the time; and to reject trailing garbage after the offset.
    
    CVE-2015-1789
    
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit dd90a91d8771fd1ad5083fd46a2b3da16a587757
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Fri Jun 5 12:11:25 2015 +0100

    Fix infinite loop in CMS
    
    Fix loop in do_free_upto if cmsbio is NULL: this will happen when attempting
    to verify and a digest is not recognised. Reported by Johannes Bauer.
    
    CVE-2015-1792
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                 | 72 ++++++++++++++++++++++++++++++++++++++++++++++++-
 NEWS                    | 10 ++++++-
 README                  |  2 +-
 crypto/bn/bn_gf2m.c     | 15 +++++++----
 crypto/cms/cms_smime.c  |  2 +-
 crypto/opensslv.h       |  6 ++---
 crypto/pkcs7/pk7_doit.c | 16 ++++++++++-
 crypto/x509/x509_vfy.c  | 57 ++++++++++++++++++++++++++++++++-------
 openssl.spec            |  2 +-
 9 files changed, 158 insertions(+), 24 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9d2f9f9..06601b4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,77 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.1m and 1.0.1n [xx XXX xxxx]
+ Changes between 1.0.1n and 1.0.1o [xx XXX xxxx]
+
+  *)
+
+ Changes between 1.0.1m and 1.0.1n [11 Jun 2015]
+
+  *) Malformed ECParameters causes infinite loop
+
+     When processing an ECParameters structure OpenSSL enters an infinite loop
+     if the curve specified is over a specially malformed binary polynomial
+     field.
+
+     This can be used to perform denial of service against any
+     system which processes public keys, certificate requests or
+     certificates.  This includes TLS clients and TLS servers with
+     client authentication enabled.
+
+     This issue was reported to OpenSSL by Joseph Barr-Pixton.
+     (CVE-2015-1788)
+     [Andy Polyakov]
+
+  *) Exploitable out-of-bounds read in X509_cmp_time
+
+     X509_cmp_time does not properly check the length of the ASN1_TIME
+     string and can read a few bytes out of bounds. In addition,
+     X509_cmp_time accepts an arbitrary number of fractional seconds in the
+     time string.
+
+     An attacker can use this to craft malformed certificates and CRLs of
+     various sizes and potentially cause a segmentation fault, resulting in
+     a DoS on applications that verify certificates or CRLs. TLS clients
+     that verify CRLs are affected. TLS clients and servers with client
+     authentication enabled may be affected if they use custom verification
+     callbacks.
+
+     This issue was reported to OpenSSL by Robert Swiecki (Google), and
+     independently by Hanno B?ck.
+     (CVE-2015-1789)
+     [Emilia K?sper]
+
+  *) PKCS7 crash with missing EnvelopedContent
+
+     The PKCS#7 parsing code does not handle missing inner EncryptedContent
+     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
+     with missing content and trigger a NULL pointer dereference on parsing.
+
+     Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
+     structures from untrusted sources are affected. OpenSSL clients and
+     servers are not affected.
+
+     This issue was reported to OpenSSL by Michal Zalewski (Google).
+     (CVE-2015-1790)
+     [Emilia K?sper]
+
+  *) CMS verify infinite loop with unknown hash function
+
+     When verifying a signedData message the CMS code can enter an infinite loop
+     if presented with an unknown hash function OID. This can be used to perform
+     denial of service against any system which verifies signedData messages using
+     the CMS code.
+     This issue was reported to OpenSSL by Johannes Bauer.
+     (CVE-2015-1792)
+     [Stephen Henson]
+
+  *) Race condition handling NewSessionTicket
+
+     If a NewSessionTicket is received by a multi-threaded client when attempting to
+     reuse a previous ticket then a race condition can occur potentially leading to
+     a double free of the ticket data.
+     (CVE-2015-1791)
+     [Matt Caswell]
 
   *) Reject DH handshakes with parameters shorter than 768 bits.
      [Kurt Roeckx and Emilia Kasper]
diff --git a/NEWS b/NEWS
index aa72ab0..286059c 100644
--- a/NEWS
+++ b/NEWS
@@ -5,10 +5,18 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.1m and OpenSSL 1.0.1n [under development]
+  Major changes between OpenSSL 1.0.1n and OpenSSL 1.0.1o [under development]
 
       o
 
+  Major changes between OpenSSL 1.0.1m and OpenSSL 1.0.1n [11 Jun 2015]
+
+      o Malformed ECParameters causes infinite loop (CVE-2015-1788)
+      o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
+      o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
+      o CMS verify infinite loop with unknown hash function (CVE-2015-1792)
+      o Race condition handling NewSessionTicket (CVE-2015-1791)
+
   Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.1m [19 Mar 2015]
 
       o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
diff --git a/README b/README
index caddc93..d379b03 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
 
- OpenSSL 1.0.1n-dev
+ OpenSSL 1.0.1o-dev
 
  Copyright (c) 1998-2011 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/crypto/bn/bn_gf2m.c b/crypto/bn/bn_gf2m.c
index aeee49a..a0ba8de 100644
--- a/crypto/bn/bn_gf2m.c
+++ b/crypto/bn/bn_gf2m.c
@@ -694,9 +694,10 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
     }
 # else
     {
-        int i, ubits = BN_num_bits(u), vbits = BN_num_bits(v), /* v is copy
-                                                                * of p */
-            top = p->top;
+        int i;
+        int ubits = BN_num_bits(u);
+        int vbits = BN_num_bits(v); /* v is copy of p */
+        int top = p->top;
         BN_ULONG *udp, *bdp, *vdp, *cdp;
 
         bn_wexpand(u, top);
@@ -740,8 +741,12 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 ubits--;
             }
 
-            if (ubits <= BN_BITS2 && udp[0] == 1)
-                break;
+            if (ubits <= BN_BITS2) {
+                if (udp[0] == 0) /* poly was reducible */
+                    goto err;
+                if (udp[0] == 1)
+                    break;
+            }
 
             if (ubits < vbits) {
                 i = ubits;
diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c
index 8851603..8b37560 100644
--- a/crypto/cms/cms_smime.c
+++ b/crypto/cms/cms_smime.c
@@ -131,7 +131,7 @@ static void do_free_upto(BIO *f, BIO *upto)
             BIO_free(f);
             f = tbio;
         }
-        while (f != upto);
+        while (f && f != upto);
     } else
         BIO_free_all(f);
 }
diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index d40d5da..14bc8bd 100644
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -30,11 +30,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x100010e0L
+# define OPENSSL_VERSION_NUMBER  0x100010f0L
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1n-fips-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1o-fips-dev xx XXX xxxx"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1n-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1o-dev xx XXX xxxx"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 31a1b98..c8d7db0 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -445,6 +445,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
     switch (i) {
     case NID_pkcs7_signed:
+        /*
+         * p7->d.sign->contents is a PKCS7 structure consisting of a contentType
+         * field and optional content.
+         * data_body is NULL if that structure has no (=detached) content
+         * or if the contentType is wrong (i.e., not "data").
+         */
         data_body = PKCS7_get_octet_string(p7->d.sign->contents);
         if (!PKCS7_is_detached(p7) && data_body == NULL) {
             PKCS7err(PKCS7_F_PKCS7_DATADECODE,
@@ -456,6 +462,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_signedAndEnveloped:
         rsk = p7->d.signed_and_enveloped->recipientinfo;
         md_sk = p7->d.signed_and_enveloped->md_algs;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.signed_and_enveloped->enc_data->enc_data;
         enc_alg = p7->d.signed_and_enveloped->enc_data->algorithm;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
@@ -468,6 +475,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_enveloped:
         rsk = p7->d.enveloped->recipientinfo;
         enc_alg = p7->d.enveloped->enc_data->algorithm;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.enveloped->enc_data->enc_data;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
         if (evp_cipher == NULL) {
@@ -481,6 +489,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         goto err;
     }
 
+    /* Detached content must be supplied via in_bio instead. */
+    if (data_body == NULL && in_bio == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT);
+        goto err;
+    }
+
     /* We will be checking the signature */
     if (md_sk != NULL) {
         for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
@@ -623,7 +637,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         etmp = NULL;
     }
 #if 1
-    if (PKCS7_is_detached(p7) || (in_bio != NULL)) {
+    if (in_bio != NULL) {
         bio = in_bio;
     } else {
 # if 0
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 29dd86c..16db4c0 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -1637,47 +1637,84 @@ int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
     ASN1_TIME atm;
     long offset;
     char buff1[24], buff2[24], *p;
-    int i, j;
+    int i, j, remaining;
 
     p = buff1;
-    i = ctm->length;
+    remaining = ctm->length;
     str = (char *)ctm->data;
+    /*
+     * Note that the following (historical) code allows much more slack in the
+     * time format than RFC5280. In RFC5280, the representation is fixed:
+     * UTCTime: YYMMDDHHMMSSZ
+     * GeneralizedTime: YYYYMMDDHHMMSSZ
+     */
     if (ctm->type == V_ASN1_UTCTIME) {
-        if ((i < 11) || (i > 17))
+        /* YYMMDDHHMM[SS]Z or YYMMDDHHMM[SS](+-)hhmm */
+        int min_length = sizeof("YYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYMMDDHHMMSS+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 10);
         p += 10;
         str += 10;
+        remaining -= 10;
     } else {
-        if (i < 13)
+        /* YYYYMMDDHHMM[SS[.fff]]Z or YYYYMMDDHHMM[SS[.f[f[f]]]](+-)hhmm */
+        int min_length = sizeof("YYYYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYYYMMDDHHMMSS.fff+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 12);
         p += 12;
         str += 12;
+        remaining -= 12;
     }
 
     if ((*str == 'Z') || (*str == '-') || (*str == '+')) {
         *(p++) = '0';
         *(p++) = '0';
     } else {
+        /* SS (seconds) */
+        if (remaining < 2)
+            return 0;
         *(p++) = *(str++);
         *(p++) = *(str++);
-        /* Skip any fractional seconds... */
-        if (*str == '.') {
+        remaining -= 2;
+        /*
+         * Skip any (up to three) fractional seconds...
+         * TODO(emilia): in RFC5280, fractional seconds are forbidden.
+         * Can we just kill them altogether?
+         */
+        if (remaining && *str == '.') {
             str++;
-            while ((*str >= '0') && (*str <= '9'))
-                str++;
+            remaining--;
+            for (i = 0; i < 3 && remaining; i++, str++, remaining--) {
+                if (*str < '0' || *str > '9')
+                    break;
+            }
         }
 
     }
     *(p++) = 'Z';
     *(p++) = '\0';
 
-    if (*str == 'Z')
+    /* We now need either a terminating 'Z' or an offset. */
+    if (!remaining)
+        return 0;
+    if (*str == 'Z') {
+        if (remaining != 1)
+            return 0;
         offset = 0;
-    else {
+    } else {
+        /* (+-)HHMM */
         if ((*str != '+') && (*str != '-'))
             return 0;
+        /* Historical behaviour: the (+-)hhmm offset is forbidden in RFC5280. */
+        if (remaining != 5)
+            return 0;
+        if (str[1] < '0' || str[1] > '9' || str[2] < '0' || str[2] > '9' ||
+            str[3] < '0' || str[3] > '9' || str[4] < '0' || str[4] > '9')
+            return 0;
         offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60;
         offset += (str[3] - '0') * 10 + (str[4] - '0');
         if (*str == '-')
diff --git a/openssl.spec b/openssl.spec
index 71e907e..3e8f3a9 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -7,7 +7,7 @@ Release: 1
 Summary: Secure Sockets Layer and cryptography libraries and tools
 Name: openssl
 #Version: %{libmaj}.%{libmin}.%{librel}
-Version: 1.0.1n
+Version: 1.0.1o
 Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
 License: OpenSSL
 Group: System Environment/Libraries

From matt at openssl.org  Thu Jun 11 14:44:12 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:44:12 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1434033852.176157.11158.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  c9f4108465b7fb2ddf5be2d8cc80b120731a7906 (commit)
       via  a06ec5a26fdb24fd829abef54422d94521ddd14a (commit)
       via  62bbfe036da827d7347ed15db2974cac7ebca6ab (commit)
       via  f46e8095aa16ed61411ab4c231570762261df438 (commit)
       via  57de3216e27c2e52bc3bc5bc7c94babdb7022179 (commit)
       via  857b2ced04be897488df311a257f254ad8516429 (commit)
      from  809bf2eab7b46e2fd768fec0c28127991c927b19 (commit)


- Log -----------------------------------------------------------------
commit c9f4108465b7fb2ddf5be2d8cc80b120731a7906
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 15:16:43 2015 +0100

    Prepare for 1.0.0t-dev
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit a06ec5a26fdb24fd829abef54422d94521ddd14a
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 15:13:36 2015 +0100

    Prepare for 1.0.0s release
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit 62bbfe036da827d7347ed15db2974cac7ebca6ab
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 11:49:31 2015 +0100

    Update CHANGES and NEWS
    
    Updates to CHANGES and NEWS to take account of the latest security fixes.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit f46e8095aa16ed61411ab4c231570762261df438
Author: Emilia Kasper <emilia at openssl.org>
Date:   Tue May 12 19:00:30 2015 +0200

    PKCS#7: Fix NULL dereference with missing EncryptedContent.
    
    CVE-2015-1790
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 57de3216e27c2e52bc3bc5bc7c94babdb7022179
Author: Emilia Kasper <emilia at openssl.org>
Date:   Wed Apr 8 16:56:43 2015 +0200

    Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
    
    Also tighten X509_cmp_time to reject more than three fractional
    seconds in the time; and to reject trailing garbage after the offset.
    
    CVE-2015-1789
    
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit 857b2ced04be897488df311a257f254ad8516429
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Fri Jun 5 12:11:25 2015 +0100

    Fix infinite loop in CMS
    
    Fix loop in do_free_upto if cmsbio is NULL: this will happen when attempting
    to verify and a digest is not recognised. Reported by Johannes Bauer.
    
    CVE-2015-1792
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                 | 70 ++++++++++++++++++++++++++++++++++++++++++++++++-
 NEWS                    | 10 ++++++-
 README                  |  2 +-
 crypto/cms/cms_smime.c  |  2 +-
 crypto/opensslv.h       |  6 ++---
 crypto/pkcs7/pk7_doit.c | 16 ++++++++++-
 crypto/x509/x509_vfy.c  | 57 +++++++++++++++++++++++++++++++++-------
 openssl.spec            |  2 +-
 8 files changed, 146 insertions(+), 19 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7660a24..ccf2c03 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,10 +2,78 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.0r and 1.0.0s [xx XXX xxxx]
+ Changes between 1.0.0s and 1.0.0t [xx XXX xxxx]
 
   *)
 
+ Changes between 1.0.0r and 1.0.0s [11 Jun 2015]
+
+  *) Malformed ECParameters causes infinite loop
+
+     When processing an ECParameters structure OpenSSL enters an infinite loop
+     if the curve specified is over a specially malformed binary polynomial
+     field.
+
+     This can be used to perform denial of service against any
+     system which processes public keys, certificate requests or
+     certificates.  This includes TLS clients and TLS servers with
+     client authentication enabled.
+
+     This issue was reported to OpenSSL by Joseph Barr-Pixton.
+     (CVE-2015-1788)
+     [Andy Polyakov]
+
+  *) Exploitable out-of-bounds read in X509_cmp_time
+
+     X509_cmp_time does not properly check the length of the ASN1_TIME
+     string and can read a few bytes out of bounds. In addition,
+     X509_cmp_time accepts an arbitrary number of fractional seconds in the
+     time string.
+
+     An attacker can use this to craft malformed certificates and CRLs of
+     various sizes and potentially cause a segmentation fault, resulting in
+     a DoS on applications that verify certificates or CRLs. TLS clients
+     that verify CRLs are affected. TLS clients and servers with client
+     authentication enabled may be affected if they use custom verification
+     callbacks.
+
+     This issue was reported to OpenSSL by Robert Swiecki (Google), and
+     independently by Hanno B?ck.
+     (CVE-2015-1789)
+     [Emilia K?sper]
+
+  *) PKCS7 crash with missing EnvelopedContent
+
+     The PKCS#7 parsing code does not handle missing inner EncryptedContent
+     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
+     with missing content and trigger a NULL pointer dereference on parsing.
+
+     Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
+     structures from untrusted sources are affected. OpenSSL clients and
+     servers are not affected.
+
+     This issue was reported to OpenSSL by Michal Zalewski (Google).
+     (CVE-2015-1790)
+     [Emilia K?sper]
+
+  *) CMS verify infinite loop with unknown hash function
+
+     When verifying a signedData message the CMS code can enter an infinite loop
+     if presented with an unknown hash function OID. This can be used to perform
+     denial of service against any system which verifies signedData messages using
+     the CMS code.
+     This issue was reported to OpenSSL by Johannes Bauer.
+     (CVE-2015-1792)
+     [Stephen Henson]
+
+  *) Race condition handling NewSessionTicket
+
+     If a NewSessionTicket is received by a multi-threaded client when attempting to
+     reuse a previous ticket then a race condition can occur potentially leading to
+     a double free of the ticket data.
+     (CVE-2015-1791)
+     [Matt Caswell]
+
  Changes between 1.0.0q and 1.0.0r [19 Mar 2015]
 
   *) Segmentation fault in ASN1_TYPE_cmp fix
diff --git a/NEWS b/NEWS
index e87b07f..99ba960 100644
--- a/NEWS
+++ b/NEWS
@@ -5,10 +5,18 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.0r and OpenSSL 1.0.0s [under development]
+  Major changes between OpenSSL 1.0.0s and OpenSSL 1.0.0t [under development]
 
       o
 
+  Major changes between OpenSSL 1.0.0r and OpenSSL 1.0.0s [11 Jun 2015]
+
+      o Malformed ECParameters causes infinite loop (CVE-2015-1788)
+      o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
+      o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
+      o CMS verify infinite loop with unknown hash function (CVE-2015-1792)
+      o Race condition handling NewSessionTicket (CVE-2015-1791)
+
   Major changes between OpenSSL 1.0.0q and OpenSSL 1.0.0r [19 Mar 2015]
 
       o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
diff --git a/README b/README
index 6a9fb12..2556b8c 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
 
- OpenSSL 1.0.0s-dev
+ OpenSSL 1.0.0t-dev
 
  Copyright (c) 1998-2011 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c
index d6f5c1a..e9e6a98 100644
--- a/crypto/cms/cms_smime.c
+++ b/crypto/cms/cms_smime.c
@@ -131,7 +131,7 @@ static void do_free_upto(BIO *f, BIO *upto)
             BIO_free(f);
             f = tbio;
         }
-        while (f != upto);
+        while (f && f != upto);
     } else
         BIO_free_all(f);
 }
diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index b5a8d27..5f79fb0 100644
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -26,11 +26,11 @@
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x10000130L
+# define OPENSSL_VERSION_NUMBER  0x10000140L
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0s-fips-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0t-fips-dev xx XXX xxxx"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0s-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0t-dev xx XXX xxxx"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 22cfb6c..4f5caf2 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -445,6 +445,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
     switch (i) {
     case NID_pkcs7_signed:
+        /*
+         * p7->d.sign->contents is a PKCS7 structure consisting of a contentType
+         * field and optional content.
+         * data_body is NULL if that structure has no (=detached) content
+         * or if the contentType is wrong (i.e., not "data").
+         */
         data_body = PKCS7_get_octet_string(p7->d.sign->contents);
         if (!PKCS7_is_detached(p7) && data_body == NULL) {
             PKCS7err(PKCS7_F_PKCS7_DATADECODE,
@@ -456,6 +462,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_signedAndEnveloped:
         rsk = p7->d.signed_and_enveloped->recipientinfo;
         md_sk = p7->d.signed_and_enveloped->md_algs;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.signed_and_enveloped->enc_data->enc_data;
         enc_alg = p7->d.signed_and_enveloped->enc_data->algorithm;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
@@ -468,6 +475,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_enveloped:
         rsk = p7->d.enveloped->recipientinfo;
         enc_alg = p7->d.enveloped->enc_data->algorithm;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.enveloped->enc_data->enc_data;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
         if (evp_cipher == NULL) {
@@ -481,6 +489,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         goto err;
     }
 
+    /* Detached content must be supplied via in_bio instead. */
+    if (data_body == NULL && in_bio == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT);
+        goto err;
+    }
+
     /* We will be checking the signature */
     if (md_sk != NULL) {
         for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
@@ -623,7 +637,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         etmp = NULL;
     }
 #if 1
-    if (PKCS7_is_detached(p7) || (in_bio != NULL)) {
+    if (in_bio != NULL) {
         bio = in_bio;
     } else {
 # if 0
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 559b5cd..b356228 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -1604,47 +1604,84 @@ int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
     ASN1_TIME atm;
     long offset;
     char buff1[24], buff2[24], *p;
-    int i, j;
+    int i, j, remaining;
 
     p = buff1;
-    i = ctm->length;
+    remaining = ctm->length;
     str = (char *)ctm->data;
+    /*
+     * Note that the following (historical) code allows much more slack in the
+     * time format than RFC5280. In RFC5280, the representation is fixed:
+     * UTCTime: YYMMDDHHMMSSZ
+     * GeneralizedTime: YYYYMMDDHHMMSSZ
+     */
     if (ctm->type == V_ASN1_UTCTIME) {
-        if ((i < 11) || (i > 17))
+        /* YYMMDDHHMM[SS]Z or YYMMDDHHMM[SS](+-)hhmm */
+        int min_length = sizeof("YYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYMMDDHHMMSS+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 10);
         p += 10;
         str += 10;
+        remaining -= 10;
     } else {
-        if (i < 13)
+        /* YYYYMMDDHHMM[SS[.fff]]Z or YYYYMMDDHHMM[SS[.f[f[f]]]](+-)hhmm */
+        int min_length = sizeof("YYYYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYYYMMDDHHMMSS.fff+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 12);
         p += 12;
         str += 12;
+        remaining -= 12;
     }
 
     if ((*str == 'Z') || (*str == '-') || (*str == '+')) {
         *(p++) = '0';
         *(p++) = '0';
     } else {
+        /* SS (seconds) */
+        if (remaining < 2)
+            return 0;
         *(p++) = *(str++);
         *(p++) = *(str++);
-        /* Skip any fractional seconds... */
-        if (*str == '.') {
+        remaining -= 2;
+        /*
+         * Skip any (up to three) fractional seconds...
+         * TODO(emilia): in RFC5280, fractional seconds are forbidden.
+         * Can we just kill them altogether?
+         */
+        if (remaining && *str == '.') {
             str++;
-            while ((*str >= '0') && (*str <= '9'))
-                str++;
+            remaining--;
+            for (i = 0; i < 3 && remaining; i++, str++, remaining--) {
+                if (*str < '0' || *str > '9')
+                    break;
+            }
         }
 
     }
     *(p++) = 'Z';
     *(p++) = '\0';
 
-    if (*str == 'Z')
+    /* We now need either a terminating 'Z' or an offset. */
+    if (!remaining)
+        return 0;
+    if (*str == 'Z') {
+        if (remaining != 1)
+            return 0;
         offset = 0;
-    else {
+    } else {
+        /* (+-)HHMM */
         if ((*str != '+') && (*str != '-'))
             return 0;
+        /* Historical behaviour: the (+-)hhmm offset is forbidden in RFC5280. */
+        if (remaining != 5)
+            return 0;
+        if (str[1] < '0' || str[1] > '9' || str[2] < '0' || str[2] > '9' ||
+            str[3] < '0' || str[3] > '9' || str[4] < '0' || str[4] > '9')
+            return 0;
         offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60;
         offset += (str[3] - '0') * 10 + (str[4] - '0');
         if (*str == '-')
diff --git a/openssl.spec b/openssl.spec
index a85f0fe..e282aca 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -6,7 +6,7 @@ Release: 1
 
 Summary: Secure Sockets Layer and cryptography libraries and tools
 Name: openssl
-Version: 1.0.0s
+Version: 1.0.0t
 Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
 License: OpenSSL
 Group: System Environment/Libraries

From matt at openssl.org  Thu Jun 11 14:44:23 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:44:23 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8-stable update
Message-ID: <1434033863.504035.12804.nullmailer@dev.openssl.org>

The branch OpenSSL_0_9_8-stable has been updated
       via  2c9dfa18aacdd22537ced0815d0a53532c019d5b (commit)
       via  0823ddc56e9aaa1de6c4f57bb45457d5eeca404d (commit)
       via  ad6567965dbab184a7e9e84212c6d4f9f9e24519 (commit)
       via  582f1f41d49b5bf5ceaca241356d5f9c986f230f (commit)
       via  fa57f74a3941db6b2efb2f43c6add914ec83db20 (commit)
       via  92f9a8bf3844359bb50d86dab92bc24b074d350d (commit)
      from  39bcfb129e816de00bf2170c3497e8104767beb7 (commit)


- Log -----------------------------------------------------------------
commit 2c9dfa18aacdd22537ced0815d0a53532c019d5b
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 15:23:16 2015 +0100

    Prepare for 0.9.8zh-dev
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit 0823ddc56e9aaa1de6c4f57bb45457d5eeca404d
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Jun 11 15:20:22 2015 +0100

    Prepare for 0.9.8zg release
    
    Reviewed-by: Stephen Henson <steve at openssl.org>

commit ad6567965dbab184a7e9e84212c6d4f9f9e24519
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Jun 10 11:49:31 2015 +0100

    Update CHANGES and NEWS
    
    Updates to CHANGES and NEWS to take account of the latest security fixes.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 582f1f41d49b5bf5ceaca241356d5f9c986f230f
Author: Emilia Kasper <emilia at openssl.org>
Date:   Tue May 12 19:00:30 2015 +0200

    PKCS#7: Fix NULL dereference with missing EncryptedContent.
    
    CVE-2015-1790
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit fa57f74a3941db6b2efb2f43c6add914ec83db20
Author: Emilia Kasper <emilia at openssl.org>
Date:   Wed Apr 8 16:56:43 2015 +0200

    Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
    
    Also tighten X509_cmp_time to reject more than three fractional
    seconds in the time; and to reject trailing garbage after the offset.
    
    CVE-2015-1789
    
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit 92f9a8bf3844359bb50d86dab92bc24b074d350d
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Fri Jun 5 12:11:25 2015 +0100

    Fix infinite loop in CMS
    
    Fix loop in do_free_upto if cmsbio is NULL: this will happen when attempting
    to verify and a digest is not recognised. Reported by Johannes Bauer.
    
    CVE-2015-1792
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                 | 70 ++++++++++++++++++++++++++++++++++++++++++++++++-
 NEWS                    | 10 ++++++-
 README                  |  2 +-
 crypto/cms/cms_smime.c  |  2 +-
 crypto/opensslv.h       |  6 ++---
 crypto/pkcs7/pk7_doit.c | 16 ++++++++++-
 crypto/x509/x509_vfy.c  | 57 +++++++++++++++++++++++++++++++++-------
 openssl.spec            |  2 +-
 8 files changed, 146 insertions(+), 19 deletions(-)

diff --git a/CHANGES b/CHANGES
index c1bb2af..ed2f0ec 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,10 +2,78 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.8zf and 0.9.8zg [xx XXX xxxx]
+ Changes between 0.9.8zg and 0.9.8zh [xx XXX xxxx]
 
   *)
 
+ Changes between 0.9.8zf and 0.9.8zg [11 Jun 2015]
+
+  *) Malformed ECParameters causes infinite loop
+
+     When processing an ECParameters structure OpenSSL enters an infinite loop
+     if the curve specified is over a specially malformed binary polynomial
+     field.
+
+     This can be used to perform denial of service against any
+     system which processes public keys, certificate requests or
+     certificates.  This includes TLS clients and TLS servers with
+     client authentication enabled.
+
+     This issue was reported to OpenSSL by Joseph Barr-Pixton.
+     (CVE-2015-1788)
+     [Andy Polyakov]
+
+  *) Exploitable out-of-bounds read in X509_cmp_time
+
+     X509_cmp_time does not properly check the length of the ASN1_TIME
+     string and can read a few bytes out of bounds. In addition,
+     X509_cmp_time accepts an arbitrary number of fractional seconds in the
+     time string.
+
+     An attacker can use this to craft malformed certificates and CRLs of
+     various sizes and potentially cause a segmentation fault, resulting in
+     a DoS on applications that verify certificates or CRLs. TLS clients
+     that verify CRLs are affected. TLS clients and servers with client
+     authentication enabled may be affected if they use custom verification
+     callbacks.
+
+     This issue was reported to OpenSSL by Robert Swiecki (Google), and
+     independently by Hanno B?ck.
+     (CVE-2015-1789)
+     [Emilia K?sper]
+
+  *) PKCS7 crash with missing EnvelopedContent
+
+     The PKCS#7 parsing code does not handle missing inner EncryptedContent
+     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
+     with missing content and trigger a NULL pointer dereference on parsing.
+
+     Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
+     structures from untrusted sources are affected. OpenSSL clients and
+     servers are not affected.
+
+     This issue was reported to OpenSSL by Michal Zalewski (Google).
+     (CVE-2015-1790)
+     [Emilia K?sper]
+
+  *) CMS verify infinite loop with unknown hash function
+
+     When verifying a signedData message the CMS code can enter an infinite loop
+     if presented with an unknown hash function OID. This can be used to perform
+     denial of service against any system which verifies signedData messages using
+     the CMS code.
+     This issue was reported to OpenSSL by Johannes Bauer.
+     (CVE-2015-1792)
+     [Stephen Henson]
+
+  *) Race condition handling NewSessionTicket
+
+     If a NewSessionTicket is received by a multi-threaded client when attempting to
+     reuse a previous ticket then a race condition can occur potentially leading to
+     a double free of the ticket data.
+     (CVE-2015-1791)
+     [Matt Caswell]
+
  Changes between 0.9.8ze and 0.9.8zf [19 Mar 2015]
 
   *) Segmentation fault in ASN1_TYPE_cmp fix
diff --git a/NEWS b/NEWS
index 0422981..4ffbbab 100644
--- a/NEWS
+++ b/NEWS
@@ -5,10 +5,18 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 0.9.8zf and OpenSSL 0.9.8zg [under development]
+  Major changes between OpenSSL 0.9.8zg and OpenSSL 0.9.8zh [under development]
 
       o
 
+  Major changes between OpenSSL 0.9.8zf and OpenSSL 0.9.8zg [11 Jun 2015]
+
+      o Malformed ECParameters causes infinite loop (CVE-2015-1788)
+      o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
+      o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
+      o CMS verify infinite loop with unknown hash function (CVE-2015-1792)
+      o Race condition handling NewSessionTicket (CVE-2015-1791)
+
   Major changes between OpenSSL 0.9.8ze and OpenSSL 0.9.8zf [19 Mar 2015]
 
       o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
diff --git a/README b/README
index b4c4a21..5ca30cf 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
 
- OpenSSL 0.9.8zg-dev
+ OpenSSL 0.9.8zh-dev
 
  Copyright (c) 1998-2011 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c
index ecb05c4..9717789 100644
--- a/crypto/cms/cms_smime.c
+++ b/crypto/cms/cms_smime.c
@@ -131,7 +131,7 @@ static void do_free_upto(BIO *f, BIO *upto)
             BIO_free(f);
             f = tbio;
         }
-        while (f != upto);
+        while (f && f != upto);
     } else
         BIO_free_all(f);
 }
diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index fa12139..9aadf3e 100644
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -26,11 +26,11 @@
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x00908200L
+# define OPENSSL_VERSION_NUMBER  0x00908210L
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.8zg-fips-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.8zh-fips-dev xx XXX xxxx"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.8zg-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.8zh-dev xx XXX xxxx"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index db134dd..0a12f03 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -359,12 +359,19 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
     switch (i) {
     case NID_pkcs7_signed:
+        /*
+         * p7->d.sign->contents is a PKCS7 structure consisting of a contentType
+         * field and optional content.
+         * data_body is NULL if that structure has no (=detached) content
+         * or if the contentType is wrong (i.e., not "data").
+         */
         data_body = PKCS7_get_octet_string(p7->d.sign->contents);
         md_sk = p7->d.sign->md_algs;
         break;
     case NID_pkcs7_signedAndEnveloped:
         rsk = p7->d.signed_and_enveloped->recipientinfo;
         md_sk = p7->d.signed_and_enveloped->md_algs;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.signed_and_enveloped->enc_data->enc_data;
         enc_alg = p7->d.signed_and_enveloped->enc_data->algorithm;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
@@ -377,6 +384,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     case NID_pkcs7_enveloped:
         rsk = p7->d.enveloped->recipientinfo;
         enc_alg = p7->d.enveloped->enc_data->algorithm;
+        /* data_body is NULL if the optional EncryptedContent is missing. */
         data_body = p7->d.enveloped->enc_data->enc_data;
         evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
         if (evp_cipher == NULL) {
@@ -390,6 +398,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         goto err;
     }
 
+    /* Detached content must be supplied via in_bio instead. */
+    if (data_body == NULL && in_bio == NULL) {
+        PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT);
+        goto err;
+    }
+
     /* We will be checking the signature */
     if (md_sk != NULL) {
         for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
@@ -557,7 +571,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         etmp = NULL;
     }
 #if 1
-    if (PKCS7_is_detached(p7) || (in_bio != NULL)) {
+    if (in_bio != NULL) {
         bio = in_bio;
     } else {
 # if 0
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 4fa493c..5269cc1 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -1007,47 +1007,84 @@ int X509_cmp_time(ASN1_TIME *ctm, time_t *cmp_time)
     ASN1_TIME atm;
     long offset;
     char buff1[24], buff2[24], *p;
-    int i, j;
+    int i, j, remaining;
 
     p = buff1;
-    i = ctm->length;
+    remaining = ctm->length;
     str = (char *)ctm->data;
+    /*
+     * Note that the following (historical) code allows much more slack in the
+     * time format than RFC5280. In RFC5280, the representation is fixed:
+     * UTCTime: YYMMDDHHMMSSZ
+     * GeneralizedTime: YYYYMMDDHHMMSSZ
+     */
     if (ctm->type == V_ASN1_UTCTIME) {
-        if ((i < 11) || (i > 17))
+        /* YYMMDDHHMM[SS]Z or YYMMDDHHMM[SS](+-)hhmm */
+        int min_length = sizeof("YYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYMMDDHHMMSS+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 10);
         p += 10;
         str += 10;
+        remaining -= 10;
     } else {
-        if (i < 13)
+        /* YYYYMMDDHHMM[SS[.fff]]Z or YYYYMMDDHHMM[SS[.f[f[f]]]](+-)hhmm */
+        int min_length = sizeof("YYYYMMDDHHMMZ") - 1;
+        int max_length = sizeof("YYYYMMDDHHMMSS.fff+hhmm") - 1;
+        if (remaining < min_length || remaining > max_length)
             return 0;
         memcpy(p, str, 12);
         p += 12;
         str += 12;
+        remaining -= 12;
     }
 
     if ((*str == 'Z') || (*str == '-') || (*str == '+')) {
         *(p++) = '0';
         *(p++) = '0';
     } else {
+        /* SS (seconds) */
+        if (remaining < 2)
+            return 0;
         *(p++) = *(str++);
         *(p++) = *(str++);
-        /* Skip any fractional seconds... */
-        if (*str == '.') {
+        remaining -= 2;
+        /*
+         * Skip any (up to three) fractional seconds...
+         * TODO(emilia): in RFC5280, fractional seconds are forbidden.
+         * Can we just kill them altogether?
+         */
+        if (remaining && *str == '.') {
             str++;
-            while ((*str >= '0') && (*str <= '9'))
-                str++;
+            remaining--;
+            for (i = 0; i < 3 && remaining; i++, str++, remaining--) {
+                if (*str < '0' || *str > '9')
+                    break;
+            }
         }
 
     }
     *(p++) = 'Z';
     *(p++) = '\0';
 
-    if (*str == 'Z')
+    /* We now need either a terminating 'Z' or an offset. */
+    if (!remaining)
+        return 0;
+    if (*str == 'Z') {
+        if (remaining != 1)
+            return 0;
         offset = 0;
-    else {
+    } else {
+        /* (+-)HHMM */
         if ((*str != '+') && (*str != '-'))
             return 0;
+        /* Historical behaviour: the (+-)hhmm offset is forbidden in RFC5280. */
+        if (remaining != 5)
+            return 0;
+        if (str[1] < '0' || str[1] > '9' || str[2] < '0' || str[2] > '9' ||
+            str[3] < '0' || str[3] > '9' || str[4] < '0' || str[4] > '9')
+            return 0;
         offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60;
         offset += (str[3] - '0') * 10 + (str[4] - '0');
         if (*str == '-')
diff --git a/openssl.spec b/openssl.spec
index ff48b84..12e0705 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -6,7 +6,7 @@ Release: 1
 
 Summary: Secure Sockets Layer and cryptography libraries and tools
 Name: openssl
-Version: 0.9.8zg
+Version: 0.9.8zh
 Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
 License: OpenSSL
 Group: System Environment/Libraries

From matt at openssl.org  Thu Jun 11 14:44:39 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:44:39 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_0_9_8zg create
Message-ID: <1434033879.792369.15393.nullmailer@dev.openssl.org>

The annotated tag OpenSSL_0_9_8zg has been created
        at  3fe449360696b4433037b4f2b50845939fc90857 (tag)
   tagging  0823ddc56e9aaa1de6c4f57bb45457d5eeca404d (commit)
  replaces  OpenSSL_0_9_8zf
 tagged by  Matt Caswell
        on  Thu Jun 11 15:20:22 2015 +0100

- Log -----------------------------------------------------------------
OpenSSL 0.9.8zg release tag

Dr. Stephen Henson (7):
      Make OCSP response verification more flexible.
      Don't set *pval to NULL in ASN1_item_ex_new.
      Fix encoding bug in i2c_ASN1_INTEGER
      PEM doc fixes
      check for error when creating PKCS#8 structure
      return correct NID for undefined object
      Fix infinite loop in CMS

Emilia Kasper (2):
      Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
      PKCS#7: Fix NULL dereference with missing EncryptedContent.

Matt Caswell (14):
      Prepare for 0.9.8zg-dev
      Check for ClientHello message overruns
      Fix ssl_get_prev_session overrun
      Reject negative shifts for BN_rshift and BN_lshift
      Fix off-by-one in BN_rand
      Clear state in DTLSv1_listen
      Fix race condition in NewSessionTicket
      Fix off-by-one error in BN_bn2hex
      Clean Kerberos pre-master secret
      Fix Kerberos issue in ssl_session_dup
      EC_POINT_is_on_curve does not return a boolean
      More ssl_session_dup fixes
      Update CHANGES and NEWS
      Prepare for 0.9.8zg release

Rich Salz (1):
      Add NULL checks from master

Richard Levitte (2):
      Have mkerr.pl treat already existing multiline string defs properly
      Add the macro OPENSSL_SYS_WIN64

Viktor Dukhovni (1):
      Code style: space after 'if'

-----------------------------------------------------------------------

From matt at openssl.org  Thu Jun 11 14:44:39 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:44:39 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0s create
Message-ID: <1434033879.880401.15410.nullmailer@dev.openssl.org>

The annotated tag OpenSSL_1_0_0s has been created
        at  6142b4e9c266e02ca659a275e6f97254e6e5bed1 (tag)
   tagging  a06ec5a26fdb24fd829abef54422d94521ddd14a (commit)
  replaces  OpenSSL_1_0_0r
 tagged by  Matt Caswell
        on  Thu Jun 11 15:13:36 2015 +0100

- Log -----------------------------------------------------------------
OpenSSL 1.0.0s release tag

Dr. Stephen Henson (9):
      Make OCSP response verification more flexible.
      Don't set *pval to NULL in ASN1_item_ex_new.
      Reject empty generation strings.
      Fix encoding bug in i2c_ASN1_INTEGER
      Limit depth of nested sequences when generating ASN.1
      PEM doc fixes
      check for error when creating PKCS#8 structure
      return correct NID for undefined object
      Fix infinite loop in CMS

Emilia Kasper (2):
      Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
      PKCS#7: Fix NULL dereference with missing EncryptedContent.

Gilles Khouzam (1):
      RT3820: Don't call GetDesktopWindow()

Loganaden Velvindron (1):
      Fix CRYPTO_strdup

Matt Caswell (16):
      Prepare for 1.0.0s-dev
      Check for ClientHello message overruns
      Fix ssl_get_prev_session overrun
      Reject negative shifts for BN_rshift and BN_lshift
      Fix off-by-one in BN_rand
      Clear state in DTLSv1_listen
      Fix race condition in NewSessionTicket
      Fix off-by-one error in BN_bn2hex
      Clean Kerberos pre-master secret
      Clean premaster_secret for GOST
      Remove misleading comment
      Fix Kerberos issue in ssl_session_dup
      EC_POINT_is_on_curve does not return a boolean
      More ssl_session_dup fixes
      Update CHANGES and NEWS
      Prepare for 1.0.0s release

Rich Salz (1):
      Add NULL checks from master

Richard Levitte (6):
      Fix the update target and remove duplicate file updates
      Missed a couple of spots in the update change
      Fix update and depend in engines/
      Have mkerr.pl treat already existing multiline string defs properly
      Add the macro OPENSSL_SYS_WIN64
      Correction of make depend merge error

Robert Swiecki (1):
      Don't add write errors into bytecounts

StudioEtrange (1):
      GitHub284: Fix typo in xx-32.pl scripts.

Viktor Dukhovni (1):
      Code style: space after 'if'

-----------------------------------------------------------------------

From matt at openssl.org  Thu Jun 11 14:44:40 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:44:40 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2b create
Message-ID: <1434033880.132313.15453.nullmailer@dev.openssl.org>

The annotated tag OpenSSL_1_0_2b has been created
        at  ca9e0fecf4f40d9c6933dcb934113aa93843a894 (tag)
   tagging  7b560c174dcd569795f5be66e0c091d1be440614 (commit)
  replaces  OpenSSL_1_0_2a
 tagged by  Matt Caswell
        on  Thu Jun 11 14:55:38 2015 +0100

- Log -----------------------------------------------------------------
OpenSSL 1.0.2b release tag

Andy Polyakov (18):
      sha/asm/sha256-armv4.pl: adapt for use in Linux kernel context.
      ec/asm/ecp_nistz256-x86_64.pl: update commentary with before-after performance data.
      aes/asm/aesv8-armx.pl: optimize for Cortex-A5x.
      sha/asm/sha*-armv8.pl: add Denver and X-Gene esults.
      modes/asm/ghashv8-armx.pl: up to 90% performance improvement.
      aes/asm/aesni-x86[_64].pl update.
      aes/asm/aesni-x86.pl: fix typo affecting Windows build.
      aes/asm/aesni-sha256-x86_64.pl: fix Windows compilation failure with old assembler.
      mk1mf.pl: replace chop for windows.
      bn/asm/vis3-mont.pl: fix intermittent EC failures on SPARC T3.
      bn/bn_gf2m.c: appease STACK, unstable code detector.
      bn/asm/x86_64-mont5.pl: fix valgrind error.
      bn/bn_lcl.h: fix MIPS-specific gcc version check.
      Configure: replace -mv8 with -mcpu=v8 in SPARC config lines.
      Housekeeping 'make TABLE' update.
      gcm.c: address linker warning about OPENSSL_ia32cap_P size mismatch.
      e_aes_cbc_hmac_sha*.c: address linker warning about OPENSSL_ia32cap_P size mismatch.
      bn/bn_gf2m.c: avoid infinite loop wich malformed ECParamters.

Annie Yousar (1):
      RT3230: Better test for C identifier

Ben Laurie (1):
      Use cc instead of gcc so either clang or gcc is used as appropriate. Add clang     flags needed to keep it happy.

Billy Brumley (1):
      fix copy paste error in ec_GF2m function prototypes

Bjoern D. Rasmussen (1):
      Fix for memcpy() and strcmp() being undefined.

David Woodhouse (2):
      Add DTLS to SSL_get_version
      Add DTLS support to ssltest

Douglas E Engert (1):
      Ensure EC private keys retain leading zeros

Dr. Stephen Henson (15):
      Make OCSP response verification more flexible.
      Configuration file examples.
      Fix OCSP tests.
      Fix ECDH detection, add ECDH keyid test.
      Fix ECDH key identifier support.
      Don't set *pval to NULL in ASN1_item_ex_new.
      Reject empty generation strings.
      Limit depth of nested sequences when generating ASN.1
      Fix encoding bug in i2c_ASN1_INTEGER
      Fix verify algorithm.
      PEM doc fixes
      check for error when creating PKCS#8 structure
      make update
      return correct NID for undefined object
      Fix infinite loop in CMS

Emilia Kasper (22):
      Harden SSLv2-supporting servers against Bleichenbacher's attack.
      Use -Wall -Wextra with clang
      Error out immediately on empty ciphers list.
      make update
      Initialize variable
      Repair EAP-FAST session resumption
      Correctly set Z_is_one on the return value in the NISTZ256 implementation.
      Fix error checking and memory leaks in NISTZ256 precomputation.
      Error checking and memory leak fixes in NISTZ256.
      NISTZ256: set Z_is_one to boolean 0/1 as is customary.
      NISTZ256: don't swallow malloc errors
      NISTZ256: use EC_POINT API and check errors.
      s_server: Use 2048-bit DH parameters by default.
      dhparam: fix documentation
      Update documentation with Diffie-Hellman best practices.     - Do not advise generation of DH parameters with dsaparam to save     computation time.     - Promote use of custom parameters more, and explicitly forbid use of     built-in parameters weaker than 2048 bits.     - Advise the callback to ignore <keylength> - it is currently called     with 1024 bits, but this value can and should be safely ignored by     servers.
      client: reject handshakes with DH parameters < 768 bits.
      Only support >= 256-bit elliptic curves with ecdh_auto (server) or by default (client).
      Fix ssltest to use 1024-bit DHE parameters
      Use CRYPTO_memcmp when comparing authenticators
      Use CRYPTO_memcmp in s3_cbc.c
      Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
      PKCS#7: Fix NULL dereference with missing EncryptedContent.

Gilles Khouzam (1):
      RT3820: Don't call GetDesktopWindow()

Hanno B?ck (2):
      Fix uninitialized variable.
      Call of memcmp with null pointers in obj_cmp()

Jeffrey Walton (1):
      Explicitly mention PKCS5_PBKDF2_HMAC in EVP doc.

Kurt Cancemi (1):
      Add missing NULL check in X509V3_parse_list()

Kurt Roeckx (7):
      Don't send a for ServerKeyExchange for kDHr and kDHd
      X509_VERIFY_PARAM_free: Check param for NULL
      do_dirname: Don't change gen on failures
      Correctly check for export size limit
      Allow all curves when the client doesn't send an supported elliptic curves extension
      Properly check certificate in case of export ciphers.
      Only allow a temporary rsa key exchange when they key is larger than 512.

Loganaden Velvindron (1):
      Fix CRYPTO_strdup

Lubom (1):
      Lost alert in DTLS

Matt Caswell (65):
      Prepare for 1.0.2b-dev
      Add DTLS tests to make test
      Fix no-ec with no-ec2m
      Don't check curves that haven't been sent
      Ensure last_write_sequence is saved in DTLS1.2
      Add ticket length before buffering DTLS message
      Fix RAND_(pseudo_)?_bytes returns
      Add more HMAC tests
      Ensure that both the MD and key have been initialised before attempting to     create an HMAC
      Add HMAC test for invalid key len
      Fix HMAC to pass invalid key len test
      Fix bug in s_client. Previously default verify locations would only be loaded     if CAfile or CApath were also supplied and successfully loaded first.
      Check for ClientHello message overruns
      Fix ssl_get_prev_session overrun
      In certain situations the server provided certificate chain may no longer be     valid. However the issuer of the leaf, or some intermediate cert is in fact     in the trust store.
      Add flag to inhibit checking for alternate certificate chains. Setting this     behaviour will force behaviour as per previous versions of OpenSSL
      Add -no_alt_chains option to apps to implement the new     X509_V_FLAG_NO_ALT_CHAINS flag. Using this option means that when building     certificate chains, the first chain found will be the one used. Without this     flag, if the first chain found is not trusted then we will keep looking to     see if we can build an alternative chain instead.
      Add documentation for the -no_alt_chains option for various apps, as well as     the X509_V_FLAG_NO_ALT_CHAINS flag.
      Fix misc NULL derefs in sureware engine
      Fix return checks in GOST engine
      Revert "Fix verify algorithm."
      Add length sanity check in SSLv2 n_do_ssl_write()
      Sanity check DES_enc_write buffer length
      Sanity check EVP_CTRL_AEAD_TLS_AAD
      Sanity check EVP_EncodeUpdate buffer len
      Clarify logic in BIO_*printf functions
      Add sanity check in ssl3_cbc_digest_record
      Sanity check the return from final_finish_mac
      Add sanity check to ssl_get_prev_session
      Add sanity check to print_bin function
      Fix buffer overrun in RSA signing
      Remove libcrypto to libssl dependency
      Add Error state
      Add more error state transitions
      Add more error state transitions (client)
      Add more error state transitions (DTLS)
      Check sk_SSL_CIPHER_new_null return value
      Don't allow a CCS when expecting a CertificateVerify
      Reject negative shifts for BN_rshift and BN_lshift
      Fix off-by-one in BN_rand
      Remove export static DH ciphersuites
      Fix typo setting up certificate masks
      Don't send an alert if we've just received one
      Handle unsigned struct timeval members
      Fix error check in GOST engine
      Don't check for a negative SRP extension size
      Check the message type requested is the type received in DTLS
      Fix race condition in NewSessionTicket
      Fix compilation failure for some tool chains
      Fix DTLS session resumption
      Fix off-by-one error in BN_bn2hex
      Clean Kerberos pre-master secret
      Clean premaster_secret for GOST
      Remove misleading comment
      Fix Kerberos issue in ssl_session_dup
      Replace memset with OPENSSL_cleanse()
      Fix memory leaks in BIO_dup_chain()
      Tighten extension handling
      EC_POINT_is_on_curve does not return a boolean
      Fix leak in HMAC error path
      DTLS handshake message fragments musn't span packets
      More ssl_session_dup fixes
      Update CHANGES and NEWS
      make update
      Prepare for 1.0.2b release

Mike Frysinger (1):
      Fix malloc define typo

Olaf Johansson (1):
      GH249: Fix bad regexp in arg parsing.

Per Allansson (1):
      Fix IP_MTU_DISCOVER typo

Rich Salz (4):
      RT3776: Wrong size for malloc
      Fix cut/paste error
      Add NULL checks from master
      RT1207: document SSL_COMP_free_compression_methods.

Richard Levitte (15):
      Appease clang -Wempty-translation-unit
      Appease clang -Wgnu-statement-expression
      Appease clang -Wshadow
      Ignore the non-dll windows specific build directories
      Have mkerr.pl treat already existing multiline string defs properly
      Initialised 'ok' and redo the logic.
      RT2943: Check sizes if -iv and -K arguments
      Fix the update target and remove duplicate file updates
      Missed a couple of spots in the update change
      Fix update and depend in engines/
      Add the macro OPENSSL_SYS_WIN64
      Add and rearrange building of libraries
      When making libcrypto from apps or test, make sure to include engines
      Correction of make depend merge error
      make update

Robert Swiecki (1):
      Don't add write errors into bytecounts

Sergey Agievich (1):
      Add funtions to set item_sign and item_verify

StudioEtrange (1):
      GitHub284: Fix typo in xx-32.pl scripts.

Viktor Dukhovni (2):
      Code style: space after 'if'
      Fix typo in valid_star

-----------------------------------------------------------------------

From matt at openssl.org  Thu Jun 11 14:44:39 2015
From: matt at openssl.org (Matt Caswell)
Date: Thu, 11 Jun 2015 14:44:39 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1n create
Message-ID: <1434033879.996779.15437.nullmailer@dev.openssl.org>

The annotated tag OpenSSL_1_0_1n has been created
        at  42c2a7f2c7173883f008a9678444cbafe2032cf8 (tag)
   tagging  517899e6c8af47d4972dcf9b375386631f6c93f1 (commit)
  replaces  OpenSSL_1_0_1m
 tagged by  Matt Caswell
        on  Thu Jun 11 15:05:11 2015 +0100

- Log -----------------------------------------------------------------
OpenSSL 1.0.1n release tag

Andy Polyakov (7):
      Please Clang's sanitizer, addendum.
      mk1mf.pl: replace chop for windows.
      md32_common.h: backport ICC fix.
      bn/bn_lcl.h: fix MIPS-specific gcc version check.
      Configure: replace -mv8 with -mcpu=v8 in SPARC config lines.
      Housekeeping 'make TABLE' update.
      bn/bn_gf2m.c: avoid infinite loop wich malformed ECParamters.

Annie Yousar (1):
      RT3230: Better test for C identifier

Billy Brumley (1):
      fix copy paste error in ec_GF2m function prototypes

Bjoern D. Rasmussen (1):
      Fix for memcpy() and strcmp() being undefined.

Douglas E Engert (1):
      Ensure EC private keys retain leading zeros

Dr. Stephen Henson (10):
      Make OCSP response verification more flexible.
      Configuration file examples.
      Don't set *pval to NULL in ASN1_item_ex_new.
      Reject empty generation strings.
      Limit depth of nested sequences when generating ASN.1
      Fix encoding bug in i2c_ASN1_INTEGER
      PEM doc fixes
      check for error when creating PKCS#8 structure
      return correct NID for undefined object
      Fix infinite loop in CMS

Emilia Kasper (16):
      Fix uninitialized variable warning
      Harden SSLv2-supporting servers against Bleichenbacher's attack.
      Error out immediately on empty ciphers list.
      make update
      Initialize variable
      Repair EAP-FAST session resumption
      s_server: Use 2048-bit DH parameters by default.
      dhparam: set the default to 2048 bits
      dhparam: fix documentation
      Update documentation with Diffie-Hellman best practices.     - Do not advise generation of DH parameters with dsaparam to save     computation time.     - Promote use of custom parameters more, and explicitly forbid use of     built-in parameters weaker than 2048 bits.     - Advise the callback to ignore <keylength> - it is currently called     with 1024 bits, but this value can and should be safely ignored by     servers.
      client: reject handshakes with DH parameters < 768 bits.
      Fix ssltest to use 1024-bit DHE parameters
      Use CRYPTO_memcmp when comparing authenticators
      Use CRYPTO_memcmp in s3_cbc.c
      Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
      PKCS#7: Fix NULL dereference with missing EncryptedContent.

Gilles Khouzam (1):
      RT3820: Don't call GetDesktopWindow()

Hanno B?ck (2):
      Fix uninitialized variable.
      Call of memcmp with null pointers in obj_cmp()

John Foley (1):
      Fix intermittent s_server issues with ECDHE

Kurt Cancemi (1):
      Add missing NULL check in X509V3_parse_list()

Kurt Roeckx (6):
      Don't send a for ServerKeyExchange for kDHr and kDHd
      X509_VERIFY_PARAM_free: Check param for NULL
      do_dirname: Don't change gen on failures
      Correctly check for export size limit
      Properly check certificate in case of export ciphers.
      Only allow a temporary rsa key exchange when they key is larger than 512.

Loganaden Velvindron (1):
      Fix CRYPTO_strdup

Lubom (1):
      Lost alert in DTLS

Matt Caswell (54):
      Prepare for 1.0.1n-dev
      Fix RAND_(pseudo_)?_bytes returns
      Add more HMAC tests
      Ensure that both the MD and key have been initialised before attempting to     create an HMAC
      Add HMAC test for invalid key len
      Fix HMAC to pass invalid key len test
      Fix bug in s_client. Previously default verify locations would only be loaded     if CAfile or CApath were also supplied and successfully loaded first.
      Check for ClientHello message overruns
      Fix ssl_get_prev_session overrun
      Fix misc NULL derefs in sureware engine
      Fix return checks in GOST engine
      Add length sanity check in SSLv2 n_do_ssl_write()
      Sanity check DES_enc_write buffer length
      Sanity check EVP_CTRL_AEAD_TLS_AAD
      Sanity check EVP_EncodeUpdate buffer len
      Clarify logic in BIO_*printf functions
      Add sanity check in ssl3_cbc_digest_record
      Sanity check the return from final_finish_mac
      Add sanity check to ssl_get_prev_session
      Add sanity check to print_bin function
      Fix buffer overrun in RSA signing
      Add Error state
      Add more error state transitions
      Add more error state transitions (client)
      Add more error state transitions (DTLS)
      Check sk_SSL_CIPHER_new_null return value
      Don't allow a CCS when expecting a CertificateVerify
      In certain situations the server provided certificate chain may no longer be valid. However the issuer of the leaf, or some intermediate cert is in fact in the trust store.
      Add flag to inhibit checking for alternate certificate chains. Setting this behaviour will force behaviour as per previous versions of OpenSSL
      Add -no_alt_chains option to apps to implement the new X509_V_FLAG_NO_ALT_CHAINS flag. Using this option means that when building certificate chains, the first chain found will be the one used. Without this flag, if the first chain found is not trusted then we will keep looking to see if we can build an alternative chain instead.
      Add documentation for the -no_alt_chains option for various apps, as well as the X509_V_FLAG_NO_ALT_CHAINS flag.
      Reject negative shifts for BN_rshift and BN_lshift
      Fix off-by-one in BN_rand
      Don't send an alert if we've just received one
      Handle unsigned struct timeval members
      Fix error check in GOST engine
      Don't check for a negative SRP extension size
      Check the message type requested is the type received in DTLS
      Clear state in DTLSv1_listen
      Fix race condition in NewSessionTicket
      Fix off-by-one error in BN_bn2hex
      Clean Kerberos pre-master secret
      Clean premaster_secret for GOST
      Remove misleading comment
      Fix Kerberos issue in ssl_session_dup
      Replace memset with OPENSSL_cleanse()
      Fix memory leaks in BIO_dup_chain()
      Tighten extension handling
      EC_POINT_is_on_curve does not return a boolean
      Fix leak in HMAC error path
      DTLS handshake message fragments musn't span packets
      More ssl_session_dup fixes
      Update CHANGES and NEWS
      Prepare for 1.0.1n release

Mike Frysinger (1):
      Fix malloc define typo

Rich Salz (1):
      Add NULL checks from master

Richard Levitte (11):
      Ignore the non-dll windows specific build directories
      Have mkerr.pl treat already existing multiline string defs properly
      Initialised 'ok' and redo the logic.
      RT2943: Check sizes if -iv and -K arguments
      Fix the update target and remove duplicate file updates
      Missed a couple of spots in the update change
      Fix update and depend in engines/
      Add the macro OPENSSL_SYS_WIN64
      Add and rearrange building of libraries
      When making libcrypto from apps or test, make sure to include engines
      Correction of make depend merge error

Robert Swiecki (1):
      Don't add write errors into bytecounts

StudioEtrange (1):
      GitHub284: Fix typo in xx-32.pl scripts.

Viktor Dukhovni (1):
      Code style: space after 'if'

-----------------------------------------------------------------------

From mark at openssl.org  Thu Jun 11 17:27:23 2015
From: mark at openssl.org (Mark J. Cox)
Date: Thu, 11 Jun 2015 17:27:23 +0000
Subject: [openssl-commits] [web]  master update
Message-ID: <1434043643.384733.8690.nullmailer@dev.openssl.org>

The branch master has been updated
       via  5484ba29155b81fd2fcfe49f8d723ef2ff66d6be (commit)
      from  ad1b4eeeeb7c92e089bb0e7db0ef9041433f5a28 (commit)


- Log -----------------------------------------------------------------
commit 5484ba29155b81fd2fcfe49f8d723ef2ff66d6be
Author: Mark J. Cox <mark at awe.com>
Date:   Thu Jun 11 18:26:01 2015 +0100

    Doesn't need cve- prefix

-----------------------------------------------------------------------

Summary of changes:
 news/vulnerabilities.xml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/news/vulnerabilities.xml b/news/vulnerabilities.xml
index a222fba..a726124 100644
--- a/news/vulnerabilities.xml
+++ b/news/vulnerabilities.xml
@@ -7,7 +7,7 @@
 
 <security updated="20150611">
   <issue public="20150611">
-    <cve name="CVE-2015-1788"/>
+    <cve name="2015-1788"/>
     <affects base="0.9.8" version="0.9.8"/>
     <affects base="0.9.8" version="0.9.8a"/>
     <affects base="0.9.8" version="0.9.8b"/>
@@ -67,7 +67,7 @@
   </issue>
 
   <issue public="20150611">
-    <cve name="CVE-2015-1789"/>
+    <cve name="2015-1789"/>
     <affects base="0.9.8" version="0.9.8"/>
     <affects base="0.9.8" version="0.9.8a"/>
     <affects base="0.9.8" version="0.9.8b"/>
@@ -157,7 +157,7 @@
   </issue>
 
   <issue public="20150611">
-    <cve name="CVE-2015-1790"/>
+    <cve name="2015-1790"/>
     <affects base="0.9.8" version="0.9.8"/>
     <affects base="0.9.8" version="0.9.8a"/>
     <affects base="0.9.8" version="0.9.8b"/>
@@ -243,7 +243,7 @@
   </issue>
 
   <issue public="20150611">
-    <cve name="CVE-2015-1792"/>
+    <cve name="2015-1792"/>
     <affects base="0.9.8" version="0.9.8"/>
     <affects base="0.9.8" version="0.9.8a"/>
     <affects base="0.9.8" version="0.9.8b"/>
@@ -327,7 +327,7 @@
   </issue>
 
   <issue public="20150602">
-    <cve name="CVE-2015-1791"/>
+    <cve name="2015-1791"/>
     <affects base="0.9.8" version="0.9.8"/>
     <affects base="0.9.8" version="0.9.8a"/>
     <affects base="0.9.8" version="0.9.8b"/>
@@ -409,7 +409,7 @@
   </issue>
 
   <issue public="20150611">
-    <cve name="CVE-2014-8176"/>
+    <cve name="2014-8176"/>
     <affects base="0.9.8" version="0.9.8"/>
     <affects base="0.9.8" version="0.9.8a"/>
     <affects base="0.9.8" version="0.9.8b"/>

From mark at openssl.org  Thu Jun 11 17:29:31 2015
From: mark at openssl.org (Mark J. Cox)
Date: Thu, 11 Jun 2015 17:29:31 +0000
Subject: [openssl-commits] [web]  master update
Message-ID: <1434043771.424810.16266.nullmailer@dev.openssl.org>

The branch master has been updated
       via  7943146bf2a70af7d5d2bf376aab497fe4238603 (commit)
      from  5484ba29155b81fd2fcfe49f8d723ef2ff66d6be (commit)


- Log -----------------------------------------------------------------
commit 7943146bf2a70af7d5d2bf376aab497fe4238603
Author: Mark J. Cox <mark at awe.com>
Date:   Thu Jun 11 18:29:07 2015 +0100

    Fied in 1.0.2b

-----------------------------------------------------------------------

Summary of changes:
 news/vulnerabilities.xml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/news/vulnerabilities.xml b/news/vulnerabilities.xml
index a726124..aaacfdc 100644
--- a/news/vulnerabilities.xml
+++ b/news/vulnerabilities.xml
@@ -48,7 +48,7 @@
     <affects base="1.0.1" version="1.0.1m"/>
     <affects base="1.0.2" version="1.0.2"/>
     <affects base="1.0.2" version="1.0.2a"/>
-    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.2" version="1.0.2b" date="20150611"/>
     <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
     <fixed base="1.0.0" version="1.0.0e" date="20110906"/>
     <fixed base="0.9.8" version="0.9.8s" date="20120104"/>
@@ -134,7 +134,7 @@
     <affects base="1.0.1" version="1.0.1m"/>
     <affects base="1.0.2" version="1.0.2"/>
     <affects base="1.0.2" version="1.0.2a"/>
-    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.2" version="1.0.2b" date="20150611"/>
     <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
     <fixed base="1.0.0" version="1.0.0s" date="20150611"/>
     <fixed base="0.9.8" version="0.9.8zg" date="20150611"/>
@@ -224,7 +224,7 @@
     <affects base="1.0.1" version="1.0.1m"/>
     <affects base="1.0.2" version="1.0.2"/>
     <affects base="1.0.2" version="1.0.2a"/>
-    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.2" version="1.0.2b" date="20150611"/>
     <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
     <fixed base="1.0.0" version="1.0.0s" date="20150611"/>
     <fixed base="0.9.8" version="0.9.8zg" date="20150611"/>
@@ -310,7 +310,7 @@
     <affects base="1.0.1" version="1.0.1m"/>
     <affects base="1.0.2" version="1.0.2"/>
     <affects base="1.0.2" version="1.0.2a"/>
-    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.2" version="1.0.2b" date="20150611"/>
     <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
     <fixed base="1.0.0" version="1.0.0s" date="20150611"/>
     <fixed base="0.9.8" version="0.9.8zg" date="20150611"/>
@@ -394,7 +394,7 @@
     <affects base="1.0.1" version="1.0.1m"/>
     <affects base="1.0.2" version="1.0.2"/>
     <affects base="1.0.2" version="1.0.2a"/>
-    <fixed base="1.0.2" version="1.0.2a" date="20150611"/>
+    <fixed base="1.0.2" version="1.0.2b" date="20150611"/>
     <fixed base="1.0.1" version="1.0.1n" date="20150611"/>
     <fixed base="1.0.0" version="1.0.0s" date="20150611"/>
     <fixed base="0.9.8" version="0.9.8zg" date="20150611"/>

From matt at openssl.org  Fri Jun 12 13:45:00 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 13:45:00 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434116700.104852.1313.nullmailer@dev.openssl.org>

The branch master has been updated
       via  4b464e7b46682f568a5df550426b0cf4b22e2485 (commit)
      from  063dccd027033401912d8c5e3f0f25b1f13de64b (commit)


- Log -----------------------------------------------------------------
commit 4b464e7b46682f568a5df550426b0cf4b22e2485
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 13:08:04 2015 +0100

    Fix ABI break with HMAC
    
    Recent HMAC changes broke ABI compatibility due to a new field in HMAC_CTX.
    This backs that change out, and does it a different way.
    
    Thanks to Timo Teras for the concept.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/hmac/hmac.c     | 20 ++++++++------------
 include/openssl/hmac.h |  1 -
 test/hmactest.c        |  7 ++++++-
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
index d50fabb..7699b0b 100644
--- a/crypto/hmac/hmac.c
+++ b/crypto/hmac/hmac.c
@@ -68,6 +68,10 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
     int i, j, reset = 0;
     unsigned char pad[HMAC_MAX_MD_CBLOCK];
 
+    /* If we are changing MD then we must have a key */
+    if (md != NULL && md != ctx->md && (key == NULL || len < 0))
+        return 0;
+
     if (md != NULL) {
         reset = 1;
         ctx->md = md;
@@ -77,9 +81,6 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         return 0;
     }
 
-    if (!ctx->key_init && key == NULL)
-        return 0;
-
     if (key != NULL) {
         reset = 1;
         j = M_EVP_MD_block_size(md);
@@ -101,7 +102,6 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         if (ctx->key_length != HMAC_MAX_MD_CBLOCK)
             memset(&ctx->key[ctx->key_length], 0,
                    HMAC_MAX_MD_CBLOCK - ctx->key_length);
-        ctx->key_init = 1;
     }
 
     if (reset) {
@@ -137,7 +137,7 @@ int HMAC_Init(HMAC_CTX *ctx, const void *key, int len, const EVP_MD *md)
 
 int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len)
 {
-    if (!ctx->key_init)
+    if (!ctx->md)
         return 0;
     return EVP_DigestUpdate(&ctx->md_ctx, data, len);
 }
@@ -147,7 +147,7 @@ int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
     unsigned int i;
     unsigned char buf[EVP_MAX_MD_SIZE];
 
-    if (!ctx->key_init)
+    if (!ctx->md)
         goto err;
 
     if (!EVP_DigestFinal_ex(&ctx->md_ctx, buf, &i))
@@ -168,7 +168,6 @@ void HMAC_CTX_init(HMAC_CTX *ctx)
     EVP_MD_CTX_init(&ctx->i_ctx);
     EVP_MD_CTX_init(&ctx->o_ctx);
     EVP_MD_CTX_init(&ctx->md_ctx);
-    ctx->key_init = 0;
     ctx->md = NULL;
 }
 
@@ -181,11 +180,8 @@ int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
         goto err;
     if (!EVP_MD_CTX_copy_ex(&dctx->md_ctx, &sctx->md_ctx))
         goto err;
-    dctx->key_init = sctx->key_init;
-    if (sctx->key_init) {
-        memcpy(dctx->key, sctx->key, HMAC_MAX_MD_CBLOCK);
-        dctx->key_length = sctx->key_length;
-    }
+    memcpy(dctx->key, sctx->key, HMAC_MAX_MD_CBLOCK);
+    dctx->key_length = sctx->key_length;
     dctx->md = sctx->md;
     return 1;
  err:
diff --git a/include/openssl/hmac.h b/include/openssl/hmac.h
index 61946fc..81aa49d 100644
--- a/include/openssl/hmac.h
+++ b/include/openssl/hmac.h
@@ -75,7 +75,6 @@ typedef struct hmac_ctx_st {
     EVP_MD_CTX o_ctx;
     unsigned int key_length;
     unsigned char key[HMAC_MAX_MD_CBLOCK];
-    int key_init;
 } HMAC_CTX;
 
 # define HMAC_size(e)    (EVP_MD_size((e)->md))
diff --git a/test/hmactest.c b/test/hmactest.c
index 13344d6..a9b829d 100644
--- a/test/hmactest.c
+++ b/test/hmactest.c
@@ -226,7 +226,12 @@ test5:
         err++;
         goto test6;
     }
-    if (!HMAC_Init_ex(&ctx, NULL, 0, EVP_sha256(), NULL)) {
+    if (HMAC_Init_ex(&ctx, NULL, 0, EVP_sha256(), NULL)) {
+        printf("Should disallow changing MD without a new key (test 5)\n");
+        err++;
+        goto test6;
+    }
+    if (!HMAC_Init_ex(&ctx, test[4].key, test[4].key_len, EVP_sha256(), NULL)) {
         printf("Failed to reinitialise HMAC (test 5)\n");
         err++;
         goto test6;

From matt at openssl.org  Fri Jun 12 13:45:09 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 13:45:09 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434116709.838871.2042.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  1030f89f5ea238820645e3d34049eb1bd30e81c4 (commit)
      from  b6ed9917314145d1133a3d571daa06f7d2fb66d2 (commit)


- Log -----------------------------------------------------------------
commit 1030f89f5ea238820645e3d34049eb1bd30e81c4
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 13:08:04 2015 +0100

    Fix ABI break with HMAC
    
    Recent HMAC changes broke ABI compatibility due to a new field in HMAC_CTX.
    This backs that change out, and does it a different way.
    
    Thanks to Timo Teras for the concept.
    
    Conflicts:
    	crypto/hmac/hmac.c
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/hmac/hmac.c     | 19 +++++++------------
 crypto/hmac/hmac.h     |  1 -
 crypto/hmac/hmactest.c |  7 ++++++-
 3 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
index 15a9a21..51a0a3e 100644
--- a/crypto/hmac/hmac.c
+++ b/crypto/hmac/hmac.c
@@ -97,6 +97,9 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
             return FIPS_hmac_init_ex(ctx, key, len, md, NULL);
     }
 #endif
+    /* If we are changing MD then we must have a key */
+    if (md != NULL && md != ctx->md && (key == NULL || len < 0))
+        return 0;
 
     if (md != NULL) {
         reset = 1;
@@ -107,9 +110,6 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         return 0;
     }
 
-    if (!ctx->key_init && key == NULL)
-        return 0;
-
     if (key != NULL) {
         reset = 1;
         j = EVP_MD_block_size(md);
@@ -131,7 +131,6 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         if (ctx->key_length != HMAC_MAX_MD_CBLOCK)
             memset(&ctx->key[ctx->key_length], 0,
                    HMAC_MAX_MD_CBLOCK - ctx->key_length);
-        ctx->key_init = 1;
     }
 
     if (reset) {
@@ -169,7 +168,7 @@ int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len)
     if (FIPS_mode() && !ctx->i_ctx.engine)
         return FIPS_hmac_update(ctx, data, len);
 #endif
-    if (!ctx->key_init)
+    if (!ctx->md)
         return 0;
 
     return EVP_DigestUpdate(&ctx->md_ctx, data, len);
@@ -184,7 +183,7 @@ int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
         return FIPS_hmac_final(ctx, md, len);
 #endif
 
-    if (!ctx->key_init)
+    if (!ctx->md)
         goto err;
 
     if (!EVP_DigestFinal_ex(&ctx->md_ctx, buf, &i))
@@ -205,7 +204,6 @@ void HMAC_CTX_init(HMAC_CTX *ctx)
     EVP_MD_CTX_init(&ctx->i_ctx);
     EVP_MD_CTX_init(&ctx->o_ctx);
     EVP_MD_CTX_init(&ctx->md_ctx);
-    ctx->key_init = 0;
     ctx->md = NULL;
 }
 
@@ -217,11 +215,8 @@ int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
         goto err;
     if (!EVP_MD_CTX_copy(&dctx->md_ctx, &sctx->md_ctx))
         goto err;
-    dctx->key_init = sctx->key_init;
-    if (sctx->key_init) {
-        memcpy(dctx->key, sctx->key, HMAC_MAX_MD_CBLOCK);
-        dctx->key_length = sctx->key_length;
-    }
+    memcpy(dctx->key, sctx->key, HMAC_MAX_MD_CBLOCK);
+    dctx->key_length = sctx->key_length;
     dctx->md = sctx->md;
     return 1;
  err:
diff --git a/crypto/hmac/hmac.h b/crypto/hmac/hmac.h
index f8e9f5e..b8b55cd 100644
--- a/crypto/hmac/hmac.h
+++ b/crypto/hmac/hmac.h
@@ -79,7 +79,6 @@ typedef struct hmac_ctx_st {
     EVP_MD_CTX o_ctx;
     unsigned int key_length;
     unsigned char key[HMAC_MAX_MD_CBLOCK];
-    int key_init;
 } HMAC_CTX;
 
 # define HMAC_size(e)    (EVP_MD_size((e)->md))
diff --git a/crypto/hmac/hmactest.c b/crypto/hmac/hmactest.c
index 86b6c25..271d0eb 100644
--- a/crypto/hmac/hmactest.c
+++ b/crypto/hmac/hmactest.c
@@ -233,7 +233,12 @@ test5:
         err++;
         goto test6;
     }
-    if (!HMAC_Init_ex(&ctx, NULL, 0, EVP_sha256(), NULL)) {
+    if (HMAC_Init_ex(&ctx, NULL, 0, EVP_sha256(), NULL)) {
+        printf("Should disallow changing MD without a new key (test 5)\n");
+        err++;
+        goto test6;
+    }
+    if (!HMAC_Init_ex(&ctx, test[4].key, test[4].key_len, EVP_sha256(), NULL)) {
         printf("Failed to reinitialise HMAC (test 5)\n");
         err++;
         goto test6;

From matt at openssl.org  Fri Jun 12 13:45:24 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 13:45:24 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434116724.121234.2278.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  fffcf87a550f76f83e4a17dd190c9c74833046e8 (commit)
      from  3adca975dc1175e76bc079306896a09692ed4c15 (commit)


- Log -----------------------------------------------------------------
commit fffcf87a550f76f83e4a17dd190c9c74833046e8
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 13:08:04 2015 +0100

    Fix ABI break with HMAC
    
    Recent HMAC changes broke ABI compatibility due to a new field in HMAC_CTX.
    This backs that change out, and does it a different way.
    
    Thanks to Timo Teras for the concept.
    
    Conflicts:
    	crypto/hmac/hmac.c
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/hmac/hmac.c     | 19 +++++++------------
 crypto/hmac/hmac.h     |  1 -
 crypto/hmac/hmactest.c |  7 ++++++-
 3 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
index 5925467..33d88be 100644
--- a/crypto/hmac/hmac.c
+++ b/crypto/hmac/hmac.c
@@ -87,6 +87,9 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
             return FIPS_hmac_init_ex(ctx, key, len, md, NULL);
     }
 #endif
+    /* If we are changing MD then we must have a key */
+    if (md != NULL && md != ctx->md && (key == NULL || len < 0))
+        return 0;
 
     if (md != NULL) {
         reset = 1;
@@ -97,9 +100,6 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         return 0;
     }
 
-    if (!ctx->key_init && key == NULL)
-        return 0;
-
     if (key != NULL) {
         reset = 1;
         j = EVP_MD_block_size(md);
@@ -121,7 +121,6 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         if (ctx->key_length != HMAC_MAX_MD_CBLOCK)
             memset(&ctx->key[ctx->key_length], 0,
                    HMAC_MAX_MD_CBLOCK - ctx->key_length);
-        ctx->key_init = 1;
     }
 
     if (reset) {
@@ -159,7 +158,7 @@ int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len)
     if (FIPS_mode() && !ctx->i_ctx.engine)
         return FIPS_hmac_update(ctx, data, len);
 #endif
-    if (!ctx->key_init)
+    if (!ctx->md)
         return 0;
 
     return EVP_DigestUpdate(&ctx->md_ctx, data, len);
@@ -174,7 +173,7 @@ int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
         return FIPS_hmac_final(ctx, md, len);
 #endif
 
-    if (!ctx->key_init)
+    if (!ctx->md)
         goto err;
 
     if (!EVP_DigestFinal_ex(&ctx->md_ctx, buf, &i))
@@ -195,7 +194,6 @@ void HMAC_CTX_init(HMAC_CTX *ctx)
     EVP_MD_CTX_init(&ctx->i_ctx);
     EVP_MD_CTX_init(&ctx->o_ctx);
     EVP_MD_CTX_init(&ctx->md_ctx);
-    ctx->key_init = 0;
     ctx->md = NULL;
 }
 
@@ -207,11 +205,8 @@ int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
         goto err;
     if (!EVP_MD_CTX_copy(&dctx->md_ctx, &sctx->md_ctx))
         goto err;
-    dctx->key_init = sctx->key_init;
-    if (sctx->key_init) {
-        memcpy(dctx->key, sctx->key, HMAC_MAX_MD_CBLOCK);
-        dctx->key_length = sctx->key_length;
-    }
+    memcpy(dctx->key, sctx->key, HMAC_MAX_MD_CBLOCK);
+    dctx->key_length = sctx->key_length;
     dctx->md = sctx->md;
     return 1;
  err:
diff --git a/crypto/hmac/hmac.h b/crypto/hmac/hmac.h
index f8e9f5e..b8b55cd 100644
--- a/crypto/hmac/hmac.h
+++ b/crypto/hmac/hmac.h
@@ -79,7 +79,6 @@ typedef struct hmac_ctx_st {
     EVP_MD_CTX o_ctx;
     unsigned int key_length;
     unsigned char key[HMAC_MAX_MD_CBLOCK];
-    int key_init;
 } HMAC_CTX;
 
 # define HMAC_size(e)    (EVP_MD_size((e)->md))
diff --git a/crypto/hmac/hmactest.c b/crypto/hmac/hmactest.c
index 86b6c25..271d0eb 100644
--- a/crypto/hmac/hmactest.c
+++ b/crypto/hmac/hmactest.c
@@ -233,7 +233,12 @@ test5:
         err++;
         goto test6;
     }
-    if (!HMAC_Init_ex(&ctx, NULL, 0, EVP_sha256(), NULL)) {
+    if (HMAC_Init_ex(&ctx, NULL, 0, EVP_sha256(), NULL)) {
+        printf("Should disallow changing MD without a new key (test 5)\n");
+        err++;
+        goto test6;
+    }
+    if (!HMAC_Init_ex(&ctx, test[4].key, test[4].key_len, EVP_sha256(), NULL)) {
         printf("Failed to reinitialise HMAC (test 5)\n");
         err++;
         goto test6;

From matt at openssl.org  Fri Jun 12 14:46:54 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 14:46:54 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434120414.911219.12571.nullmailer@dev.openssl.org>

The branch master has been updated
       via  1ae3fdbe6a7e78eef4d7678cb08ff468481c24ad (commit)
      from  4b464e7b46682f568a5df550426b0cf4b22e2485 (commit)


- Log -----------------------------------------------------------------
commit 1ae3fdbe6a7e78eef4d7678cb08ff468481c24ad
Author: Adam Langley <agl at google.com>
Date:   Fri Jun 12 08:05:49 2015 +0100

    Allow a zero length extension block
    
    It is valid for an extension block to be present in a ClientHello, but to
    be of zero length.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/t1_lib.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index f0565a2..402047a 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1940,12 +1940,12 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
 
     s->srtp_profile = NULL;
 
-    if (data >= (d + n - 2)) {
-        if (data != d + n)
-            goto err;
-        else
-            goto ri_check;
-    }
+    if (data == d + n)
+        goto ri_check;
+
+    if (data > (d + n - 2))
+        goto err;
+
     n2s(data, len);
 
     if (data > (d + n - len))

From matt at openssl.org  Fri Jun 12 14:48:40 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 14:48:40 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434120520.381765.13614.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  fe64245aa1b1f5519ddfe11e3c9d7ad49ae4de95 (commit)
      from  1030f89f5ea238820645e3d34049eb1bd30e81c4 (commit)


- Log -----------------------------------------------------------------
commit fe64245aa1b1f5519ddfe11e3c9d7ad49ae4de95
Author: Adam Langley <agl at google.com>
Date:   Fri Jun 12 08:05:49 2015 +0100

    Allow a zero length extension block
    
    It is valid for an extension block to be present in a ClientHello, but to
    be of zero length.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/t1_lib.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index d811d3f..210a5e8 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -2016,12 +2016,12 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
 
     s->srtp_profile = NULL;
 
-    if (data >= (d + n - 2)) {
-        if (data != d + n)
-            goto err;
-        else
-            goto ri_check;
-    }
+    if (data == d + n)
+        goto ri_check;
+
+    if (data > (d + n - 2))
+        goto err;
+
     n2s(data, len);
 
     if (data > (d + n - len))

From matt at openssl.org  Fri Jun 12 14:48:50 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 14:48:50 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434120530.861961.13934.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  6cbc78906b24cd274f61d205d7f43d66ca08e808 (commit)
      from  fffcf87a550f76f83e4a17dd190c9c74833046e8 (commit)


- Log -----------------------------------------------------------------
commit 6cbc78906b24cd274f61d205d7f43d66ca08e808
Author: Adam Langley <agl at google.com>
Date:   Fri Jun 12 08:05:49 2015 +0100

    Allow a zero length extension block
    
    It is valid for an extension block to be present in a ClientHello, but to
    be of zero length.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/t1_lib.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index c2d7d72..d70b93f 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1016,12 +1016,12 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 
     s->srtp_profile = NULL;
 
-    if (data >= (d + n - 2)) {
-        if (data != d + n)
-            goto err;
-        else
-            goto ri_check;
-    }
+    if (data == d + n)
+        goto ri_check;
+
+    if (data > (d + n - 2))
+        goto err;
+
     n2s(data, len);
 
     if (data > (d + n - len))

From matt at openssl.org  Fri Jun 12 15:05:23 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 15:05:23 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434121523.804716.17446.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  2ad310ffde8c751586b6b5a8b93086fdf79eb815 (commit)
      from  6cbc78906b24cd274f61d205d7f43d66ca08e808 (commit)


- Log -----------------------------------------------------------------
commit 2ad310ffde8c751586b6b5a8b93086fdf79eb815
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 15:56:51 2015 +0100

    Updated CHANGES and NEWS entries for new release
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES | 4 +++-
 NEWS    | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 06601b4..3ad6093 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,9 @@
 
  Changes between 1.0.1n and 1.0.1o [xx XXX xxxx]
 
-  *)
+  *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
+     incompatibility in the handling of HMAC. The previous ABI has now been
+     restored.
 
  Changes between 1.0.1m and 1.0.1n [11 Jun 2015]
 
diff --git a/NEWS b/NEWS
index 286059c..4452d22 100644
--- a/NEWS
+++ b/NEWS
@@ -7,7 +7,7 @@
 
   Major changes between OpenSSL 1.0.1n and OpenSSL 1.0.1o [under development]
 
-      o
+      o Fix HMAC ABI incompatibility
 
   Major changes between OpenSSL 1.0.1m and OpenSSL 1.0.1n [11 Jun 2015]
 

From matt at openssl.org  Fri Jun 12 15:05:35 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 15:05:35 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434121535.007143.17823.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  d4c1763858c11bc3ed15250bb9612c718d80c62c (commit)
      from  fe64245aa1b1f5519ddfe11e3c9d7ad49ae4de95 (commit)


- Log -----------------------------------------------------------------
commit d4c1763858c11bc3ed15250bb9612c718d80c62c
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 15:56:51 2015 +0100

    Updated CHANGES and NEWS entries for new release
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES | 4 +++-
 NEWS    | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2ec8b7b..7cdebad 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,9 @@
 
  Changes between 1.0.2b and 1.0.2c [xx XXX xxxx]
 
-  *)
+  *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
+     incompatibility in the handling of HMAC. The previous ABI has now been
+     restored.
 
  Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
 
diff --git a/NEWS b/NEWS
index 8750b03..5daeef7 100644
--- a/NEWS
+++ b/NEWS
@@ -7,7 +7,7 @@
 
   Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [under development]
 
-      o
+      o Fix HMAC ABI incompatibility
 
   Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [11 Jun 2015]
 

From matt at openssl.org  Fri Jun 12 15:32:57 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 15:32:57 +0000
Subject: [openssl-commits] [web]  master update
Message-ID: <1434123177.675482.24914.nullmailer@dev.openssl.org>

The branch master has been updated
       via  df19ba3056b64a54cfc10837cdc9f4b40633e8a6 (commit)
      from  7943146bf2a70af7d5d2bf376aab497fe4238603 (commit)


- Log -----------------------------------------------------------------
commit df19ba3056b64a54cfc10837cdc9f4b40633e8a6
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 16:28:37 2015 +0100

    Updated newsflash.txt for new releases

-----------------------------------------------------------------------

Summary of changes:
 news/newsflash.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/news/newsflash.txt b/news/newsflash.txt
index 72c9804..def6902 100644
--- a/news/newsflash.txt
+++ b/news/newsflash.txt
@@ -1,3 +1,6 @@
+12-Jun-2015: New releases to resolve ABI compatibility problems:
+12-Jun-2015: OpenSSL 1.0.2c is now <a href="ROOT/source/">available</a>, including bug fixes
+12-Jun-2015: OpenSSL 1.0.1o is now <a href="ROOT/source/">available</a>, including bug fixes
 11-Jun-2015: <a href="ROOT/news/secadv_20150611.txt">Security Advisory</a>: five security fixes
 11-Jun-2015: OpenSSL 1.0.2b is now <a href="ROOT/source/">available</a>, including bug and security fixes
 11-Jun-2015: OpenSSL 1.0.1n is now <a href="ROOT/source/">available</a>, including bug and security fixes

From matt at openssl.org  Fri Jun 12 15:35:15 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 15:35:15 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434123315.954867.2027.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  54ae378c9ea0a68fbdada833f6e2dd857bcecd65 (commit)
       via  0ee5fcde06827b041023e5a596d58da98e53740c (commit)
      from  d4c1763858c11bc3ed15250bb9612c718d80c62c (commit)


- Log -----------------------------------------------------------------
commit 54ae378c9ea0a68fbdada833f6e2dd857bcecd65
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 16:14:35 2015 +0100

    Prepare for 1.0.2d-dev
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit 0ee5fcde06827b041023e5a596d58da98e53740c
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 16:10:40 2015 +0100

    Prepare for 1.0.2c release
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES           | 6 +++++-
 NEWS              | 6 +++++-
 README            | 2 +-
 crypto/opensslv.h | 6 +++---
 openssl.spec      | 2 +-
 5 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7cdebad..5aff3e1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,11 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.2b and 1.0.2c [xx XXX xxxx]
+ Changes between 1.0.2c and 1.0.2d [xx XXX xxxx]
+
+  *)
+
+ Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
 
   *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
      incompatibility in the handling of HMAC. The previous ABI has now been
diff --git a/NEWS b/NEWS
index 5daeef7..f87f926 100644
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,11 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [under development]
+  Major changes between OpenSSL 1.0.2c and OpenSSL 1.0.2d [under development]
+
+      o
+
+  Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [12 Jun 2015]
 
       o Fix HMAC ABI incompatibility
 
diff --git a/README b/README
index 0bd70de..5f76493 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
 
- OpenSSL 1.0.2c-dev
+ OpenSSL 1.0.2d-dev
 
  Copyright (c) 1998-2011 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index d6df194..b33edf3 100644
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -30,11 +30,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x10002030L
+# define OPENSSL_VERSION_NUMBER  0x10002040L
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2c-fips-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2d-fips-dev xx XXX xxxx"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2c-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2d-dev xx XXX xxxx"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/openssl.spec b/openssl.spec
index e6c7584..b721d65 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -6,7 +6,7 @@ Release: 1
 
 Summary: Secure Sockets Layer and cryptography libraries and tools
 Name: openssl
-Version: 1.0.2c
+Version: 1.0.2d
 Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
 License: OpenSSL
 Group: System Environment/Libraries

From matt at openssl.org  Fri Jun 12 15:35:31 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 15:35:31 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434123331.355318.2326.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  902795b2f19c8ed91aa13ad471526b0c3f5c674b (commit)
       via  2a8c2799e1227a020d60a32ff8d0a12544e35c50 (commit)
      from  2ad310ffde8c751586b6b5a8b93086fdf79eb815 (commit)


- Log -----------------------------------------------------------------
commit 902795b2f19c8ed91aa13ad471526b0c3f5c674b
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 16:24:26 2015 +0100

    Prepare for 1.0.1p-dev
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit 2a8c2799e1227a020d60a32ff8d0a12544e35c50
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 12 16:20:59 2015 +0100

    Prepare for 1.0.1o release
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES           | 6 +++++-
 NEWS              | 6 +++++-
 README            | 2 +-
 crypto/opensslv.h | 6 +++---
 openssl.spec      | 2 +-
 5 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index 3ad6093..af27f3f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,11 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.1n and 1.0.1o [xx XXX xxxx]
+ Changes between 1.0.1o and 1.0.1p [xx XXX xxxx]
+
+  *)
+
+ Changes between 1.0.1n and 1.0.1o [12 Jun 2015]
 
   *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
      incompatibility in the handling of HMAC. The previous ABI has now been
diff --git a/NEWS b/NEWS
index 4452d22..1d81d4c 100644
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,11 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.1n and OpenSSL 1.0.1o [under development]
+  Major changes between OpenSSL 1.0.1o and OpenSSL 1.0.1p [under development]
+
+      o
+
+  Major changes between OpenSSL 1.0.1n and OpenSSL 1.0.1o [12 Jun 2015]
 
       o Fix HMAC ABI incompatibility
 
diff --git a/README b/README
index d379b03..7b9ff6e 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
 
- OpenSSL 1.0.1o-dev
+ OpenSSL 1.0.1p-dev
 
  Copyright (c) 1998-2011 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index 14bc8bd..f86e324 100644
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -30,11 +30,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x100010f0L
+# define OPENSSL_VERSION_NUMBER  0x10001100L
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1o-fips-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1p-fips-dev xx XXX xxxx"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1o-dev xx XXX xxxx"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1p-dev xx XXX xxxx"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/openssl.spec b/openssl.spec
index 3e8f3a9..67a6074 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -7,7 +7,7 @@ Release: 1
 Summary: Secure Sockets Layer and cryptography libraries and tools
 Name: openssl
 #Version: %{libmaj}.%{libmin}.%{librel}
-Version: 1.0.1o
+Version: 1.0.1p
 Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
 License: OpenSSL
 Group: System Environment/Libraries

From matt at openssl.org  Fri Jun 12 15:35:52 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 15:35:52 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1o create
Message-ID: <1434123352.980573.2617.nullmailer@dev.openssl.org>

The annotated tag OpenSSL_1_0_1o has been created
        at  73886ae39ea2d05421ad37755b5482c2d9b4687c (tag)
   tagging  2a8c2799e1227a020d60a32ff8d0a12544e35c50 (commit)
  replaces  OpenSSL_1_0_1n
 tagged by  Matt Caswell
        on  Fri Jun 12 16:20:59 2015 +0100

- Log -----------------------------------------------------------------
OpenSSL 1.0.1o release tag

Adam Langley (1):
      Allow a zero length extension block

Matt Caswell (4):
      Prepare for 1.0.1o-dev
      Fix ABI break with HMAC
      Updated CHANGES and NEWS entries for new release
      Prepare for 1.0.1o release

-----------------------------------------------------------------------

From matt at openssl.org  Fri Jun 12 15:35:53 2015
From: matt at openssl.org (Matt Caswell)
Date: Fri, 12 Jun 2015 15:35:53 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2c create
Message-ID: <1434123353.044664.2634.nullmailer@dev.openssl.org>

The annotated tag OpenSSL_1_0_2c has been created
        at  af69970a2e9aac16b1da819c6ba8e01add4c2d4b (tag)
   tagging  0ee5fcde06827b041023e5a596d58da98e53740c (commit)
  replaces  OpenSSL_1_0_2b
 tagged by  Matt Caswell
        on  Fri Jun 12 16:10:40 2015 +0100

- Log -----------------------------------------------------------------
OpenSSL 1.0.2c release tag

Adam Langley (1):
      Allow a zero length extension block

Matt Caswell (4):
      Prepare for 1.0.2c-dev
      Fix ABI break with HMAC
      Updated CHANGES and NEWS entries for new release
      Prepare for 1.0.2c release

-----------------------------------------------------------------------

From steve at openssl.org  Sat Jun 13 11:26:56 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Sat, 13 Jun 2015 11:26:56 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434194816.552831.19221.nullmailer@dev.openssl.org>

The branch master has been updated
       via  f2dc4d517fa11208b90ba0e92a2590f8cfdafb28 (commit)
      from  1ae3fdbe6a7e78eef4d7678cb08ff468481c24ad (commit)


- Log -----------------------------------------------------------------
commit f2dc4d517fa11208b90ba0e92a2590f8cfdafb28
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Fri Jun 12 22:18:36 2015 +0100

    Encode b == NULL or blen == 0 as zero.
    
    PR#3904
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/asn1/a_int.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c
index 9a58378..0d020e0 100644
--- a/crypto/asn1/a_int.c
+++ b/crypto/asn1/a_int.c
@@ -158,8 +158,8 @@ static size_t i2c_ibuf(const unsigned char *b, size_t blen, int neg,
 
     if (pad)
         *(p++) = pb;
-    if (blen == 0)
-        *(p++) = 0;
+    if (b == NULL || blen == 0)
+        *p = 0;
     else if (!neg)
         memcpy(p, b, blen);
     else {

From tjh at openssl.org  Mon Jun 15 01:37:57 2015
From: tjh at openssl.org (Tim Hudson)
Date: Mon, 15 Jun 2015 01:37:57 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434332277.215829.7445.nullmailer@dev.openssl.org>

The branch master has been updated
       via  e58ddf0af86e391cd1a3d0eb2641844607f1e300 (commit)
      from  f2dc4d517fa11208b90ba0e92a2590f8cfdafb28 (commit)


- Log -----------------------------------------------------------------
commit e58ddf0af86e391cd1a3d0eb2641844607f1e300
Author: Tim Hudson <tjh at openssl.org>
Date:   Mon Jun 15 11:36:32 2015 +1000

    Fix argument processing error from the option parsing change over.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/ca.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/ca.c b/apps/ca.c
index 4dc9176..a0f9f79 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -325,6 +325,7 @@ opthelp:
                 ret = 0;
                 goto end;
             case OPT_IN:
+		req = 1;
                 infile = opt_arg();
                 break;
             case OPT_OUT:

From tjh at openssl.org  Mon Jun 15 04:55:58 2015
From: tjh at openssl.org (Tim Hudson)
Date: Mon, 15 Jun 2015 04:55:58 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434344158.625482.9154.nullmailer@dev.openssl.org>

The branch master has been updated
       via  29eca1c0d58026792b50f7fd7f447f7a5fe63b5f (commit)
      from  e58ddf0af86e391cd1a3d0eb2641844607f1e300 (commit)


- Log -----------------------------------------------------------------
commit 29eca1c0d58026792b50f7fd7f447f7a5fe63b5f
Author: Tim Hudson <tjh at openssl.org>
Date:   Mon Jun 15 14:55:34 2015 +1000

    Fix argument processing error from the option parsing change over.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/req.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/apps/req.c b/apps/req.c
index 00d7c4a..712037d 100644
--- a/apps/req.c
+++ b/apps/req.c
@@ -125,7 +125,7 @@ typedef enum OPTION_choice {
     OPT_KEYOUT, OPT_PASSIN, OPT_PASSOUT, OPT_RAND, OPT_NEWKEY,
     OPT_PKEYOPT, OPT_SIGOPT, OPT_BATCH, OPT_NEWHDR, OPT_MODULUS,
     OPT_VERIFY, OPT_NODES, OPT_NOOUT, OPT_VERBOSE, OPT_UTF8,
-    OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJECT, OPT_TEXT, OPT_X509,
+    OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT, OPT_X509,
     OPT_ASN1_KLUDGE, OPT_NO_ASN1_KLUDGE, OPT_MULTIVALUE_RDN,
     OPT_DAYS, OPT_SET_SERIAL, OPT_EXTENSIONS, OPT_REQEXTS, OPT_MD
 } OPTION_CHOICE;
@@ -167,7 +167,8 @@ OPTIONS req_options[] = {
      "Output the request in a format that is wrong"},
     {OPT_MORE_STR, 1, 1, "(Required by some CA's)"},
     {"no-asn1-kludge", OPT_NO_ASN1_KLUDGE, '-'},
-    {"subject", OPT_SUBJECT, 's', "Output the request's subject"},
+    {"subj", OPT_SUBJ, 's', "Set or modify request subject"},
+    {"subject", OPT_SUBJECT, '-', "Output the request's subject"},
     {"multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
      "Enable support for multivalued RDNs"},
     {"days", OPT_DAYS, 'p', "Number of days cert is valid for"},
@@ -351,6 +352,9 @@ int req_main(int argc, char **argv)
                 goto opthelp;
             break;
         case OPT_SUBJECT:
+	    subject = 1;
+            break;
+        case OPT_SUBJ:
             subj = opt_arg();
             break;
         case OPT_MULTIVALUE_RDN:

From rsalz at openssl.org  Mon Jun 15 14:09:23 2015
From: rsalz at openssl.org (Rich Salz)
Date: Mon, 15 Jun 2015 14:09:23 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434377363.180441.11611.nullmailer@dev.openssl.org>

The branch master has been updated
       via  d31fb0b5b341aa7883b487d07e6a56d216224e25 (commit)
      from  29eca1c0d58026792b50f7fd7f447f7a5fe63b5f (commit)


- Log -----------------------------------------------------------------
commit d31fb0b5b341aa7883b487d07e6a56d216224e25
Author: Rich Salz <rsalz at akamai.com>
Date:   Sat Jun 13 10:50:00 2015 -0400

    Refactor into clear_ciphers; RT3588
    
    While closing RT3588 (Remove obsolete comment) Kurt and I saw that a
    few lines to completely clear the SSL cipher state could be moved into
    a common function.
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_lib.c | 30 ++++++++++++------------------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 1ce4f36..5c814fd 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -186,6 +186,14 @@ SSL3_ENC_METHOD ssl3_undef_enc_method = {
              int use_context))ssl_undefined_function,
 };
 
+static void clear_ciphers(SSL *s)
+{
+    /* clear the current cipher */
+    ssl_clear_cipher_ctx(s);
+    ssl_clear_hash_ctx(&s->read_hash);
+    ssl_clear_hash_ctx(&s->write_hash);
+}
+
 int SSL_clear(SSL *s)
 {
     if (s->method == NULL) {
@@ -217,9 +225,7 @@ int SSL_clear(SSL *s)
 
     BUF_MEM_free(s->init_buf);
     s->init_buf = NULL;
-    ssl_clear_cipher_ctx(s);
-    ssl_clear_hash_ctx(&s->read_hash);
-    ssl_clear_hash_ctx(&s->write_hash);
+    clear_ciphers(s);
     s->first_packet = 0;
 
     /*
@@ -548,9 +554,7 @@ void SSL_free(SSL *s)
         SSL_SESSION_free(s->session);
     }
 
-    ssl_clear_cipher_ctx(s);
-    ssl_clear_hash_ctx(&s->read_hash);
-    ssl_clear_hash_ctx(&s->write_hash);
+    clear_ciphers(s);
 
     ssl_cert_free(s->cert);
     /* Free up if allocated */
@@ -2450,20 +2454,13 @@ int SSL_do_handshake(SSL *s)
     return (ret);
 }
 
-/*
- * For the next 2 functions, SSL_clear() sets shutdown and so one of these
- * calls will reset it
- */
 void SSL_set_accept_state(SSL *s)
 {
     s->server = 1;
     s->shutdown = 0;
     s->state = SSL_ST_ACCEPT | SSL_ST_BEFORE;
     s->handshake_func = s->method->ssl_accept;
-    /* clear the current cipher */
-    ssl_clear_cipher_ctx(s);
-    ssl_clear_hash_ctx(&s->read_hash);
-    ssl_clear_hash_ctx(&s->write_hash);
+    clear_ciphers(s);
 }
 
 void SSL_set_connect_state(SSL *s)
@@ -2472,10 +2469,7 @@ void SSL_set_connect_state(SSL *s)
     s->shutdown = 0;
     s->state = SSL_ST_CONNECT | SSL_ST_BEFORE;
     s->handshake_func = s->method->ssl_connect;
-    /* clear the current cipher */
-    ssl_clear_cipher_ctx(s);
-    ssl_clear_hash_ctx(&s->read_hash);
-    ssl_clear_hash_ctx(&s->write_hash);
+    clear_ciphers(s);
 }
 
 int ssl_undefined_function(SSL *s)

From rsalz at openssl.org  Mon Jun 15 22:27:21 2015
From: rsalz at openssl.org (Rich Salz)
Date: Mon, 15 Jun 2015 22:27:21 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434407241.849224.31402.nullmailer@dev.openssl.org>

The branch master has been updated
       via  3b061a00e39d2e4ad524ff01cbdc0c53fe8171ee (commit)
      from  d31fb0b5b341aa7883b487d07e6a56d216224e25 (commit)


- Log -----------------------------------------------------------------
commit 3b061a00e39d2e4ad524ff01cbdc0c53fe8171ee
Author: Rich Salz <rsalz at akamai.com>
Date:   Sat May 2 10:01:33 2015 -0400

    RT2547: Tighten perms on generated privkey files
    
    When generating a private key, try to make the output file be readable
    only by the owner.  Put it in CHANGES file since it might be noticeable.
    
    Add "int private" flag to apps that write private keys, and check that it's
    set whenever we do write a private key.  Checked via assert so that this
    bug (security-related) gets fixed.  Thanks to Viktor for help in tracing
    the code-paths where private keys are written.
    
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES         |  4 ++++
 apps/apps.c     |  1 -
 apps/apps.h     |  2 ++
 apps/dsa.c      | 26 ++++++++++++++++-----
 apps/dsaparam.c | 10 ++++----
 apps/ec.c       | 19 +++++++++++----
 apps/ecparam.c  |  9 ++++----
 apps/gendsa.c   |  6 +++--
 apps/genpkey.c  | 13 +++++++----
 apps/genrsa.c   | 22 +++++++++---------
 apps/openssl.c  | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++++---
 apps/opt.c      |  1 -
 apps/passwd.c   |  1 -
 apps/pkcs12.c   |  8 ++++---
 apps/pkcs8.c    |  8 ++++++-
 apps/pkey.c     | 12 ++++++++--
 apps/req.c      |  8 ++++---
 apps/rsa.c      | 22 +++++++++++++-----
 apps/s_cb.c     |  1 -
 apps/s_client.c |  1 -
 apps/s_server.c |  1 -
 apps/x509.c     |  1 -
 22 files changed, 184 insertions(+), 63 deletions(-)

diff --git a/CHANGES b/CHANGES
index 6faf644..fae1123 100644
--- a/CHANGES
+++ b/CHANGES
@@ -41,6 +41,10 @@
      code and the associated standard is no longer considered fit-for-purpose.
      [Matt Caswell]
 
+  *) RT2547 was closed.  When generating a private key, try to make the
+     output file readable only by the owner.  This behavior change might
+     be noticeable when interacting with other software.
+
   *) Added HTTP GET support to the ocsp command.
      [Rich Salz]
 
diff --git a/apps/apps.c b/apps/apps.c
index 60f71c3..3f2c049 100644
--- a/apps/apps.c
+++ b/apps/apps.c
@@ -124,7 +124,6 @@
 #include <sys/types.h>
 #include <ctype.h>
 #include <errno.h>
-#include <assert.h>
 #include <openssl/err.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
diff --git a/apps/apps.h b/apps/apps.h
index a8652a1..b83d4b2 100644
--- a/apps/apps.h
+++ b/apps/apps.h
@@ -113,6 +113,7 @@
 # define HEADER_APPS_H
 
 # include "e_os.h"
+# include <assert.h>
 
 # include <openssl/bio.h>
 # include <openssl/x509.h>
@@ -153,6 +154,7 @@ extern BIO *bio_out;
 extern BIO *bio_err;
 BIO *dup_bio_in(void);
 BIO *dup_bio_out(void);
+BIO *bio_open_owner(const char *filename, const char *mode, int private);
 BIO *bio_open_default(const char *filename, const char *mode);
 BIO *bio_open_default_quiet(const char *filename, const char *mode);
 CONF *app_load_config(const char *filename);
diff --git a/apps/dsa.c b/apps/dsa.c
index f61e151..9998bfe 100644
--- a/apps/dsa.c
+++ b/apps/dsa.c
@@ -114,6 +114,7 @@ int dsa_main(int argc, char **argv)
     OPTION_CHOICE o;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, text = 0, noout = 0;
     int i, modulus = 0, pubin = 0, pubout = 0, pvk_encr = 2, ret = 1;
+    int private = 0;
 
     prog = opt_init(argc, argv, dsa_options);
     while ((o = opt_next()) != OPT_EOF) {
@@ -192,6 +193,9 @@ int dsa_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = pubin || pubout ? 0 : 1;
+    if (text)
+        private = 1;
 
     if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
         BIO_printf(bio_err, "Error getting passwords\n");
@@ -221,16 +225,18 @@ int dsa_main(int argc, char **argv)
         goto end;
     }
 
-    out = bio_open_default(outfile, "w");
+    out = bio_open_owner(outfile, "w", private);
     if (out == NULL)
         goto end;
 
-    if (text)
+    if (text) {
+        assert(private);
         if (!DSA_print(out, dsa, 0)) {
             perror(outfile);
             ERR_print_errors(bio_err);
             goto end;
         }
+    }
 
     if (modulus) {
         BIO_printf(out, "Public Key=");
@@ -246,25 +252,33 @@ int dsa_main(int argc, char **argv)
     if (outformat == FORMAT_ASN1) {
         if (pubin || pubout)
             i = i2d_DSA_PUBKEY_bio(out, dsa);
-        else
+        else {
+            assert(private);
             i = i2d_DSAPrivateKey_bio(out, dsa);
+        }
     } else if (outformat == FORMAT_PEM) {
         if (pubin || pubout)
             i = PEM_write_bio_DSA_PUBKEY(out, dsa);
-        else
+        else {
+            assert(private);
             i = PEM_write_bio_DSAPrivateKey(out, dsa, enc,
                                             NULL, 0, NULL, passout);
+        }
 # if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_RC4)
     } else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
         EVP_PKEY *pk;
         pk = EVP_PKEY_new();
         EVP_PKEY_set1_DSA(pk, dsa);
-        if (outformat == FORMAT_PVK)
+        if (outformat == FORMAT_PVK) {
+            assert(private);
             i = i2b_PVK_bio(out, pk, pvk_encr, 0, passout);
+        }
         else if (pubin || pubout)
             i = i2b_PublicKey_bio(out, pk);
-        else
+        else {
+            assert(private);
             i = i2b_PrivateKey_bio(out, pk);
+        }
         EVP_PKEY_free(pk);
 # endif
     } else {
diff --git a/apps/dsaparam.c b/apps/dsaparam.c
index 27170a2..8d48313 100644
--- a/apps/dsaparam.c
+++ b/apps/dsaparam.c
@@ -58,7 +58,6 @@
 #include <openssl/opensslconf.h> /* for OPENSSL_NO_DSA */
 
 #ifndef OPENSSL_NO_DSA
-# include <assert.h>
 # include <stdio.h>
 # include <stdlib.h>
 # include <time.h>
@@ -118,9 +117,8 @@ int dsaparam_main(int argc, char **argv)
     BIO *in = NULL, *out = NULL;
     BN_GENCB *cb = NULL;
     int numbits = -1, num = 0, genkey = 0, need_rand = 0, non_fips_allow = 0;
-    int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0, ret =
-        1;
-    int i, text = 0;
+    int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
+    int ret = 1, i, text = 0, private = 0;
 # ifdef GENCB_TEST
     int timebomb = 0;
 # endif
@@ -195,11 +193,12 @@ int dsaparam_main(int argc, char **argv)
         numbits = num;
         need_rand = 1;
     }
+    private = genkey ? 1 : 0;
 
     in = bio_open_default(infile, "r");
     if (in == NULL)
         goto end;
-    out = bio_open_default(outfile, "w");
+    out = bio_open_owner(outfile, "w", private);
     if (out == NULL)
         goto end;
 
@@ -320,6 +319,7 @@ int dsaparam_main(int argc, char **argv)
             DSA_free(dsakey);
             goto end;
         }
+        assert(private);
         if (outformat == FORMAT_ASN1)
             i = i2d_DSAPrivateKey_bio(out, dsakey);
         else
diff --git a/apps/ec.c b/apps/ec.c
index 341243f..e4f2db3 100644
--- a/apps/ec.c
+++ b/apps/ec.c
@@ -121,7 +121,7 @@ int ec_main(int argc, char **argv)
     OPTION_CHOICE o;
     int asn1_flag = OPENSSL_EC_NAMED_CURVE, new_form = 0, new_asn1_flag = 0;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, text = 0, noout = 0;
-    int pubin = 0, pubout = 0, param_out = 0, i, ret = 1;
+    int pubin = 0, pubout = 0, param_out = 0, i, ret = 1, private = 0;
 
     prog = opt_init(argc, argv, ec_options);
     while ((o = opt_next()) != OPT_EOF) {
@@ -193,6 +193,9 @@ int ec_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = param_out || pubin || pubout ? 0 : 1;
+    if (text)
+        private = 1;
 
     if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
         BIO_printf(bio_err, "Error getting passwords\n");
@@ -224,7 +227,7 @@ int ec_main(int argc, char **argv)
         goto end;
     }
 
-    out = bio_open_default(outfile, WB(outformat));
+    out = bio_open_owner(outfile, WB(outformat), private);
     if (out == NULL)
         goto end;
 
@@ -236,12 +239,14 @@ int ec_main(int argc, char **argv)
     if (new_asn1_flag)
         EC_KEY_set_asn1_flag(eckey, asn1_flag);
 
-    if (text)
+    if (text) {
+        assert(private);
         if (!EC_KEY_print(out, eckey, 0)) {
             perror(outfile);
             ERR_print_errors(bio_err);
             goto end;
         }
+    }
 
     if (noout) {
         ret = 0;
@@ -254,16 +259,20 @@ int ec_main(int argc, char **argv)
             i = i2d_ECPKParameters_bio(out, group);
         else if (pubin || pubout)
             i = i2d_EC_PUBKEY_bio(out, eckey);
-        else
+        else {
+            assert(private);
             i = i2d_ECPrivateKey_bio(out, eckey);
+        }
     } else {
         if (param_out)
             i = PEM_write_bio_ECPKParameters(out, group);
         else if (pubin || pubout)
             i = PEM_write_bio_EC_PUBKEY(out, eckey);
-        else
+        else {
+            assert(private);
             i = PEM_write_bio_ECPrivateKey(out, eckey, enc,
                                            NULL, 0, NULL, passout);
+        }
     }
 
     if (!i) {
diff --git a/apps/ecparam.c b/apps/ecparam.c
index ae75573..a0781c5 100644
--- a/apps/ecparam.c
+++ b/apps/ecparam.c
@@ -70,7 +70,6 @@
 
 #include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_EC
-# include <assert.h>
 # include <stdio.h>
 # include <stdlib.h>
 # include <time.h>
@@ -142,8 +141,8 @@ int ecparam_main(int argc, char **argv)
     unsigned char *buffer = NULL;
     OPTION_CHOICE o;
     int asn1_flag = OPENSSL_EC_NAMED_CURVE, new_asn1_flag = 0;
-    int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0, ret =
-        1;
+    int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
+    int ret = 1, private = 0;
     int list_curves = 0, no_seed = 0, check = 0, new_form = 0;
     int text = 0, i, need_rand = 0, genkey = 0;
 
@@ -219,6 +218,7 @@ int ecparam_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = genkey ? 1 : 0;
 
     if (!app_load_modules(NULL))
         goto end;
@@ -226,7 +226,7 @@ int ecparam_main(int argc, char **argv)
     in = bio_open_default(infile, RB(informat));
     if (in == NULL)
         goto end;
-    out = bio_open_default(outfile, WB(outformat));
+    out = bio_open_owner(outfile, WB(outformat), private);
     if (out == NULL)
         goto end;
 
@@ -473,6 +473,7 @@ int ecparam_main(int argc, char **argv)
             EC_KEY_free(eckey);
             goto end;
         }
+        assert(private);
         if (outformat == FORMAT_ASN1)
             i = i2d_ECPrivateKey_bio(out, eckey);
         else
diff --git a/apps/gendsa.c b/apps/gendsa.c
index 01bbceb..087a44a 100644
--- a/apps/gendsa.c
+++ b/apps/gendsa.c
@@ -99,7 +99,7 @@ int gendsa_main(int argc, char **argv)
     char *inrand = NULL, *dsaparams = NULL;
     char *outfile = NULL, *passoutarg = NULL, *passout = NULL, *prog;
     OPTION_CHOICE o;
-    int ret = 1;
+    int ret = 1, private = 0;
 
     prog = opt_init(argc, argv, gendsa_options);
     while ((o = opt_next()) != OPT_EOF) {
@@ -133,6 +133,7 @@ int gendsa_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = 1;
 
     if (argc != 1)
         goto opthelp;
@@ -157,7 +158,7 @@ int gendsa_main(int argc, char **argv)
     BIO_free(in);
     in = NULL;
 
-    out = bio_open_default(outfile, "w");
+    out = bio_open_owner(outfile, "w", private);
     if (out == NULL)
         goto end2;
 
@@ -175,6 +176,7 @@ int gendsa_main(int argc, char **argv)
 
     app_RAND_write_file(NULL);
 
+    assert(private);
     if (!PEM_write_bio_DSAPrivateKey(out, dsa, enc, NULL, 0, NULL, passout))
         goto end;
     ret = 0;
diff --git a/apps/genpkey.c b/apps/genpkey.c
index 7c8d551..dbbedaa 100644
--- a/apps/genpkey.c
+++ b/apps/genpkey.c
@@ -105,6 +105,7 @@ int genpkey_main(int argc, char **argv)
     const EVP_CIPHER *cipher = NULL;
     OPTION_CHOICE o;
     int outformat = FORMAT_PEM, text = 0, ret = 1, rv, do_param = 0;
+    int private = 0;
 
     prog = opt_init(argc, argv, genpkey_options);
     while ((o = opt_next()) != OPT_EOF) {
@@ -125,7 +126,6 @@ int genpkey_main(int argc, char **argv)
         case OPT_OUT:
             outfile = opt_arg();
             break;
-
         case OPT_PASS:
             passarg = opt_arg();
             break;
@@ -171,6 +171,7 @@ int genpkey_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = do_param ? 0 : 1;
 
     if (ctx == NULL)
         goto opthelp;
@@ -183,7 +184,7 @@ int genpkey_main(int argc, char **argv)
     if (!app_load_modules(NULL))
         goto end;
 
-    out = bio_open_default(outfile, "wb");
+    out = bio_open_owner(outfile, "wb", private);
     if (out == NULL)
         goto end;
 
@@ -206,11 +207,13 @@ int genpkey_main(int argc, char **argv)
 
     if (do_param)
         rv = PEM_write_bio_Parameters(out, pkey);
-    else if (outformat == FORMAT_PEM)
+    else if (outformat == FORMAT_PEM) {
+        assert(private);
         rv = PEM_write_bio_PrivateKey(out, pkey, cipher, NULL, 0, NULL, pass);
-    else if (outformat == FORMAT_ASN1)
+    } else if (outformat == FORMAT_ASN1) {
+        assert(private);
         rv = i2d_PrivateKey_bio(out, pkey);
-    else {
+    } else {
         BIO_printf(bio_err, "Bad format specified for key\n");
         goto end;
     }
diff --git a/apps/genrsa.c b/apps/genrsa.c
index 80d9ea6..bb8437f 100644
--- a/apps/genrsa.c
+++ b/apps/genrsa.c
@@ -102,12 +102,13 @@ OPTIONS genrsa_options[] = {
 int genrsa_main(int argc, char **argv)
 {
     BN_GENCB *cb = BN_GENCB_new();
+    PW_CB_DATA cb_data;
     ENGINE *e = NULL;
     BIGNUM *bn = BN_new();
     BIO *out = NULL;
     RSA *rsa = NULL;
     const EVP_CIPHER *enc = NULL;
-    int ret = 1, non_fips_allow = 0, num = DEFBITS;
+    int ret = 1, non_fips_allow = 0, num = DEFBITS, private = 0;
     unsigned long f4 = RSA_F4;
     char *outfile = NULL, *passoutarg = NULL, *passout = NULL;
     char *inrand = NULL, *prog, *hexe, *dece;
@@ -157,6 +158,7 @@ int genrsa_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = 1;
 
     if (argv[0] && (!opt_int(argv[0], &num) || num <= 0))
         goto end;
@@ -169,7 +171,7 @@ int genrsa_main(int argc, char **argv)
     if (!app_load_modules(NULL))
         goto end;
 
-    out = bio_open_default(outfile, "w");
+    out = bio_open_owner(outfile, "w", private);
     if (out == NULL)
         goto end;
 
@@ -203,15 +205,13 @@ int genrsa_main(int argc, char **argv)
     }
     OPENSSL_free(hexe);
     OPENSSL_free(dece);
-    {
-        PW_CB_DATA cb_data;
-        cb_data.password = passout;
-        cb_data.prompt_info = outfile;
-        if (!PEM_write_bio_RSAPrivateKey(out, rsa, enc, NULL, 0,
-                                         (pem_password_cb *)password_callback,
-                                         &cb_data))
-            goto end;
-    }
+    cb_data.password = passout;
+    cb_data.prompt_info = outfile;
+    assert(private);
+    if (!PEM_write_bio_RSAPrivateKey(out, rsa, enc, NULL, 0,
+                                     (pem_password_cb *)password_callback,
+                                     &cb_data))
+        goto end;
 
     ret = 0;
  end:
diff --git a/apps/openssl.c b/apps/openssl.c
index 9117726..7c202cf 100644
--- a/apps/openssl.c
+++ b/apps/openssl.c
@@ -122,13 +122,23 @@
 #ifndef OPENSSL_NO_ENGINE
 # include <openssl/engine.h>
 #endif
-/* needed for the _O_BINARY defs in the MS world */
-#define USE_SOCKETS
-#include "s_apps.h"
 #include <openssl/err.h>
 #ifdef OPENSSL_FIPS
 # include <openssl/fips.h>
 #endif
+#define USE_SOCKETS /* needed for the _O_BINARY defs in the MS world */
+#include "s_apps.h"
+/* Needed to get the other O_xxx flags. */
+#ifdef OPENSSL_SYS_VMS
+# include <unixio.h>
+#endif
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifndef OPENSSL_NO_POSIX_IO
+# include <sys/stat.h>
+# include <fcntl.h>
+#endif
 #define INCLUDE_FUNCTION_TABLE
 #include "apps.h"
 
@@ -289,6 +299,59 @@ void unbuffer(FILE *fp)
     setbuf(fp, NULL);
 }
 
+/*
+ * Open a file for writing, owner-read-only.
+ */
+BIO *bio_open_owner(const char *filename, const char *modestr, int private)
+{
+    FILE *fp = NULL;
+    BIO *b = NULL;
+    int fd = -1, bflags, mode, binmode;
+
+    if (!private || filename == NULL || strcmp(filename, "-") == 0)
+        return bio_open_default(filename, modestr);
+
+    mode = O_WRONLY;
+#ifdef O_CREAT
+    mode |= O_CREAT;
+#endif
+#ifdef O_TRUNC
+    mode |= O_TRUNC;
+#endif
+    binmode = strchr(modestr, 'b') != NULL;
+    if (binmode) {
+#ifdef O_BINARY
+        mode |= O_BINARY;
+#elif defined(_O_BINARY)
+        mode |= _O_BINARY;
+#endif
+    }
+
+    fd = open(filename, mode, 0600);
+    if (fd < 0)
+        goto err;
+    fp = fdopen(fd, modestr);
+    if (fp == NULL)
+        goto err;
+    bflags = BIO_CLOSE;
+    if (!binmode)
+        bflags |= BIO_FP_TEXT;
+    b = BIO_new_fp(fp, bflags);
+    if (b)
+        return b;
+
+ err:
+    BIO_printf(bio_err, "%s: Can't open \"%s\" for writing, %s\n",
+               opt_getprog(), filename, strerror(errno));
+    ERR_print_errors(bio_err);
+    /* If we have fp, then fdopen took over fd, so don't close both. */
+    if (fp)
+        fclose(fp);
+    else if (fd >= 0)
+        close(fd);
+    return NULL;
+}
+
 static BIO *bio_open_default_(const char *filename, const char *mode, int quiet)
 {
     BIO *ret;
@@ -320,10 +383,12 @@ static BIO *bio_open_default_(const char *filename, const char *mode, int quiet)
     ERR_print_errors(bio_err);
     return NULL;
 }
+
 BIO *bio_open_default(const char *filename, const char *mode)
 {
     return bio_open_default_(filename, mode, 0);
 }
+
 BIO *bio_open_default_quiet(const char *filename, const char *mode)
 {
     return bio_open_default_(filename, mode, 1);
diff --git a/apps/opt.c b/apps/opt.c
index 3e2831c..b81cec4 100644
--- a/apps/opt.c
+++ b/apps/opt.c
@@ -49,7 +49,6 @@
 
 /* #define COMPILE_STANDALONE_TEST_DRIVER  */
 #include "apps.h"
-#include <assert.h>
 #include <string.h>
 #if !defined(OPENSSL_SYS_MSDOS)
 # include OPENSSL_UNISTD
diff --git a/apps/passwd.c b/apps/passwd.c
index 0e168c4..dbae620 100644
--- a/apps/passwd.c
+++ b/apps/passwd.c
@@ -53,7 +53,6 @@
 
 #if !defined(OPENSSL_NO_DES) || !defined(NO_MD5CRYPT_1)
 
-# include <assert.h>
 # include <string.h>
 
 # include "apps.h"
diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index 05bb1ad..5b14dd5 100644
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -169,7 +169,7 @@ int pkcs12_main(int argc, char **argv)
     int cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
 # endif
     int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
-    int ret = 1, macver = 1, noprompt = 0, add_lmk = 0;
+    int ret = 1, macver = 1, noprompt = 0, add_lmk = 0, private = 0;
     char *passinarg = NULL, *passoutarg = NULL, *passarg = NULL;
     char *passin = NULL, *passout = NULL, *inrand = NULL, *macalg = NULL;
     char *cpass = NULL, *mpass = NULL, *CApath = NULL, *CAfile = NULL;
@@ -314,6 +314,7 @@ int pkcs12_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = 1;
 
     if (passarg) {
         if (export_cert)
@@ -355,8 +356,7 @@ int pkcs12_main(int argc, char **argv)
     in = bio_open_default(infile, "rb");
     if (in == NULL)
         goto end;
-
-    out = bio_open_default(outfile, "wb");
+    out = bio_open_owner(outfile, "wb", private);
     if (out == NULL)
         goto end;
 
@@ -500,6 +500,7 @@ int pkcs12_main(int argc, char **argv)
         if (maciter != -1)
             PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd);
 
+        assert(private);
         i2d_PKCS12_bio(out, p12);
 
         ret = 0;
@@ -545,6 +546,7 @@ int pkcs12_main(int argc, char **argv)
         }
     }
 
+    assert(private);
     if (!dump_certs_keys_p12(out, p12, cpass, -1, options, passout, enc)) {
         BIO_printf(bio_err, "Error outputting keys and certificates\n");
         ERR_print_errors(bio_err);
diff --git a/apps/pkcs8.c b/apps/pkcs8.c
index e94a232..919b8f1 100644
--- a/apps/pkcs8.c
+++ b/apps/pkcs8.c
@@ -115,6 +115,7 @@ int pkcs8_main(int argc, char **argv)
     OPTION_CHOICE o;
     int nocrypt = 0, ret = 1, iter = PKCS12_DEFAULT_ITER, p8_broken = PKCS8_OK;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, topk8 = 0, pbe_nid = -1;
+    int private = 0;
     unsigned long scrypt_N = 0, scrypt_r = 0, scrypt_p = 0;
 
     prog = opt_init(argc, argv, pkcs8_options);
@@ -217,6 +218,7 @@ int pkcs8_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = 1;
 
     if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
         BIO_printf(bio_err, "Error getting passwords\n");
@@ -232,9 +234,10 @@ int pkcs8_main(int argc, char **argv)
     in = bio_open_default(infile, "rb");
     if (in == NULL)
         goto end;
-    out = bio_open_default(outfile, "wb");
+    out = bio_open_owner(outfile, "wb", private);
     if (out == NULL)
         goto end;
+
     if (topk8) {
         pkey = load_key(infile, informat, 1, passin, e, "key");
         if (!pkey)
@@ -245,6 +248,7 @@ int pkcs8_main(int argc, char **argv)
             goto end;
         }
         if (nocrypt) {
+            assert(private);
             if (outformat == FORMAT_PEM)
                 PEM_write_bio_PKCS8_PRIV_KEY_INFO(out, p8inf);
             else if (outformat == FORMAT_ASN1)
@@ -289,6 +293,7 @@ int pkcs8_main(int argc, char **argv)
                 goto end;
             }
             app_RAND_write_file(NULL);
+            assert(private);
             if (outformat == FORMAT_PEM)
                 PEM_write_bio_PKCS8(out, p8);
             else if (outformat == FORMAT_ASN1)
@@ -373,6 +378,7 @@ int pkcs8_main(int argc, char **argv)
         }
     }
 
+    assert(private);
     if (outformat == FORMAT_PEM)
         PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, passout);
     else if (outformat == FORMAT_ASN1)
diff --git a/apps/pkey.c b/apps/pkey.c
index 875087f..80c2e15 100644
--- a/apps/pkey.c
+++ b/apps/pkey.c
@@ -101,6 +101,7 @@ int pkey_main(int argc, char **argv)
     OPTION_CHOICE o;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM;
     int pubin = 0, pubout = 0, pubtext = 0, text = 0, noout = 0, ret = 1;
+    int private = 0;
 
     prog = opt_init(argc, argv, pkey_options);
     while ((o = opt_next()) != OPT_EOF) {
@@ -159,6 +160,9 @@ int pkey_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = !noout && !pubout ? 1 : 0;
+    if (text && !pubtext)
+        private = 1;
 
     if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
         BIO_printf(bio_err, "Error getting passwords\n");
@@ -168,7 +172,7 @@ int pkey_main(int argc, char **argv)
     if (!app_load_modules(NULL))
         goto end;
 
-    out = bio_open_default(outfile, "wb");
+    out = bio_open_owner(outfile, "wb", private);
     if (out == NULL)
         goto end;
 
@@ -181,12 +185,14 @@ int pkey_main(int argc, char **argv)
 
     if (!noout) {
         if (outformat == FORMAT_PEM) {
+            assert(private);
             if (pubout)
                 PEM_write_bio_PUBKEY(out, pkey);
             else
                 PEM_write_bio_PrivateKey(out, pkey, cipher,
                                          NULL, 0, NULL, passout);
         } else if (outformat == FORMAT_ASN1) {
+            assert(private);
             if (pubout)
                 i2d_PUBKEY_bio(out, pkey);
             else
@@ -201,8 +207,10 @@ int pkey_main(int argc, char **argv)
     if (text) {
         if (pubtext)
             EVP_PKEY_print_public(out, pkey, 0, NULL);
-        else
+        else {
+            assert(private);
             EVP_PKEY_print_private(out, pkey, 0, NULL);
+        }
     }
 
     ret = 0;
diff --git a/apps/req.c b/apps/req.c
index 712037d..03736cc 100644
--- a/apps/req.c
+++ b/apps/req.c
@@ -204,8 +204,8 @@ int req_main(int argc, char **argv)
     char *template = default_config_file, *keyout = NULL;
     const char *keyalg = NULL;
     OPTION_CHOICE o;
-    int ret = 1, x509 = 0, days = 30, i = 0, newreq = 0, verbose =
-        0, pkey_type = -1;
+    int ret = 1, x509 = 0, days = 30, i = 0, newreq = 0, verbose = 0;
+    int pkey_type = -1, private = 0;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyform = FORMAT_PEM;
     int modulus = 0, multirdn = 0, verify = 0, noout = 0, text = 0;
     int nodes = 0, kludge = 0, newhdr = 0, subject = 0, pubkey = 0;
@@ -375,6 +375,7 @@ int req_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = newreq && (pkey == NULL) ? 1 : 0;
 
     if (!app_passwd(passargin, passargout, &passin, &passout)) {
         BIO_printf(bio_err, "Error getting passwords\n");
@@ -569,7 +570,7 @@ int req_main(int argc, char **argv)
             BIO_printf(bio_err, "writing new private key to stdout\n");
         else
             BIO_printf(bio_err, "writing new private key to '%s'\n", keyout);
-        out = bio_open_default(keyout, "w");
+        out = bio_open_owner(keyout, "w", private);
         if (out == NULL)
             goto end;
 
@@ -587,6 +588,7 @@ int req_main(int argc, char **argv)
 
         i = 0;
  loop:
+        assert(private);
         if (!PEM_write_bio_PrivateKey(out, pkey, cipher,
                                       NULL, 0, NULL, passout)) {
             if ((ERR_GET_REASON(ERR_peek_error()) ==
diff --git a/apps/rsa.c b/apps/rsa.c
index 51581ae..f6961d9 100644
--- a/apps/rsa.c
+++ b/apps/rsa.c
@@ -162,7 +162,7 @@ int rsa_main(int argc, char **argv)
     const EVP_CIPHER *enc = NULL;
     char *infile = NULL, *outfile = NULL, *prog;
     char *passin = NULL, *passout = NULL, *passinarg = NULL, *passoutarg = NULL;
-    int i;
+    int i, private = 0;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, text = 0, check = 0;
     int noout = 0, modulus = 0, pubin = 0, pubout = 0, pvk_encr = 2, ret = 1;
     OPTION_CHOICE o;
@@ -250,6 +250,7 @@ int rsa_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = text || (!pubout && !noout) ? 1 : 0;
 
     if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
         BIO_printf(bio_err, "Error getting passwords\n");
@@ -291,16 +292,18 @@ int rsa_main(int argc, char **argv)
         goto end;
     }
 
-    out = bio_open_default(outfile, "w");
+    out = bio_open_owner(outfile, "w", private);
     if (out == NULL)
         goto end;
 
-    if (text)
+    if (text) {
+        assert(private);
         if (!RSA_print(out, rsa, 0)) {
             perror(outfile);
             ERR_print_errors(bio_err);
             goto end;
         }
+    }
 
     if (modulus) {
         BIO_printf(out, "Modulus=");
@@ -344,8 +347,10 @@ int rsa_main(int argc, char **argv)
                 i = i2d_RSAPublicKey_bio(out, rsa);
             else
                 i = i2d_RSA_PUBKEY_bio(out, rsa);
-        } else
+        } else {
+            assert(private);
             i = i2d_RSAPrivateKey_bio(out, rsa);
+        }
     }
 # ifndef OPENSSL_NO_RC4
     else if (outformat == FORMAT_NETSCAPE) {
@@ -353,6 +358,7 @@ int rsa_main(int argc, char **argv)
         int size = i2d_RSA_NET(rsa, NULL, NULL, 0);
 
         save = p = app_malloc(size, "RSA i2d buffer");
+        assert(private);
         i2d_RSA_NET(rsa, &p, NULL, 0);
         BIO_write(out, (char *)save, size);
         OPENSSL_free(save);
@@ -365,9 +371,11 @@ int rsa_main(int argc, char **argv)
                 i = PEM_write_bio_RSAPublicKey(out, rsa);
             else
                 i = PEM_write_bio_RSA_PUBKEY(out, rsa);
-        } else
+        } else {
+            assert(private);
             i = PEM_write_bio_RSAPrivateKey(out, rsa,
                                             enc, NULL, 0, NULL, passout);
+        }
 # if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_RC4)
     } else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
         EVP_PKEY *pk;
@@ -377,8 +385,10 @@ int rsa_main(int argc, char **argv)
             i = i2b_PVK_bio(out, pk, pvk_encr, 0, passout);
         else if (pubin || pubout)
             i = i2b_PublicKey_bio(out, pk);
-        else
+        else {
+            assert(private);
             i = i2b_PrivateKey_bio(out, pk);
+        }
         EVP_PKEY_free(pk);
 # endif
     } else {
diff --git a/apps/s_cb.c b/apps/s_cb.c
index 44e70f2..a14e00c 100644
--- a/apps/s_cb.c
+++ b/apps/s_cb.c
@@ -111,7 +111,6 @@
 /* callback functions used by s_client, s_server, and s_time */
 #include <stdio.h>
 #include <stdlib.h>
-#include <assert.h>
 #include <string.h> /* for memcpy() and strcmp() */
 #define USE_SOCKETS
 #include "apps.h"
diff --git a/apps/s_client.c b/apps/s_client.c
index 22aa270..f82f9db 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -134,7 +134,6 @@
  * OTHERWISE.
  */
 
-#include <assert.h>
 #include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/apps/s_server.c b/apps/s_server.c
index 072d30d..3143078 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -139,7 +139,6 @@
  * OTHERWISE.
  */
 
-#include <assert.h>
 #include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/apps/x509.c b/apps/x509.c
index 0345cf0..8293a6e 100644
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -55,7 +55,6 @@
  * [including the GNU Public Licence.]
  */
 
-#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>

From levitte at openssl.org  Tue Jun 16 11:11:19 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 16 Jun 2015 11:11:19 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434453079.494588.14756.nullmailer@dev.openssl.org>

The branch master has been updated
       via  b4f0d1a4a89b964dba80036a6348ca0a1913c526 (commit)
       via  30cf91784bfde82622f79d87d17d20ce73329532 (commit)
      from  3b061a00e39d2e4ad524ff01cbdc0c53fe8171ee (commit)


- Log -----------------------------------------------------------------
commit b4f0d1a4a89b964dba80036a6348ca0a1913c526
Author: Richard Levitte <levitte at openssl.org>
Date:   Mon Jun 15 09:59:25 2015 +0200

    Make preprocessor error into real preprocessor error
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>

commit 30cf91784bfde82622f79d87d17d20ce73329532
Author: Richard Levitte <levitte at openssl.org>
Date:   Sat Jun 13 13:13:55 2015 +0200

    Remove one extraneous parenthesis
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/opensslconf.h.in | 2 +-
 include/openssl/bio.h   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/opensslconf.h.in b/crypto/opensslconf.h.in
index 504d93d..4429c91 100644
--- a/crypto/opensslconf.h.in
+++ b/crypto/opensslconf.h.in
@@ -118,7 +118,7 @@
 #endif
 
 #if defined(DES_RISC1) && defined(DES_RISC2)
-YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
+#error YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
 #endif
 
 /* Unroll the inner loop, this sometimes helps, sometimes hinders.
diff --git a/include/openssl/bio.h b/include/openssl/bio.h
index e224dd9..7fe88ec 100644
--- a/include/openssl/bio.h
+++ b/include/openssl/bio.h
@@ -276,7 +276,7 @@ void BIO_clear_flags(BIO *b, int flags);
  * BIO_CB_RETURN flag indicates if it is after the call
  */
 # define BIO_CB_RETURN   0x80
-# define BIO_CB_return(a) ((a)|BIO_CB_RETURN))
+# define BIO_CB_return(a) ((a)|BIO_CB_RETURN)
 # define BIO_cb_pre(a)   (!((a)&BIO_CB_RETURN))
 # define BIO_cb_post(a)  ((a)&BIO_CB_RETURN)
 

From levitte at openssl.org  Tue Jun 16 11:14:25 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 16 Jun 2015 11:14:25 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434453265.668614.15877.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  4f0812cc28c5cd4fb2c396b1825af82abebc6e56 (commit)
       via  3bf9adaa2ba3456b90c01ac719edc566f8bb3037 (commit)
      from  54ae378c9ea0a68fbdada833f6e2dd857bcecd65 (commit)


- Log -----------------------------------------------------------------
commit 4f0812cc28c5cd4fb2c396b1825af82abebc6e56
Author: Richard Levitte <levitte at openssl.org>
Date:   Mon Jun 15 09:59:25 2015 +0200

    Make preprocessor error into real preprocessor error
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit b4f0d1a4a89b964dba80036a6348ca0a1913c526)

commit 3bf9adaa2ba3456b90c01ac719edc566f8bb3037
Author: Richard Levitte <levitte at openssl.org>
Date:   Sat Jun 13 13:13:55 2015 +0200

    Remove one extraneous parenthesis
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit 30cf91784bfde82622f79d87d17d20ce73329532)

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bio.h        | 2 +-
 crypto/opensslconf.h.in | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/bio/bio.h b/crypto/bio/bio.h
index 7878fb1..f78796b 100644
--- a/crypto/bio/bio.h
+++ b/crypto/bio/bio.h
@@ -291,7 +291,7 @@ void BIO_clear_flags(BIO *b, int flags);
  * BIO_CB_RETURN flag indicates if it is after the call
  */
 # define BIO_CB_RETURN   0x80
-# define BIO_CB_return(a) ((a)|BIO_CB_RETURN))
+# define BIO_CB_return(a) ((a)|BIO_CB_RETURN)
 # define BIO_cb_pre(a)   (!((a)&BIO_CB_RETURN))
 # define BIO_cb_post(a)  ((a)&BIO_CB_RETURN)
 
diff --git a/crypto/opensslconf.h.in b/crypto/opensslconf.h.in
index 97e3745..814309b 100644
--- a/crypto/opensslconf.h.in
+++ b/crypto/opensslconf.h.in
@@ -101,7 +101,7 @@
 #endif
 
 #if defined(DES_RISC1) && defined(DES_RISC2)
-YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
+#error YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
 #endif
 
 /* Unroll the inner loop, this sometimes helps, sometimes hinders.

From levitte at openssl.org  Tue Jun 16 11:14:36 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 16 Jun 2015 11:14:36 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434453276.592948.16133.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  347fc5d8cd2cf14f943a15f8ff8ba2698211e503 (commit)
       via  a5d8c1c291293105f1c4b0336c0569d25b2b468d (commit)
      from  902795b2f19c8ed91aa13ad471526b0c3f5c674b (commit)


- Log -----------------------------------------------------------------
commit 347fc5d8cd2cf14f943a15f8ff8ba2698211e503
Author: Richard Levitte <levitte at openssl.org>
Date:   Mon Jun 15 09:59:25 2015 +0200

    Make preprocessor error into real preprocessor error
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit b4f0d1a4a89b964dba80036a6348ca0a1913c526)

commit a5d8c1c291293105f1c4b0336c0569d25b2b468d
Author: Richard Levitte <levitte at openssl.org>
Date:   Sat Jun 13 13:13:55 2015 +0200

    Remove one extraneous parenthesis
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit 30cf91784bfde82622f79d87d17d20ce73329532)

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bio.h        | 2 +-
 crypto/opensslconf.h.in | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/bio/bio.h b/crypto/bio/bio.h
index be9cd0e..d583cc1 100644
--- a/crypto/bio/bio.h
+++ b/crypto/bio/bio.h
@@ -290,7 +290,7 @@ void BIO_clear_flags(BIO *b, int flags);
  * BIO_CB_RETURN flag indicates if it is after the call
  */
 # define BIO_CB_RETURN   0x80
-# define BIO_CB_return(a) ((a)|BIO_CB_RETURN))
+# define BIO_CB_return(a) ((a)|BIO_CB_RETURN)
 # define BIO_cb_pre(a)   (!((a)&BIO_CB_RETURN))
 # define BIO_cb_post(a)  ((a)&BIO_CB_RETURN)
 
diff --git a/crypto/opensslconf.h.in b/crypto/opensslconf.h.in
index 97e3745..814309b 100644
--- a/crypto/opensslconf.h.in
+++ b/crypto/opensslconf.h.in
@@ -101,7 +101,7 @@
 #endif
 
 #if defined(DES_RISC1) && defined(DES_RISC2)
-YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
+#error YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
 #endif
 
 /* Unroll the inner loop, this sometimes helps, sometimes hinders.

From levitte at openssl.org  Tue Jun 16 11:14:44 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 16 Jun 2015 11:14:44 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1434453284.289325.16373.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  c040acd76a8918768aea560750937845f1e031e7 (commit)
       via  7c3f9198322908c33fb7c65087c64aa55cb37447 (commit)
      from  c9f4108465b7fb2ddf5be2d8cc80b120731a7906 (commit)


- Log -----------------------------------------------------------------
commit c040acd76a8918768aea560750937845f1e031e7
Author: Richard Levitte <levitte at openssl.org>
Date:   Mon Jun 15 09:59:25 2015 +0200

    Make preprocessor error into real preprocessor error
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit b4f0d1a4a89b964dba80036a6348ca0a1913c526)

commit 7c3f9198322908c33fb7c65087c64aa55cb37447
Author: Richard Levitte <levitte at openssl.org>
Date:   Sat Jun 13 13:13:55 2015 +0200

    Remove one extraneous parenthesis
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>
    (cherry picked from commit 30cf91784bfde82622f79d87d17d20ce73329532)

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bio.h        | 2 +-
 crypto/opensslconf.h.in | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/bio/bio.h b/crypto/bio/bio.h
index 73e8c78..8f79c29 100644
--- a/crypto/bio/bio.h
+++ b/crypto/bio/bio.h
@@ -263,7 +263,7 @@ void BIO_clear_flags(BIO *b, int flags);
  * BIO_CB_RETURN flag indicates if it is after the call
  */
 # define BIO_CB_RETURN   0x80
-# define BIO_CB_return(a) ((a)|BIO_CB_RETURN))
+# define BIO_CB_return(a) ((a)|BIO_CB_RETURN)
 # define BIO_cb_pre(a)   (!((a)&BIO_CB_RETURN))
 # define BIO_cb_post(a)  ((a)&BIO_CB_RETURN)
 
diff --git a/crypto/opensslconf.h.in b/crypto/opensslconf.h.in
index 97e3745..814309b 100644
--- a/crypto/opensslconf.h.in
+++ b/crypto/opensslconf.h.in
@@ -101,7 +101,7 @@
 #endif
 
 #if defined(DES_RISC1) && defined(DES_RISC2)
-YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
+#error YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
 #endif
 
 /* Unroll the inner loop, this sometimes helps, sometimes hinders.

From steve at openssl.org  Sat Jun 20 18:28:31 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Sat, 20 Jun 2015 18:28:31 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434824911.752672.10721.nullmailer@dev.openssl.org>

The branch master has been updated
       via  bc9567cdc9a56b5c904e075e3b929076c1e7583c (commit)
      from  b4f0d1a4a89b964dba80036a6348ca0a1913c526 (commit)


- Log -----------------------------------------------------------------
commit bc9567cdc9a56b5c904e075e3b929076c1e7583c
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sat Jun 20 16:10:54 2015 +0100

    typo: should be OPENSSL_free
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index efd9683..8784642 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -2948,7 +2948,7 @@ void ssl3_clear(SSL *s)
     }
 
     if (s->s3->alpn_selected) {
-        free(s->s3->alpn_selected);
+        OPENSSL_free(s->s3->alpn_selected);
         s->s3->alpn_selected = NULL;
     }
 

From steve at openssl.org  Sun Jun 21 14:30:25 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Sun, 21 Jun 2015 14:30:25 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434897025.305423.11685.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  8615d8b4ec08864674c2d8226f4c6c192e313893 (commit)
      from  4f0812cc28c5cd4fb2c396b1825af82abebc6e56 (commit)


- Log -----------------------------------------------------------------
commit 8615d8b4ec08864674c2d8226f4c6c192e313893
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sat Jun 20 16:10:54 2015 +0100

    typo: should be OPENSSL_free
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit bc9567cdc9a56b5c904e075e3b929076c1e7583c)

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 5db349a..ad9eeb6 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -3084,7 +3084,7 @@ void ssl3_clear(SSL *s)
     }
 #if !defined(OPENSSL_NO_TLSEXT)
     if (s->s3->alpn_selected) {
-        free(s->s3->alpn_selected);
+        OPENSSL_free(s->s3->alpn_selected);
         s->s3->alpn_selected = NULL;
     }
 #endif

From steve at openssl.org  Sun Jun 21 14:30:25 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Sun, 21 Jun 2015 14:30:25 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434897025.418555.11707.nullmailer@dev.openssl.org>

The branch master has been updated
       via  d480e182fe20fcaeca7817a4693eeaf594bb1a32 (commit)
       via  85fb6fdaed74d6091817ce5da17fcc737f36a51f (commit)
      from  bc9567cdc9a56b5c904e075e3b929076c1e7583c (commit)


- Log -----------------------------------------------------------------
commit d480e182fe20fcaeca7817a4693eeaf594bb1a32
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sat Jun 20 15:44:03 2015 +0100

    Avoid duplication.
    
    We always free the handshake buffer when digests are freed so move
    it into ssl_free_digest_list()
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 85fb6fdaed74d6091817ce5da17fcc737f36a51f
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sat Jun 20 15:37:22 2015 +0100

    remove unnecessary NULL checks
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_enc.c | 11 ++++++++---
 ssl/s3_lib.c | 10 ++--------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index dd93e25..eedf74d 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -476,16 +476,21 @@ void ssl3_cleanup_key_block(SSL *s)
 
 void ssl3_init_finished_mac(SSL *s)
 {
-    BIO_free(s->s3->handshake_buffer);
-    if (s->s3->handshake_dgst)
-        ssl3_free_digest_list(s);
+    ssl3_free_digest_list(s);
     s->s3->handshake_buffer = BIO_new(BIO_s_mem());
     (void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
 }
 
+/*
+ * Free digest list. Also frees handshake buffer since they are always freed
+ * together.
+ */
+
 void ssl3_free_digest_list(SSL *s)
 {
     int i;
+    BIO_free(s->s3->handshake_buffer);
+    s->s3->handshake_buffer = NULL;
     if (!s->s3->handshake_dgst)
         return;
     for (i = 0; i < SSL_MAX_DIGEST; i++) {
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 8784642..36b5f0d 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -2905,9 +2905,7 @@ void ssl3_free(SSL *s)
     OPENSSL_free(s->s3->tmp.ciphers_raw);
     OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen);
     OPENSSL_free(s->s3->tmp.peer_sigalgs);
-    BIO_free(s->s3->handshake_buffer);
-    if (s->s3->handshake_dgst)
-        ssl3_free_digest_list(s);
+    ssl3_free_digest_list(s);
     OPENSSL_free(s->s3->alpn_selected);
 
 #ifndef OPENSSL_NO_SRP
@@ -2941,11 +2939,7 @@ void ssl3_clear(SSL *s)
 #endif                         /* !OPENSSL_NO_EC */
 
     init_extra = s->s3->init_extra;
-    BIO_free(s->s3->handshake_buffer);
-    s->s3->handshake_buffer = NULL;
-    if (s->s3->handshake_dgst) {
-        ssl3_free_digest_list(s);
-    }
+    ssl3_free_digest_list(s);
 
     if (s->s3->alpn_selected) {
         OPENSSL_free(s->s3->alpn_selected);

From steve at openssl.org  Sun Jun 21 17:14:05 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Sun, 21 Jun 2015 17:14:05 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434906845.400805.31968.nullmailer@dev.openssl.org>

The branch master has been updated
       via  f6a103133abefd7795260af3f439d84430331e33 (commit)
      from  d480e182fe20fcaeca7817a4693eeaf594bb1a32 (commit)


- Log -----------------------------------------------------------------
commit f6a103133abefd7795260af3f439d84430331e33
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sun Jun 21 16:06:21 2015 +0100

    Revert "Avoid duplication."
    
    This reverts commit d480e182fe20fcaeca7817a4693eeaf594bb1a32.
    
    Commit broke TLS handshakes due to fragility of digest caching: that will be
    fixed separately.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_enc.c | 8 +-------
 ssl/s3_lib.c | 3 +++
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index eedf74d..bde19e1 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -476,21 +476,15 @@ void ssl3_cleanup_key_block(SSL *s)
 
 void ssl3_init_finished_mac(SSL *s)
 {
+    BIO_free(s->s3->handshake_buffer);
     ssl3_free_digest_list(s);
     s->s3->handshake_buffer = BIO_new(BIO_s_mem());
     (void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
 }
 
-/*
- * Free digest list. Also frees handshake buffer since they are always freed
- * together.
- */
-
 void ssl3_free_digest_list(SSL *s)
 {
     int i;
-    BIO_free(s->s3->handshake_buffer);
-    s->s3->handshake_buffer = NULL;
     if (!s->s3->handshake_dgst)
         return;
     for (i = 0; i < SSL_MAX_DIGEST; i++) {
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 36b5f0d..0307801 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -2905,6 +2905,7 @@ void ssl3_free(SSL *s)
     OPENSSL_free(s->s3->tmp.ciphers_raw);
     OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen);
     OPENSSL_free(s->s3->tmp.peer_sigalgs);
+    BIO_free(s->s3->handshake_buffer);
     ssl3_free_digest_list(s);
     OPENSSL_free(s->s3->alpn_selected);
 
@@ -2939,6 +2940,8 @@ void ssl3_clear(SSL *s)
 #endif                         /* !OPENSSL_NO_EC */
 
     init_extra = s->s3->init_extra;
+    BIO_free(s->s3->handshake_buffer);
+    s->s3->handshake_buffer = NULL;
     ssl3_free_digest_list(s);
 
     if (s->s3->alpn_selected) {

From rsalz at openssl.org  Sun Jun 21 19:27:12 2015
From: rsalz at openssl.org (Rich Salz)
Date: Sun, 21 Jun 2015 19:27:12 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434914832.959323.15004.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  8e6bb99979b95ee8b878e22e043ceb78d79c32a1 (commit)
      from  8615d8b4ec08864674c2d8226f4c6c192e313893 (commit)


- Log -----------------------------------------------------------------
commit 8e6bb99979b95ee8b878e22e043ceb78d79c32a1
Author: Rich Salz <rsalz at akamai.com>
Date:   Sun Jun 21 15:12:20 2015 -0400

    RT1688: Add dependencies for parallel make
    
    Backport to 1.0.1 and 1.0.2 to fix RT 3905
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 Makefile.org | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/Makefile.org b/Makefile.org
index 9f4faae..d77e264 100644
--- a/Makefile.org
+++ b/Makefile.org
@@ -269,6 +269,7 @@ reflect:
 	@[ -n "$(THIS)" ] && $(CLEARENV) && $(MAKE) $(THIS) -e $(BUILDENV)
 
 sub_all: build_all
+
 build_all: build_libs build_apps build_tests build_tools
 
 build_libs: build_libcrypto build_libssl openssl.pc
@@ -278,15 +279,15 @@ build_libssl: build_ssl libssl.pc
 
 build_crypto:
 	@dir=crypto; target=all; $(BUILD_ONE_CMD)
-build_ssl:
+build_ssl: build_crypto
 	@dir=ssl; target=all; $(BUILD_ONE_CMD)
-build_engines:
+build_engines: build_crypto
 	@dir=engines; target=all; $(BUILD_ONE_CMD)
-build_apps:
+build_apps: build_libs
 	@dir=apps; target=all; $(BUILD_ONE_CMD)
-build_tests:
+build_tests: build_libs
 	@dir=test; target=all; $(BUILD_ONE_CMD)
-build_tools:
+build_tools: build_libs
 	@dir=tools; target=all; $(BUILD_ONE_CMD)
 
 all_testapps: build_libs build_testapps

From rsalz at openssl.org  Sun Jun 21 19:27:37 2015
From: rsalz at openssl.org (Rich Salz)
Date: Sun, 21 Jun 2015 19:27:37 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434914857.593481.15312.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  83d6620986ab351b02ec2f5bbc30d2c4cac21f63 (commit)
      from  347fc5d8cd2cf14f943a15f8ff8ba2698211e503 (commit)


- Log -----------------------------------------------------------------
commit 83d6620986ab351b02ec2f5bbc30d2c4cac21f63
Author: Rich Salz <rsalz at akamai.com>
Date:   Sun Jun 21 15:12:20 2015 -0400

    RT1688: Add dependencies for parallel make
    
    Backport to 1.0.1 and 1.0.2 to fix RT 3905
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit 8e6bb99979b95ee8b878e22e043ceb78d79c32a1)

-----------------------------------------------------------------------

Summary of changes:
 Makefile.org | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/Makefile.org b/Makefile.org
index cf82487..55a3700 100644
--- a/Makefile.org
+++ b/Makefile.org
@@ -268,6 +268,7 @@ reflect:
 	@[ -n "$(THIS)" ] && $(CLEARENV) && $(MAKE) $(THIS) -e $(BUILDENV)
 
 sub_all: build_all
+
 build_all: build_libs build_apps build_tests build_tools
 
 build_libs: build_libcrypto build_libssl openssl.pc
@@ -277,15 +278,15 @@ build_libssl: build_ssl libssl.pc
 
 build_crypto:
 	@dir=crypto; target=all; $(BUILD_ONE_CMD)
-build_ssl:
+build_ssl: build_crypto
 	@dir=ssl; target=all; $(BUILD_ONE_CMD)
-build_engines:
+build_engines: build_crypto
 	@dir=engines; target=all; $(BUILD_ONE_CMD)
-build_apps:
+build_apps: build_libs
 	@dir=apps; target=all; $(BUILD_ONE_CMD)
-build_tests:
+build_tests: build_libs
 	@dir=test; target=all; $(BUILD_ONE_CMD)
-build_tools:
+build_tools: build_libs
 	@dir=tools; target=all; $(BUILD_ONE_CMD)
 
 all_testapps: build_libs build_testapps

From levitte at openssl.org  Sun Jun 21 19:45:58 2015
From: levitte at openssl.org (Richard Levitte)
Date: Sun, 21 Jun 2015 19:45:58 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434915958.970672.17916.nullmailer@dev.openssl.org>

The branch master has been updated
       via  8ca96efd24b73f917837fdd45b1c22d7b8ff8cbd (commit)
       via  d62c98c81c7b47b7b1878fd7e91e5fd33818faf0 (commit)
       via  03b672deca60ab1fb272f1a1e206769da969bc9a (commit)
       via  964626957f79e07ed97756527cdc7e84007c60c9 (commit)
       via  7a1789d254c561bd3024c971b5cfeeedd12d63f3 (commit)
       via  f4c73bfe0ab7a0e8f82fe2947c0f77fe3d98acab (commit)
       via  bb8abd6735e198de36c1eb9098a7f1516d156220 (commit)
       via  5c78e1835285ce4acdc7cc4f4c06aa7d6661c9b4 (commit)
       via  a3f9286556d6d78c1800caae97a9328afb2557e6 (commit)
      from  f6a103133abefd7795260af3f439d84430331e33 (commit)


- Log -----------------------------------------------------------------
commit 8ca96efd24b73f917837fdd45b1c22d7b8ff8cbd
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 21:35:59 2015 +0200

    Cleanup mttest.c : because we no longer use stdio here, don't include it
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit d62c98c81c7b47b7b1878fd7e91e5fd33818faf0
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:19:59 2015 +0200

    Add -ldl to the build of mttest.c
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 03b672deca60ab1fb272f1a1e206769da969bc9a
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:19:17 2015 +0200

    Cleanup mttest.c : use BIO_free only, no preceding hacks
    
    Since [sc]_ssl->[rw]bio aren't available, do not try to fiddle with
    them.  Surely, a BIO_free on the "main" BIOs should be enough
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 964626957f79e07ed97756527cdc7e84007c60c9
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:16:50 2015 +0200

    Cleanup mttest.c : do not try to output reference counts when threads are done
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 7a1789d254c561bd3024c971b5cfeeedd12d63f3
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:13:57 2015 +0200

    Cleanup mttest.c : better error reporting when certs are miggins
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit f4c73bfe0ab7a0e8f82fe2947c0f77fe3d98acab
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:12:33 2015 +0200

    Cleanup mttest.c : make ssl_method a pointer to const
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit bb8abd6735e198de36c1eb9098a7f1516d156220
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:11:43 2015 +0200

    Cleanup mttest.c : modernise output
    
    Construct bio_err and bio_stdout from file handles instead of FILE
    pointers, since the latter might not be implemented (when OPENSSL_NO_STDIO
    is defined).
    Convert all output to use BIO_printf.
    Change lh_foo to lh_SSL_SESSION_foo.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 5c78e1835285ce4acdc7cc4f4c06aa7d6661c9b4
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:03:44 2015 +0200

    Cleanup mttest.c : modernise the threads setup
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit a3f9286556d6d78c1800caae97a9328afb2557e6
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 18:51:18 2015 +0200

    Cleanup mttest.c : remove MS_CALLBACK
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/threads/mttest.c    | 306 +++++++++++++++++++++++----------------------
 crypto/threads/pthread2.sh |   3 +-
 2 files changed, 157 insertions(+), 152 deletions(-)

diff --git a/crypto/threads/mttest.c b/crypto/threads/mttest.c
index 3218c32..914ba7b 100644
--- a/crypto/threads/mttest.c
+++ b/crypto/threads/mttest.c
@@ -56,7 +56,6 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
@@ -86,16 +85,11 @@
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
-#include "../../e_os.h"
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/rand.h>
 
-#ifdef OPENSSL_NO_STDIO
-# include "../buffer/bss_file.c"
-#endif
-
 #ifdef OPENSSL_SYS_NETWARE
 # define TEST_SERVER_CERT "/openssl/apps/server.pem"
 # define TEST_CLIENT_CERT "/openssl/apps/client.pem"
@@ -106,23 +100,23 @@
 
 #define MAX_THREAD_NUMBER       100
 
-int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *xs);
+int verify_callback(int ok, X509_STORE_CTX *xs);
 void thread_setup(void);
 void thread_cleanup(void);
 void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx);
 
-void irix_locking_callback(int mode, int type, char *file, int line);
-void solaris_locking_callback(int mode, int type, char *file, int line);
-void win32_locking_callback(int mode, int type, char *file, int line);
-void pthreads_locking_callback(int mode, int type, char *file, int line);
-void netware_locking_callback(int mode, int type, char *file, int line);
+void irix_locking_callback(int mode, int type, const char *file, int line);
+void solaris_locking_callback(int mode, int type, const char *file, int line);
+void win32_locking_callback(int mode, int type, const char *file, int line);
+void pthreads_locking_callback(int mode, int type, const char *file, int line);
+void netware_locking_callback(int mode, int type, const char *file, int line);
 void beos_locking_callback(int mode, int type, const char *file, int line);
 
-unsigned long irix_thread_id(void);
-unsigned long solaris_thread_id(void);
-unsigned long pthreads_thread_id(void);
-unsigned long netware_thread_id(void);
-unsigned long beos_thread_id(void);
+void irix_thread_id(CRYPTO_THREADID *tid);
+void solaris_thread_id(CRYPTO_THREADID *tid);
+void pthreads_thread_id(CRYPTO_THREADID *tid);
+void netware_thread_id(CRYPTO_THREADID *tid);
+void beos_thread_id(CRYPTO_THREADID *tid);
 
 #if defined(OPENSSL_SYS_NETWARE)
 static MPKMutex *lock_cs;
@@ -148,39 +142,39 @@ static const char rnd_seed[] =
     "string to make the random number generator think it has entropy";
 
 int doit(char *ctx[4]);
-static void print_stats(FILE *fp, SSL_CTX *ctx)
+static void print_stats(BIO *bio, SSL_CTX *ctx)
 {
-    fprintf(fp, "%4ld items in the session cache\n",
-            SSL_CTX_sess_number(ctx));
-    fprintf(fp, "%4d client connects (SSL_connect())\n",
-            SSL_CTX_sess_connect(ctx));
-    fprintf(fp, "%4d client connects that finished\n",
-            SSL_CTX_sess_connect_good(ctx));
-    fprintf(fp, "%4d server connects (SSL_accept())\n",
-            SSL_CTX_sess_accept(ctx));
-    fprintf(fp, "%4d server connects that finished\n",
-            SSL_CTX_sess_accept_good(ctx));
-    fprintf(fp, "%4d session cache hits\n", SSL_CTX_sess_hits(ctx));
-    fprintf(fp, "%4d session cache misses\n", SSL_CTX_sess_misses(ctx));
-    fprintf(fp, "%4d session cache timeouts\n", SSL_CTX_sess_timeouts(ctx));
+    BIO_printf(bio, "%4ld items in the session cache\n",
+	       SSL_CTX_sess_number(ctx));
+    BIO_printf(bio, "%4d client connects (SSL_connect())\n",
+	       SSL_CTX_sess_connect(ctx));
+    BIO_printf(bio, "%4d client connects that finished\n",
+	       SSL_CTX_sess_connect_good(ctx));
+    BIO_printf(bio, "%4d server connects (SSL_accept())\n",
+	       SSL_CTX_sess_accept(ctx));
+    BIO_printf(bio, "%4d server connects that finished\n",
+	       SSL_CTX_sess_accept_good(ctx));
+    BIO_printf(bio, "%4d session cache hits\n", SSL_CTX_sess_hits(ctx));
+    BIO_printf(bio, "%4d session cache misses\n", SSL_CTX_sess_misses(ctx));
+    BIO_printf(bio, "%4d session cache timeouts\n", SSL_CTX_sess_timeouts(ctx));
 }
 
 static void sv_usage(void)
 {
-    fprintf(stderr, "usage: ssltest [args ...]\n");
-    fprintf(stderr, "\n");
-    fprintf(stderr, " -server_auth  - check server certificate\n");
-    fprintf(stderr, " -client_auth  - do client authentication\n");
-    fprintf(stderr, " -v            - more output\n");
-    fprintf(stderr, " -CApath arg   - PEM format directory of CA's\n");
-    fprintf(stderr, " -CAfile arg   - PEM format file of CA's\n");
-    fprintf(stderr, " -threads arg  - number of threads\n");
-    fprintf(stderr, " -loops arg    - number of 'connections', per thread\n");
-    fprintf(stderr, " -reconnect    - reuse session-id's\n");
-    fprintf(stderr, " -stats        - server session-id cache stats\n");
-    fprintf(stderr, " -cert arg     - server certificate/key\n");
-    fprintf(stderr, " -ccert arg    - client certificate/key\n");
-    fprintf(stderr, " -ssl3         - just SSLv3n\n");
+    BIO_printf(bio_err, "usage: ssltest [args ...]\n");
+    BIO_printf(bio_err, "\n");
+    BIO_printf(bio_err, " -server_auth  - check server certificate\n");
+    BIO_printf(bio_err, " -client_auth  - do client authentication\n");
+    BIO_printf(bio_err, " -v            - more output\n");
+    BIO_printf(bio_err, " -CApath arg   - PEM format directory of CA's\n");
+    BIO_printf(bio_err, " -CAfile arg   - PEM format file of CA's\n");
+    BIO_printf(bio_err, " -threads arg  - number of threads\n");
+    BIO_printf(bio_err, " -loops arg    - number of 'connections', per thread\n");
+    BIO_printf(bio_err, " -reconnect    - reuse session-id's\n");
+    BIO_printf(bio_err, " -stats        - server session-id cache stats\n");
+    BIO_printf(bio_err, " -cert arg     - server certificate/key\n");
+    BIO_printf(bio_err, " -ccert arg    - client certificate/key\n");
+    BIO_printf(bio_err, " -ssl3         - just SSLv3n\n");
 }
 
 int main(int argc, char *argv[])
@@ -194,14 +188,14 @@ int main(int argc, char *argv[])
     SSL_CTX *c_ctx = NULL;
     char *scert = TEST_SERVER_CERT;
     char *ccert = TEST_CLIENT_CERT;
-    SSL_METHOD *ssl_method = TLS_method();
+    const SSL_METHOD *ssl_method = TLS_method();
 
     RAND_seed(rnd_seed, sizeof rnd_seed);
 
     if (bio_err == NULL)
-        bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
+        bio_err = BIO_new_fd(2, BIO_NOCLOSE);
     if (bio_stdout == NULL)
-        bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE);
+        bio_stdout = BIO_new_fd(1, BIO_NOCLOSE);
     argc--;
     argv++;
 
@@ -247,7 +241,7 @@ int main(int argc, char *argv[])
             if (number_of_loops == 0)
                 number_of_loops = 1;
         } else {
-            fprintf(stderr, "unknown option %s\n", *argv);
+            BIO_printf(bio_err, "unknown option %s\n", *argv);
             badop = 1;
             break;
         }
@@ -281,9 +275,12 @@ int main(int argc, char *argv[])
                                    SSL_SESS_CACHE_SERVER);
 
     if (!SSL_CTX_use_certificate_file(s_ctx, scert, SSL_FILETYPE_PEM)) {
+        BIO_printf(bio_err, "SSL_CTX_use_certificate_file (%s)\n", scert);
         ERR_print_errors(bio_err);
+        goto end;
     } else
         if (!SSL_CTX_use_RSAPrivateKey_file(s_ctx, scert, SSL_FILETYPE_PEM)) {
+        BIO_printf(bio_err, "SSL_CTX_use_RSAPrivateKey_file (%s)\n", scert);
         ERR_print_errors(bio_err);
         goto end;
     }
@@ -297,19 +294,19 @@ int main(int argc, char *argv[])
         (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
         (!SSL_CTX_load_verify_locations(c_ctx, CAfile, CApath)) ||
         (!SSL_CTX_set_default_verify_paths(c_ctx))) {
-        fprintf(stderr, "SSL_load_verify_locations\n");
+        BIO_printf(bio_err, "SSL_load_verify_locations\n");
         ERR_print_errors(bio_err);
         goto end;
     }
 
     if (client_auth) {
-        fprintf(stderr, "client authentication\n");
+        BIO_printf(bio_err, "client authentication\n");
         SSL_CTX_set_verify(s_ctx,
                            SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
                            verify_callback);
     }
     if (server_auth) {
-        fprintf(stderr, "server authentication\n");
+        BIO_printf(bio_err, "server authentication\n");
         SSL_CTX_set_verify(c_ctx, SSL_VERIFY_PEER, verify_callback);
     }
 
@@ -319,24 +316,24 @@ int main(int argc, char *argv[])
  end:
 
     if (c_ctx != NULL) {
-        fprintf(stderr, "Client SSL_CTX stats then free it\n");
-        print_stats(stderr, c_ctx);
+        BIO_printf(bio_err, "Client SSL_CTX stats then free it\n");
+        print_stats(bio_err, c_ctx);
         SSL_CTX_free(c_ctx);
     }
     if (s_ctx != NULL) {
-        fprintf(stderr, "Server SSL_CTX stats then free it\n");
-        print_stats(stderr, s_ctx);
+        BIO_printf(bio_err, "Server SSL_CTX stats then free it\n");
+        print_stats(bio_err, s_ctx);
         if (cache_stats) {
-            fprintf(stderr, "-----\n");
-            lh_stats(SSL_CTX_sessions(s_ctx), stderr);
-            fprintf(stderr, "-----\n");
-                /*-     lh_node_stats(SSL_CTX_sessions(s_ctx),stderr);
-                        fprintf(stderr,"-----\n"); */
-            lh_node_usage_stats(SSL_CTX_sessions(s_ctx), stderr);
-            fprintf(stderr, "-----\n");
+            BIO_printf(bio_err, "-----\n");
+            lh_SSL_SESSION_stats_bio(SSL_CTX_sessions(s_ctx), bio_err);
+            BIO_printf(bio_err, "-----\n");
+    /*-     lh_SSL_SESSION_node_stats_bio(SSL_CTX_sessions(s_ctx),bio_err);
+            BIO_printf(bio_err,"-----\n"); */
+            lh_SSL_SESSION_node_usage_stats_bio(SSL_CTX_sessions(s_ctx), bio_err);
+            BIO_printf(bio_err, "-----\n");
         }
         SSL_CTX_free(s_ctx);
-        fprintf(stderr, "done free\n");
+        BIO_printf(bio_err, "done free\n");
     }
     exit(ret);
     return (0);
@@ -352,6 +349,7 @@ int ndoit(SSL_CTX *ssl_ctx[2])
     int i;
     int ret;
     char *ctx[4];
+    CRYPTO_THREADID thread_id;
 
     ctx[0] = (char *)ssl_ctx[0];
     ctx[1] = (char *)ssl_ctx[1];
@@ -364,22 +362,24 @@ int ndoit(SSL_CTX *ssl_ctx[2])
         ctx[3] = NULL;
     }
 
-    fprintf(stdout, "started thread %lu\n", CRYPTO_thread_id());
+    CRYPTO_THREADID_current(&thread_id);
+    BIO_printf(bio_stdout, "started thread %lu\n",
+	       CRYPTO_THREADID_hash(&thread_id));
     for (i = 0; i < number_of_loops; i++) {
-/*-             fprintf(stderr,"%4d %2d ctx->ref (%3d,%3d)\n",
-                        CRYPTO_thread_id(),i,
-                        ssl_ctx[0]->references,
-                        ssl_ctx[1]->references); */
-        /*      pthread_delay_np(&tm); */
+/*-     BIO_printf(bio_err,"%4d %2d ctx->ref (%3d,%3d)\n",
+                   CRYPTO_THREADID_hash(&thread_id),i,
+                   ssl_ctx[0]->references,
+                   ssl_ctx[1]->references); */
+/*      pthread_delay_np(&tm); */
 
         ret = doit(ctx);
         if (ret != 0) {
-            fprintf(stdout, "error[%d] %lu - %d\n",
-                    i, CRYPTO_thread_id(), ret);
+            BIO_printf(bio_stdout, "error[%d] %lu - %d\n",
+                       i, CRYPTO_THREADID_hash(&thread_id), ret);
             return (ret);
         }
     }
-    fprintf(stdout, "DONE %lu\n", CRYPTO_thread_id());
+    BIO_printf(bio_stdout, "DONE %lu\n", CRYPTO_THREADID_hash(&thread_id));
     if (reconnect) {
         SSL_free((SSL *)ctx[2]);
         SSL_free((SSL *)ctx[3]);
@@ -464,26 +464,26 @@ int doit(char *ctx[4])
 
         if (do_server && verbose) {
             if (SSL_in_init(s_ssl))
-                printf("server waiting in SSL_accept - %s\n",
-                       SSL_state_string_long(s_ssl));
+                BIO_printf(bio_stdout, "server waiting in SSL_accept - %s\n",
+                           SSL_state_string_long(s_ssl));
             else if (s_write)
-                printf("server:SSL_write()\n");
+                BIO_printf(bio_stdout, "server:SSL_write()\n");
             else
-                printf("server:SSL_read()\n");
+                BIO_printf(bio_stdout, "server:SSL_read()\n");
         }
 
         if (do_client && verbose) {
             if (SSL_in_init(c_ssl))
-                printf("client waiting in SSL_connect - %s\n",
-                       SSL_state_string_long(c_ssl));
+                BIO_printf(bio_stdout, "client waiting in SSL_connect - %s\n",
+                           SSL_state_string_long(c_ssl));
             else if (c_write)
-                printf("client:SSL_write()\n");
+                BIO_printf(bio_stdout, "client:SSL_write()\n");
             else
-                printf("client:SSL_read()\n");
+                BIO_printf(bio_stdout, "client:SSL_read()\n");
         }
 
         if (!do_client && !do_server) {
-            fprintf(stdout, "ERROR IN STARTUP\n");
+            BIO_printf(bio_stdout, "ERROR IN STARTUP\n");
             break;
         }
         if (do_client && !(done & C_DONE)) {
@@ -498,12 +498,12 @@ int doit(char *ctx[4])
                         if (BIO_should_write(c_bio))
                             c_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in CLIENT\n");
+                        BIO_printf(bio_err, "ERROR in CLIENT\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL CLIENT STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL CLIENT STARTUP FAILED\n");
                     return (1);
                 } else {
                     /* ok */
@@ -520,12 +520,12 @@ int doit(char *ctx[4])
                         if (BIO_should_write(c_bio))
                             c_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in CLIENT\n");
+                        BIO_printf(bio_err, "ERROR in CLIENT\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL CLIENT STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL CLIENT STARTUP FAILED\n");
                     return (1);
                 } else {
                     done |= C_DONE;
@@ -545,12 +545,12 @@ int doit(char *ctx[4])
                         if (BIO_should_write(s_bio))
                             s_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in SERVER\n");
+                        BIO_printf(bio_err, "ERROR in SERVER\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL SERVER STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL SERVER STARTUP FAILED\n");
                     return (1);
                 } else {
                     s_write = 1;
@@ -567,12 +567,12 @@ int doit(char *ctx[4])
                         if (BIO_should_write(s_bio))
                             s_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in SERVER\n");
+                        BIO_printf(bio_err, "ERROR in SERVER\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL SERVER STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL SERVER STARTUP FAILED\n");
                     return (1);
                 } else {
                     s_write = 0;
@@ -593,6 +593,7 @@ int doit(char *ctx[4])
     SSL_set_shutdown(s_ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
 
  err:
+#if 0
     /*
      * We have to set the BIO's to NULL otherwise they will be free()ed
      * twice.  Once when th s_ssl is SSL_free()ed and again when c_ssl is
@@ -614,13 +615,14 @@ int doit(char *ctx[4])
     /* The SSL's are optionally freed in the following calls */
     BIO_free(c_to_s);
     BIO_free(s_to_c);
+#endif
 
     BIO_free(c_bio);
     BIO_free(s_bio);
     return (0);
 }
 
-int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
+int verify_callback(int ok, X509_STORE_CTX *ctx)
 {
     char *s, buf[256];
 
@@ -629,9 +631,9 @@ int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
                               buf, 256);
         if (s != NULL) {
             if (ok)
-                fprintf(stderr, "depth=%d %s\n", ctx->error_depth, buf);
+                BIO_printf(bio_err, "depth=%d %s\n", ctx->error_depth, buf);
             else
-                fprintf(stderr, "depth=%d error=%d %s\n",
+                BIO_printf(bio_err, "depth=%d error=%d %s\n",
                         ctx->error_depth, ctx->error, buf);
         }
     }
@@ -668,7 +670,7 @@ void thread_cleanup(void)
     OPENSSL_free(lock_cs);
 }
 
-void win32_locking_callback(int mode, int type, char *file, int line)
+void win32_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
         WaitForSingleObject(lock_cs[type], INFINITE);
@@ -697,7 +699,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                                         (void *)ssl_ctx, 0L, &(thread_id[i]));
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i += 50) {
         int j;
 
@@ -707,7 +709,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                                    (CONST HANDLE *) & (thread_handle[i]),
                                    TRUE, INFINITE)
             == WAIT_FAILED) {
-            fprintf(stderr, "WaitForMultipleObjects failed:%d\n",
+            BIO_printf(bio_err, "WaitForMultipleObjects failed:%d\n",
                     GetLastError());
             exit(1);
         }
@@ -723,7 +725,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
     ret = (ret + end.wSecond - start.wSecond);
     ret += (end.wMilliseconds - start.wMilliseconds) / 1000.0;
 
-    printf("win32 threads done - %.3f seconds\n", ret);
+    BIO_printf(bio_stdout, "win32 threads done - %.3f seconds\n", ret);
 }
 
 #endif                          /* OPENSSL_SYS_WIN32 */
@@ -748,8 +750,8 @@ void thread_setup(void)
         mutex_init(&(lock_cs[i]), USYNC_THREAD, NULL);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())solaris_thread_id);
-    CRYPTO_set_locking_callback((void (*)())solaris_locking_callback);
+    CRYPTO_set_id_callback(solaris_thread_id);
+    CRYPTO_set_locking_callback(solaris_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -758,21 +760,21 @@ void thread_cleanup(void)
 
     CRYPTO_set_locking_callback(NULL);
 
-    fprintf(stderr, "cleanup\n");
+    BIO_printf(bio_err, "cleanup\n");
 
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         /* rwlock_destroy(&(lock_cs[i])); */
         mutex_destroy(&(lock_cs[i]));
-        fprintf(stderr, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_err, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
-    fprintf(stderr, "done cleanup\n");
+    BIO_printf(bio_err, "done cleanup\n");
 
 }
 
-void solaris_locking_callback(int mode, int type, char *file, int line)
+void solaris_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
         mutex_lock(&(lock_cs[type]));
@@ -797,21 +799,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                    (void *(*)())ndoit, (void *)ssl_ctx, 0L, &(thread_ctx[i]));
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         thr_join(thread_ctx[i], NULL, NULL);
     }
 
-    printf("solaris threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "solaris threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "solaris threads done\n");
+#endif
 }
 
-unsigned long solaris_thread_id(void)
+void solaris_thread_id(CRYPTO_THREADID *tid)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)thr_self();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)thr_self());
 }
 #endif                          /* SOLARIS */
 
@@ -840,8 +843,8 @@ void thread_setup(void)
         lock_cs[i] = usnewsema(arena, 1);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())irix_thread_id);
-    CRYPTO_set_locking_callback((void (*)())irix_locking_callback);
+    CRYPTO_set_id_callback(irix_thread_id);
+    CRYPTO_set_locking_callback(irix_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -859,13 +862,13 @@ void thread_cleanup(void)
     OPENSSL_free(lock_cs);
 }
 
-void irix_locking_callback(int mode, int type, char *file, int line)
+void irix_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
-        printf("lock %d\n", type);
+        BIO_printf(bio_stdout, "lock %d\n", type);
         uspsema(lock_cs[type]);
     } else {
-        printf("unlock %d\n", type);
+        BIO_printf(bio_stdout, "unlock %d\n", type);
         usvsema(lock_cs[type]);
     }
 }
@@ -884,21 +887,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                               PR_SADDR | PR_SFDS, (void *)ssl_ctx);
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         wait(NULL);
     }
 
-    printf("irix threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "irix threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "irix threads done\n");
+#endif
 }
 
 unsigned long irix_thread_id(void)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)getpid();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)getpid());
 }
 #endif                          /* IRIX */
 
@@ -918,8 +922,8 @@ void thread_setup(void)
         pthread_mutex_init(&(lock_cs[i]), NULL);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
-    CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
+    CRYPTO_THREADID_set_callback(pthreads_thread_id);
+    CRYPTO_set_locking_callback(pthreads_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -927,18 +931,18 @@ void thread_cleanup(void)
     int i;
 
     CRYPTO_set_locking_callback(NULL);
-    fprintf(stderr, "cleanup\n");
+    BIO_printf(bio_err, "cleanup\n");
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         pthread_mutex_destroy(&(lock_cs[i]));
-        fprintf(stderr, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_err, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
-    fprintf(stderr, "done cleanup\n");
+    BIO_printf(bio_err, "done cleanup\n");
 }
 
-void pthreads_locking_callback(int mode, int type, char *file, int line)
+void pthreads_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
         pthread_mutex_lock(&(lock_cs[type]));
@@ -965,21 +969,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                        (void *(*)())ndoit, (void *)ssl_ctx);
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         pthread_join(thread_ctx[i], NULL);
     }
 
-    printf("pthreads threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "pthreads threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "pthreads threads done\n");
+#endif
 }
 
-unsigned long pthreads_thread_id(void)
+void pthreads_thread_id(CRYPTO_THREADID *tid)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)pthread_self();
-    return (ret);
+    CRYPTO_THREADID_set_numeric(tid, (unsigned long)pthread_self());
 }
 
 #endif                          /* PTHREADS */
@@ -999,8 +1004,8 @@ void thread_setup(void)
 
     ThreadSem = MPKSemaphoreAlloc("OpenSSL mttest semaphore", 0);
 
-    CRYPTO_set_id_callback((unsigned long (*)())netware_thread_id);
-    CRYPTO_set_locking_callback((void (*)())netware_locking_callback);
+    CRYPTO_set_id_callback(netware_thread_id);
+    CRYPTO_set_locking_callback(netware_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -1009,21 +1014,21 @@ void thread_cleanup(void)
 
     CRYPTO_set_locking_callback(NULL);
 
-    fprintf(stdout, "thread_cleanup\n");
+    BIO_printf(bio_stdout, "thread_cleanup\n");
 
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         MPKMutexFree(lock_cs[i]);
-        fprintf(stdout, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_stdout, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
     MPKSemaphoreFree(ThreadSem);
 
-    fprintf(stdout, "done cleanup\n");
+    BIO_printf(bio_stdout, "done cleanup\n");
 }
 
-void netware_locking_callback(int mode, int type, char *file, int line)
+void netware_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
         MPKMutexLock(lock_cs[type]);
@@ -1045,21 +1050,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
         ThreadSwitchWithDelay();
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
 
     /* loop until all threads have signaled the semaphore */
     for (i = 0; i < thread_number; i++) {
         MPKSemaphoreWait(ThreadSem);
     }
-    printf("netware threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "netware threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "netware threads done\n");
+#endif
 }
 
 unsigned long netware_thread_id(void)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)GetThreadID();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)GetThreadID());
 }
 #endif                          /* NETWARE */
diff --git a/crypto/threads/pthread2.sh b/crypto/threads/pthread2.sh
index 41264c6..ec945c4 100755
--- a/crypto/threads/pthread2.sh
+++ b/crypto/threads/pthread2.sh
@@ -3,5 +3,4 @@
 # build using pthreads where it's already built into the system
 #
 /bin/rm -f mttest
-gcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto -lpthread
-
+gcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto -lpthread -ldl

From levitte at openssl.org  Sun Jun 21 20:12:13 2015
From: levitte at openssl.org (Richard Levitte)
Date: Sun, 21 Jun 2015 20:12:13 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434917533.370978.22285.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  220b9519eb48c5e3f969123508976f777f897330 (commit)
       via  710e28ef936794d045836e4c0cd9f83acfdf6166 (commit)
       via  05d20833e34cc63b928b45a5fb4bdedfd10d841e (commit)
       via  90ee3c1646a5efc1a24aa4d89ab15b3cbd3dbd75 (commit)
       via  7ef465050edfd8e8d95e01affc02f6e26cf6fa7d (commit)
       via  8ca211707afe1b946020e9c9a83cc5c047dfc7a0 (commit)
       via  9007dfa2030c58a10e6b16c5920d5a4ff0578933 (commit)
       via  603bebc0e753a70587972af5600cbb57b14f218b (commit)
       via  56f0733145aaecc09f1692bac965e3d2782b7ef6 (commit)
      from  8e6bb99979b95ee8b878e22e043ceb78d79c32a1 (commit)


- Log -----------------------------------------------------------------
commit 220b9519eb48c5e3f969123508976f777f897330
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 21:35:59 2015 +0200

    Cleanup mttest.c : because we no longer use stdio here, don't include it
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 8ca96efd24b73f917837fdd45b1c22d7b8ff8cbd)

commit 710e28ef936794d045836e4c0cd9f83acfdf6166
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:19:59 2015 +0200

    Add -ldl to the build of mttest.c
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit d62c98c81c7b47b7b1878fd7e91e5fd33818faf0)

commit 05d20833e34cc63b928b45a5fb4bdedfd10d841e
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:16:50 2015 +0200

    Cleanup mttest.c : do not try to output reference counts when threads are done
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 964626957f79e07ed97756527cdc7e84007c60c9)

commit 90ee3c1646a5efc1a24aa4d89ab15b3cbd3dbd75
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:13:57 2015 +0200

    Cleanup mttest.c : better error reporting when certs are missing
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 7a1789d254c561bd3024c971b5cfeeedd12d63f3)

commit 7ef465050edfd8e8d95e01affc02f6e26cf6fa7d
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:12:33 2015 +0200

    Cleanup mttest.c : make ssl_method a pointer to const
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit f4c73bfe0ab7a0e8f82fe2947c0f77fe3d98acab)
    
    Conflicts:
    	crypto/threads/mttest.c

commit 8ca211707afe1b946020e9c9a83cc5c047dfc7a0
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:19:17 2015 +0200

    Cleanup mttest.c : more output changes
    
    More fprintf()s and printf()s to turn into BIO calls.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 9007dfa2030c58a10e6b16c5920d5a4ff0578933
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:11:43 2015 +0200

    Cleanup mttest.c : modernise output
    
    Construct bio_err and bio_stdout from file handles instead of FILE
    pointers, since the latter might not be implemented (when OPENSSL_NO_STDIO
    is defined).
    Convert all output to use BIO_printf.
    Change lh_foo to lh_SSL_SESSION_foo.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit bb8abd6735e198de36c1eb9098a7f1516d156220)
    
    Conflicts:
    	crypto/threads/mttest.c

commit 603bebc0e753a70587972af5600cbb57b14f218b
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:03:44 2015 +0200

    Cleanup mttest.c : modernise the threads setup
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 5c78e1835285ce4acdc7cc4f4c06aa7d6661c9b4)
    
    Conflicts:
    	crypto/threads/mttest.c

commit 56f0733145aaecc09f1692bac965e3d2782b7ef6
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 18:51:18 2015 +0200

    Cleanup mttest.c : remove MS_CALLBACK
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit a3f9286556d6d78c1800caae97a9328afb2557e6)

-----------------------------------------------------------------------

Summary of changes:
 crypto/threads/mttest.c    | 365 +++++++++++++++++++++++----------------------
 crypto/threads/pthread2.sh |   3 +-
 2 files changed, 185 insertions(+), 183 deletions(-)

diff --git a/crypto/threads/mttest.c b/crypto/threads/mttest.c
index 8f67db6..dbff4a6 100644
--- a/crypto/threads/mttest.c
+++ b/crypto/threads/mttest.c
@@ -56,7 +56,6 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
@@ -86,17 +85,11 @@
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
-#include "../../e_os.h"
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/rand.h>
 
-#ifdef OPENSSL_NO_FP_API
-# define APPS_WIN16
-# include "../buffer/bss_file.c"
-#endif
-
 #ifdef OPENSSL_SYS_NETWARE
 # define TEST_SERVER_CERT "/openssl/apps/server.pem"
 # define TEST_CLIENT_CERT "/openssl/apps/client.pem"
@@ -107,23 +100,23 @@
 
 #define MAX_THREAD_NUMBER       100
 
-int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *xs);
+int verify_callback(int ok, X509_STORE_CTX *xs);
 void thread_setup(void);
 void thread_cleanup(void);
 void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx);
 
-void irix_locking_callback(int mode, int type, char *file, int line);
-void solaris_locking_callback(int mode, int type, char *file, int line);
-void win32_locking_callback(int mode, int type, char *file, int line);
-void pthreads_locking_callback(int mode, int type, char *file, int line);
-void netware_locking_callback(int mode, int type, char *file, int line);
+void irix_locking_callback(int mode, int type, const char *file, int line);
+void solaris_locking_callback(int mode, int type, const char *file, int line);
+void win32_locking_callback(int mode, int type, const char *file, int line);
+void pthreads_locking_callback(int mode, int type, const char *file, int line);
+void netware_locking_callback(int mode, int type, const char *file, int line);
 void beos_locking_callback(int mode, int type, const char *file, int line);
 
-unsigned long irix_thread_id(void);
-unsigned long solaris_thread_id(void);
-unsigned long pthreads_thread_id(void);
-unsigned long netware_thread_id(void);
-unsigned long beos_thread_id(void);
+void irix_thread_id(CRYPTO_THREADID *tid);
+void solaris_thread_id(CRYPTO_THREADID *tid);
+void pthreads_thread_id(CRYPTO_THREADID *tid);
+void netware_thread_id(CRYPTO_THREADID *tid);
+void beos_thread_id(CRYPTO_THREADID *tid);
 
 #if defined(OPENSSL_SYS_NETWARE)
 static MPKMutex *lock_cs;
@@ -149,39 +142,39 @@ static const char rnd_seed[] =
     "string to make the random number generator think it has entropy";
 
 int doit(char *ctx[4]);
-static void print_stats(FILE *fp, SSL_CTX *ctx)
+static void print_stats(BIO *bio, SSL_CTX *ctx)
 {
-    fprintf(fp, "%4ld items in the session cache\n",
-            SSL_CTX_sess_number(ctx));
-    fprintf(fp, "%4d client connects (SSL_connect())\n",
-            SSL_CTX_sess_connect(ctx));
-    fprintf(fp, "%4d client connects that finished\n",
-            SSL_CTX_sess_connect_good(ctx));
-    fprintf(fp, "%4d server connects (SSL_accept())\n",
-            SSL_CTX_sess_accept(ctx));
-    fprintf(fp, "%4d server connects that finished\n",
-            SSL_CTX_sess_accept_good(ctx));
-    fprintf(fp, "%4d session cache hits\n", SSL_CTX_sess_hits(ctx));
-    fprintf(fp, "%4d session cache misses\n", SSL_CTX_sess_misses(ctx));
-    fprintf(fp, "%4d session cache timeouts\n", SSL_CTX_sess_timeouts(ctx));
+    BIO_printf(bio, "%4ld items in the session cache\n",
+	       SSL_CTX_sess_number(ctx));
+    BIO_printf(bio, "%4d client connects (SSL_connect())\n",
+	       SSL_CTX_sess_connect(ctx));
+    BIO_printf(bio, "%4d client connects that finished\n",
+	       SSL_CTX_sess_connect_good(ctx));
+    BIO_printf(bio, "%4d server connects (SSL_accept())\n",
+	       SSL_CTX_sess_accept(ctx));
+    BIO_printf(bio, "%4d server connects that finished\n",
+	       SSL_CTX_sess_accept_good(ctx));
+    BIO_printf(bio, "%4d session cache hits\n", SSL_CTX_sess_hits(ctx));
+    BIO_printf(bio, "%4d session cache misses\n", SSL_CTX_sess_misses(ctx));
+    BIO_printf(bio, "%4d session cache timeouts\n", SSL_CTX_sess_timeouts(ctx));
 }
 
 static void sv_usage(void)
 {
-    fprintf(stderr, "usage: ssltest [args ...]\n");
-    fprintf(stderr, "\n");
-    fprintf(stderr, " -server_auth  - check server certificate\n");
-    fprintf(stderr, " -client_auth  - do client authentication\n");
-    fprintf(stderr, " -v            - more output\n");
-    fprintf(stderr, " -CApath arg   - PEM format directory of CA's\n");
-    fprintf(stderr, " -CAfile arg   - PEM format file of CA's\n");
-    fprintf(stderr, " -threads arg  - number of threads\n");
-    fprintf(stderr, " -loops arg    - number of 'connections', per thread\n");
-    fprintf(stderr, " -reconnect    - reuse session-id's\n");
-    fprintf(stderr, " -stats        - server session-id cache stats\n");
-    fprintf(stderr, " -cert arg     - server certificate/key\n");
-    fprintf(stderr, " -ccert arg    - client certificate/key\n");
-    fprintf(stderr, " -ssl3         - just SSLv3n\n");
+    BIO_printf(bio_err, "usage: ssltest [args ...]\n");
+    BIO_printf(bio_err, "\n");
+    BIO_printf(bio_err, " -server_auth  - check server certificate\n");
+    BIO_printf(bio_err, " -client_auth  - do client authentication\n");
+    BIO_printf(bio_err, " -v            - more output\n");
+    BIO_printf(bio_err, " -CApath arg   - PEM format directory of CA's\n");
+    BIO_printf(bio_err, " -CAfile arg   - PEM format file of CA's\n");
+    BIO_printf(bio_err, " -threads arg  - number of threads\n");
+    BIO_printf(bio_err, " -loops arg    - number of 'connections', per thread\n");
+    BIO_printf(bio_err, " -reconnect    - reuse session-id's\n");
+    BIO_printf(bio_err, " -stats        - server session-id cache stats\n");
+    BIO_printf(bio_err, " -cert arg     - server certificate/key\n");
+    BIO_printf(bio_err, " -ccert arg    - client certificate/key\n");
+    BIO_printf(bio_err, " -ssl3         - just SSLv3n\n");
 }
 
 int main(int argc, char *argv[])
@@ -195,14 +188,14 @@ int main(int argc, char *argv[])
     SSL_CTX *c_ctx = NULL;
     char *scert = TEST_SERVER_CERT;
     char *ccert = TEST_CLIENT_CERT;
-    SSL_METHOD *ssl_method = SSLv23_method();
+    const SSL_METHOD *ssl_method = SSLv23_method();
 
     RAND_seed(rnd_seed, sizeof rnd_seed);
 
     if (bio_err == NULL)
-        bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
+        bio_err = BIO_new_fd(2, BIO_NOCLOSE);
     if (bio_stdout == NULL)
-        bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE);
+        bio_stdout = BIO_new_fd(1, BIO_NOCLOSE);
     argc--;
     argv++;
 
@@ -250,7 +243,7 @@ int main(int argc, char *argv[])
             if (number_of_loops == 0)
                 number_of_loops = 1;
         } else {
-            fprintf(stderr, "unknown option %s\n", *argv);
+            BIO_printf(bio_err, "unknown option %s\n", *argv);
             badop = 1;
             break;
         }
@@ -284,9 +277,12 @@ int main(int argc, char *argv[])
                                    SSL_SESS_CACHE_SERVER);
 
     if (!SSL_CTX_use_certificate_file(s_ctx, scert, SSL_FILETYPE_PEM)) {
+        BIO_printf(bio_err, "SSL_CTX_use_certificate_file (%s)\n", scert);
         ERR_print_errors(bio_err);
+        goto end;
     } else
         if (!SSL_CTX_use_RSAPrivateKey_file(s_ctx, scert, SSL_FILETYPE_PEM)) {
+        BIO_printf(bio_err, "SSL_CTX_use_RSAPrivateKey_file (%s)\n", scert);
         ERR_print_errors(bio_err);
         goto end;
     }
@@ -300,19 +296,19 @@ int main(int argc, char *argv[])
         (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
         (!SSL_CTX_load_verify_locations(c_ctx, CAfile, CApath)) ||
         (!SSL_CTX_set_default_verify_paths(c_ctx))) {
-        fprintf(stderr, "SSL_load_verify_locations\n");
+        BIO_printf(bio_err, "SSL_load_verify_locations\n");
         ERR_print_errors(bio_err);
         goto end;
     }
 
     if (client_auth) {
-        fprintf(stderr, "client authentication\n");
+        BIO_printf(bio_err, "client authentication\n");
         SSL_CTX_set_verify(s_ctx,
                            SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
                            verify_callback);
     }
     if (server_auth) {
-        fprintf(stderr, "server authentication\n");
+        BIO_printf(bio_err, "server authentication\n");
         SSL_CTX_set_verify(c_ctx, SSL_VERIFY_PEER, verify_callback);
     }
 
@@ -322,24 +318,24 @@ int main(int argc, char *argv[])
  end:
 
     if (c_ctx != NULL) {
-        fprintf(stderr, "Client SSL_CTX stats then free it\n");
-        print_stats(stderr, c_ctx);
+        BIO_printf(bio_err, "Client SSL_CTX stats then free it\n");
+        print_stats(bio_err, c_ctx);
         SSL_CTX_free(c_ctx);
     }
     if (s_ctx != NULL) {
-        fprintf(stderr, "Server SSL_CTX stats then free it\n");
-        print_stats(stderr, s_ctx);
+        BIO_printf(bio_err, "Server SSL_CTX stats then free it\n");
+        print_stats(bio_err, s_ctx);
         if (cache_stats) {
-            fprintf(stderr, "-----\n");
-            lh_stats(SSL_CTX_sessions(s_ctx), stderr);
-            fprintf(stderr, "-----\n");
-    /*-     lh_node_stats(SSL_CTX_sessions(s_ctx),stderr);
-            fprintf(stderr,"-----\n"); */
-            lh_node_usage_stats(SSL_CTX_sessions(s_ctx), stderr);
-            fprintf(stderr, "-----\n");
+            BIO_printf(bio_err, "-----\n");
+            lh_SSL_SESSION_stats_bio(SSL_CTX_sessions(s_ctx), bio_err);
+            BIO_printf(bio_err, "-----\n");
+    /*-     lh_SSL_SESSION_node_stats_bio(SSL_CTX_sessions(s_ctx),bio_err);
+            BIO_printf(bio_err,"-----\n"); */
+            lh_SSL_SESSION_node_usage_stats_bio(SSL_CTX_sessions(s_ctx), bio_err);
+            BIO_printf(bio_err, "-----\n");
         }
         SSL_CTX_free(s_ctx);
-        fprintf(stderr, "done free\n");
+        BIO_printf(bio_err, "done free\n");
     }
     exit(ret);
     return (0);
@@ -355,6 +351,7 @@ int ndoit(SSL_CTX *ssl_ctx[2])
     int i;
     int ret;
     char *ctx[4];
+    CRYPTO_THREADID thread_id;
 
     ctx[0] = (char *)ssl_ctx[0];
     ctx[1] = (char *)ssl_ctx[1];
@@ -367,22 +364,24 @@ int ndoit(SSL_CTX *ssl_ctx[2])
         ctx[3] = NULL;
     }
 
-    fprintf(stdout, "started thread %lu\n", CRYPTO_thread_id());
+    CRYPTO_THREADID_current(&thread_id);
+    BIO_printf(bio_stdout, "started thread %lu\n",
+	       CRYPTO_THREADID_hash(&thread_id));
     for (i = 0; i < number_of_loops; i++) {
-/*-     fprintf(stderr,"%4d %2d ctx->ref (%3d,%3d)\n",
-            CRYPTO_thread_id(),i,
-            ssl_ctx[0]->references,
-            ssl_ctx[1]->references); */
+/*-     BIO_printf(bio_err,"%4d %2d ctx->ref (%3d,%3d)\n",
+                   CRYPTO_THREADID_hash(&thread_id),i,
+                   ssl_ctx[0]->references,
+                   ssl_ctx[1]->references); */
 /*      pthread_delay_np(&tm); */
 
         ret = doit(ctx);
         if (ret != 0) {
-            fprintf(stdout, "error[%d] %lu - %d\n",
-                    i, CRYPTO_thread_id(), ret);
+            BIO_printf(bio_stdout, "error[%d] %lu - %d\n",
+                       i, CRYPTO_THREADID_hash(&thread_id), ret);
             return (ret);
         }
     }
-    fprintf(stdout, "DONE %lu\n", CRYPTO_thread_id());
+    BIO_printf(bio_stdout, "DONE %lu\n", CRYPTO_THREADID_hash(&thread_id));
     if (reconnect) {
         SSL_free((SSL *)ctx[2]);
         SSL_free((SSL *)ctx[3]);
@@ -467,26 +466,26 @@ int doit(char *ctx[4])
 
         if (do_server && verbose) {
             if (SSL_in_init(s_ssl))
-                printf("server waiting in SSL_accept - %s\n",
-                       SSL_state_string_long(s_ssl));
+                BIO_printf(bio_stdout, "server waiting in SSL_accept - %s\n",
+                           SSL_state_string_long(s_ssl));
             else if (s_write)
-                printf("server:SSL_write()\n");
+                BIO_printf(bio_stdout, "server:SSL_write()\n");
             else
-                printf("server:SSL_read()\n");
+                BIO_printf(bio_stdout, "server:SSL_read()\n");
         }
 
         if (do_client && verbose) {
             if (SSL_in_init(c_ssl))
-                printf("client waiting in SSL_connect - %s\n",
-                       SSL_state_string_long(c_ssl));
+                BIO_printf(bio_stdout, "client waiting in SSL_connect - %s\n",
+                           SSL_state_string_long(c_ssl));
             else if (c_write)
-                printf("client:SSL_write()\n");
+                BIO_printf(bio_stdout, "client:SSL_write()\n");
             else
-                printf("client:SSL_read()\n");
+                BIO_printf(bio_stdout, "client:SSL_read()\n");
         }
 
         if (!do_client && !do_server) {
-            fprintf(stdout, "ERROR IN STARTUP\n");
+            BIO_printf(bio_stdout, "ERROR IN STARTUP\n");
             break;
         }
         if (do_client && !(done & C_DONE)) {
@@ -501,12 +500,12 @@ int doit(char *ctx[4])
                         if (BIO_should_write(c_bio))
                             c_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in CLIENT\n");
+                        BIO_printf(bio_err, "ERROR in CLIENT\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL CLIENT STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL CLIENT STARTUP FAILED\n");
                     return (1);
                 } else {
                     /* ok */
@@ -523,19 +522,19 @@ int doit(char *ctx[4])
                         if (BIO_should_write(c_bio))
                             c_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in CLIENT\n");
+                        BIO_printf(bio_err, "ERROR in CLIENT\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL CLIENT STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL CLIENT STARTUP FAILED\n");
                     return (1);
                 } else {
                     done |= C_DONE;
 #ifdef undef
-                    fprintf(stdout, "CLIENT:from server:");
-                    fwrite(cbuf, 1, i, stdout);
-                    fflush(stdout);
+                    BIO_printf(bio_stdout, "CLIENT:from server:");
+                    BIO_write(bio_stdout, cbuf, i);
+                    BIO_flush(bio_stdout);
 #endif
                 }
             }
@@ -553,20 +552,20 @@ int doit(char *ctx[4])
                         if (BIO_should_write(s_bio))
                             s_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in SERVER\n");
+                        BIO_printf(bio_err, "ERROR in SERVER\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL SERVER STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL SERVER STARTUP FAILED\n");
                     return (1);
                 } else {
                     s_write = 1;
                     s_w = 1;
 #ifdef undef
-                    fprintf(stdout, "SERVER:from client:");
-                    fwrite(sbuf, 1, i, stdout);
-                    fflush(stdout);
+                    BIO_printf(bio_stdout, "SERVER:from client:");
+                    BIO_write(bio_stdout, sbuf, i);
+                    BIO_flush(bio_stdout);
 #endif
                 }
             } else {
@@ -580,12 +579,12 @@ int doit(char *ctx[4])
                         if (BIO_should_write(s_bio))
                             s_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in SERVER\n");
+                        BIO_printf(bio_err, "ERROR in SERVER\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL SERVER STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL SERVER STARTUP FAILED\n");
                     return (1);
                 } else {
                     s_write = 0;
@@ -606,7 +605,7 @@ int doit(char *ctx[4])
     SSL_set_shutdown(s_ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
 
 #ifdef undef
-    fprintf(stdout, "DONE\n");
+    BIO_printf(bio_stdout, "DONE\n");
 #endif
  err:
     /*
@@ -640,7 +639,7 @@ int doit(char *ctx[4])
     return (0);
 }
 
-int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
+int verify_callback(int ok, X509_STORE_CTX *ctx)
 {
     char *s, buf[256];
 
@@ -649,9 +648,9 @@ int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
                               buf, 256);
         if (s != NULL) {
             if (ok)
-                fprintf(stderr, "depth=%d %s\n", ctx->error_depth, buf);
+                BIO_printf(bio_err, "depth=%d %s\n", ctx->error_depth, buf);
             else
-                fprintf(stderr, "depth=%d error=%d %s\n",
+                BIO_printf(bio_err, "depth=%d error=%d %s\n",
                         ctx->error_depth, ctx->error, buf);
         }
     }
@@ -688,7 +687,7 @@ void thread_cleanup(void)
     OPENSSL_free(lock_cs);
 }
 
-void win32_locking_callback(int mode, int type, char *file, int line)
+void win32_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
         WaitForSingleObject(lock_cs[type], INFINITE);
@@ -717,7 +716,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                                         (void *)ssl_ctx, 0L, &(thread_id[i]));
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i += 50) {
         int j;
 
@@ -727,7 +726,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                                    (CONST HANDLE *) & (thread_handle[i]),
                                    TRUE, INFINITE)
             == WAIT_FAILED) {
-            fprintf(stderr, "WaitForMultipleObjects failed:%d\n",
+            BIO_printf(bio_err, "WaitForMultipleObjects failed:%d\n",
                     GetLastError());
             exit(1);
         }
@@ -743,7 +742,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
     ret = (ret + end.wSecond - start.wSecond);
     ret += (end.wMilliseconds - start.wMilliseconds) / 1000.0;
 
-    printf("win32 threads done - %.3f seconds\n", ret);
+    BIO_printf(bio_stdout, "win32 threads done - %.3f seconds\n", ret);
 }
 
 #endif                          /* OPENSSL_SYS_WIN32 */
@@ -768,8 +767,8 @@ void thread_setup(void)
         mutex_init(&(lock_cs[i]), USYNC_THREAD, NULL);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())solaris_thread_id);
-    CRYPTO_set_locking_callback((void (*)())solaris_locking_callback);
+    CRYPTO_set_id_callback(solaris_thread_id);
+    CRYPTO_set_locking_callback(solaris_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -778,34 +777,34 @@ void thread_cleanup(void)
 
     CRYPTO_set_locking_callback(NULL);
 
-    fprintf(stderr, "cleanup\n");
+    BIO_printf(bio_err, "cleanup\n");
 
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         /* rwlock_destroy(&(lock_cs[i])); */
         mutex_destroy(&(lock_cs[i]));
-        fprintf(stderr, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_err, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
-    fprintf(stderr, "done cleanup\n");
+    BIO_printf(bio_err, "done cleanup\n");
 
 }
 
-void solaris_locking_callback(int mode, int type, char *file, int line)
+void solaris_locking_callback(int mode, int type, const char *file, int line)
 {
 # ifdef undef
-    fprintf(stderr, "thread=%4d mode=%s lock=%s %s:%d\n",
-            CRYPTO_thread_id(),
-            (mode & CRYPTO_LOCK) ? "l" : "u",
-            (type & CRYPTO_READ) ? "r" : "w", file, line);
+    BIO_printf(bio_err, "thread=%4d mode=%s lock=%s %s:%d\n",
+               CRYPTO_thread_id(),
+               (mode & CRYPTO_LOCK) ? "l" : "u",
+               (type & CRYPTO_READ) ? "r" : "w", file, line);
 # endif
 
     /*-
     if (CRYPTO_LOCK_SSL_CERT == type)
-    fprintf(stderr,"(t,m,f,l) %ld %d %s %d\n",
-            CRYPTO_thread_id(),
-            mode,file,line);
+    BIO_printf(bio_err,"(t,m,f,l) %ld %d %s %d\n",
+               CRYPTO_thread_id(),
+               mode,file,line);
     */
     if (mode & CRYPTO_LOCK) {
         /*-
@@ -837,21 +836,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                    (void *(*)())ndoit, (void *)ssl_ctx, 0L, &(thread_ctx[i]));
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         thr_join(thread_ctx[i], NULL, NULL);
     }
 
-    printf("solaris threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "solaris threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "solaris threads done\n");
+#endif
 }
 
-unsigned long solaris_thread_id(void)
+void solaris_thread_id(CRYPTO_THREADID *tid)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)thr_self();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)thr_self());
 }
 #endif                          /* SOLARIS */
 
@@ -880,8 +880,8 @@ void thread_setup(void)
         lock_cs[i] = usnewsema(arena, 1);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())irix_thread_id);
-    CRYPTO_set_locking_callback((void (*)())irix_locking_callback);
+    CRYPTO_set_id_callback(irix_thread_id);
+    CRYPTO_set_locking_callback(irix_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -899,13 +899,13 @@ void thread_cleanup(void)
     OPENSSL_free(lock_cs);
 }
 
-void irix_locking_callback(int mode, int type, char *file, int line)
+void irix_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
-        printf("lock %d\n", type);
+        BIO_printf(bio_stdout, "lock %d\n", type);
         uspsema(lock_cs[type]);
     } else {
-        printf("unlock %d\n", type);
+        BIO_printf(bio_stdout, "unlock %d\n", type);
         usvsema(lock_cs[type]);
     }
 }
@@ -924,21 +924,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                               PR_SADDR | PR_SFDS, (void *)ssl_ctx);
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         wait(NULL);
     }
 
-    printf("irix threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "irix threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "irix threads done\n");
+#endif
 }
 
 unsigned long irix_thread_id(void)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)getpid();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)getpid());
 }
 #endif                          /* IRIX */
 
@@ -958,8 +959,8 @@ void thread_setup(void)
         pthread_mutex_init(&(lock_cs[i]), NULL);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
-    CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
+    CRYPTO_THREADID_set_callback(pthreads_thread_id);
+    CRYPTO_set_locking_callback(pthreads_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -967,30 +968,30 @@ void thread_cleanup(void)
     int i;
 
     CRYPTO_set_locking_callback(NULL);
-    fprintf(stderr, "cleanup\n");
+    BIO_printf(bio_err, "cleanup\n");
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         pthread_mutex_destroy(&(lock_cs[i]));
-        fprintf(stderr, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_err, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
-    fprintf(stderr, "done cleanup\n");
+    BIO_printf(bio_err, "done cleanup\n");
 }
 
-void pthreads_locking_callback(int mode, int type, char *file, int line)
+void pthreads_locking_callback(int mode, int type, const char *file, int line)
 {
 # ifdef undef
-    fprintf(stderr, "thread=%4d mode=%s lock=%s %s:%d\n",
-            CRYPTO_thread_id(),
-            (mode & CRYPTO_LOCK) ? "l" : "u",
-            (type & CRYPTO_READ) ? "r" : "w", file, line);
+    BIO_printf(bio_err, "thread=%4d mode=%s lock=%s %s:%d\n",
+               CRYPTO_thread_id(),
+               (mode & CRYPTO_LOCK) ? "l" : "u",
+               (type & CRYPTO_READ) ? "r" : "w", file, line);
 # endif
 /*-
     if (CRYPTO_LOCK_SSL_CERT == type)
-            fprintf(stderr,"(t,m,f,l) %ld %d %s %d\n",
-            CRYPTO_thread_id(),
-            mode,file,line);
+            BIO_printf(bio_err,"(t,m,f,l) %ld %d %s %d\n",
+                       CRYPTO_thread_id(),
+                       mode,file,line);
 */
     if (mode & CRYPTO_LOCK) {
         pthread_mutex_lock(&(lock_cs[type]));
@@ -1017,21 +1018,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                        (void *(*)())ndoit, (void *)ssl_ctx);
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         pthread_join(thread_ctx[i], NULL);
     }
 
-    printf("pthreads threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "pthreads threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "pthreads threads done\n");
+#endif
 }
 
-unsigned long pthreads_thread_id(void)
+void pthreads_thread_id(CRYPTO_THREADID *tid)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)pthread_self();
-    return (ret);
+    CRYPTO_THREADID_set_numeric(tid, (unsigned long)pthread_self());
 }
 
 #endif                          /* PTHREADS */
@@ -1051,8 +1053,8 @@ void thread_setup(void)
 
     ThreadSem = MPKSemaphoreAlloc("OpenSSL mttest semaphore", 0);
 
-    CRYPTO_set_id_callback((unsigned long (*)())netware_thread_id);
-    CRYPTO_set_locking_callback((void (*)())netware_locking_callback);
+    CRYPTO_set_id_callback(netware_thread_id);
+    CRYPTO_set_locking_callback(netware_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -1061,21 +1063,21 @@ void thread_cleanup(void)
 
     CRYPTO_set_locking_callback(NULL);
 
-    fprintf(stdout, "thread_cleanup\n");
+    BIO_printf(bio_stdout, "thread_cleanup\n");
 
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         MPKMutexFree(lock_cs[i]);
-        fprintf(stdout, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_stdout, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
     MPKSemaphoreFree(ThreadSem);
 
-    fprintf(stdout, "done cleanup\n");
+    BIO_printf(bio_stdout, "done cleanup\n");
 }
 
-void netware_locking_callback(int mode, int type, char *file, int line)
+void netware_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
         MPKMutexLock(lock_cs[type]);
@@ -1097,22 +1099,23 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
         ThreadSwitchWithDelay();
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
 
     /* loop until all threads have signaled the semaphore */
     for (i = 0; i < thread_number; i++) {
         MPKSemaphoreWait(ThreadSem);
     }
-    printf("netware threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "netware threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "netware threads done\n");
+#endif
 }
 
 unsigned long netware_thread_id(void)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)GetThreadID();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)GetThreadID());
 }
 #endif                          /* NETWARE */
 
@@ -1144,24 +1147,24 @@ void thread_cleanup(void)
     int i;
 
     CRYPTO_set_locking_callback(NULL);
-    fprintf(stderr, "cleanup\n");
+    BIO_printf(bio_err, "cleanup\n");
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         delete lock_cs[i];
-        fprintf(stderr, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_err, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
-    fprintf(stderr, "done cleanup\n");
+    BIO_printf(bio_err, "done cleanup\n");
 }
 
 void beos_locking_callback(int mode, int type, const char *file, int line)
 {
 # if 0
-    fprintf(stderr, "thread=%4d mode=%s lock=%s %s:%d\n",
-            CRYPTO_thread_id(),
-            (mode & CRYPTO_LOCK) ? "l" : "u",
-            (type & CRYPTO_READ) ? "r" : "w", file, line);
+    BIO_printf(bio_err, "thread=%4d mode=%s lock=%s %s:%d\n",
+               CRYPTO_thread_id(),
+               (mode & CRYPTO_LOCK) ? "l" : "u",
+               (type & CRYPTO_READ) ? "r" : "w", file, line);
 # endif
     if (mode & CRYPTO_LOCK) {
         lock_cs[type]->Lock();
@@ -1187,14 +1190,14 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
         resume_thread(thread_ctx[i]);
     }
 
-    printf("waiting...\n");
+    BIO_printf(bio_stdout, "waiting...\n");
     for (i = 0; i < thread_number; i++) {
         status_t result;
         wait_for_thread(thread_ctx[i], &result);
     }
 
-    printf("beos threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+    BIO_printf(bio_stdout, "beos threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
 }
 
 unsigned long beos_thread_id(void)
diff --git a/crypto/threads/pthread2.sh b/crypto/threads/pthread2.sh
index 41264c6..ec945c4 100755
--- a/crypto/threads/pthread2.sh
+++ b/crypto/threads/pthread2.sh
@@ -3,5 +3,4 @@
 # build using pthreads where it's already built into the system
 #
 /bin/rm -f mttest
-gcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto -lpthread
-
+gcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto -lpthread -ldl

From levitte at openssl.org  Sun Jun 21 20:14:01 2015
From: levitte at openssl.org (Richard Levitte)
Date: Sun, 21 Jun 2015 20:14:01 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1434917641.706756.23382.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  f4961dc2af340f87747c739269fa2b3b704bfe3f (commit)
       via  40ced6c1871e48910cb981c6033c6874129f6632 (commit)
       via  f1817dd4d05004359940eaf87805f91a77517d95 (commit)
       via  5891dae67c93d53e79bfa2bdc31d9bd72ba9da73 (commit)
       via  1d6d4efea56c8b03a4fbb2b1b9e1f25447e752aa (commit)
       via  0fee33440466df4296da37f255788f9711e36747 (commit)
       via  141f7d263b6b4e2c5871d9cd1cd85746e601a69a (commit)
       via  ae3254a52d1ee77c1930a863fb98f7f3723a9d9b (commit)
       via  9720dd4314470c8504d9e7038540ccd3635b3602 (commit)
      from  83d6620986ab351b02ec2f5bbc30d2c4cac21f63 (commit)


- Log -----------------------------------------------------------------
commit f4961dc2af340f87747c739269fa2b3b704bfe3f
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 21:35:59 2015 +0200

    Cleanup mttest.c : because we no longer use stdio here, don't include it
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 8ca96efd24b73f917837fdd45b1c22d7b8ff8cbd)

commit 40ced6c1871e48910cb981c6033c6874129f6632
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:19:59 2015 +0200

    Add -ldl to the build of mttest.c
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit d62c98c81c7b47b7b1878fd7e91e5fd33818faf0)

commit f1817dd4d05004359940eaf87805f91a77517d95
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:16:50 2015 +0200

    Cleanup mttest.c : do not try to output reference counts when threads are done
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 964626957f79e07ed97756527cdc7e84007c60c9)

commit 5891dae67c93d53e79bfa2bdc31d9bd72ba9da73
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:13:57 2015 +0200

    Cleanup mttest.c : better error reporting when certs are missing
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 7a1789d254c561bd3024c971b5cfeeedd12d63f3)

commit 1d6d4efea56c8b03a4fbb2b1b9e1f25447e752aa
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:12:33 2015 +0200

    Cleanup mttest.c : make ssl_method a pointer to const
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit f4c73bfe0ab7a0e8f82fe2947c0f77fe3d98acab)
    
    Conflicts:
    	crypto/threads/mttest.c

commit 0fee33440466df4296da37f255788f9711e36747
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:19:17 2015 +0200

    Cleanup mttest.c : more output changes
    
    More fprintf()s and printf()s to turn into BIO calls.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 141f7d263b6b4e2c5871d9cd1cd85746e601a69a
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:11:43 2015 +0200

    Cleanup mttest.c : modernise output
    
    Construct bio_err and bio_stdout from file handles instead of FILE
    pointers, since the latter might not be implemented (when OPENSSL_NO_STDIO
    is defined).
    Convert all output to use BIO_printf.
    Change lh_foo to lh_SSL_SESSION_foo.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit bb8abd6735e198de36c1eb9098a7f1516d156220)
    
    Conflicts:
    	crypto/threads/mttest.c

commit ae3254a52d1ee77c1930a863fb98f7f3723a9d9b
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 19:03:44 2015 +0200

    Cleanup mttest.c : modernise the threads setup
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 5c78e1835285ce4acdc7cc4f4c06aa7d6661c9b4)
    
    Conflicts:
    	crypto/threads/mttest.c

commit 9720dd4314470c8504d9e7038540ccd3635b3602
Author: Richard Levitte <levitte at openssl.org>
Date:   Sun Jun 21 18:51:18 2015 +0200

    Cleanup mttest.c : remove MS_CALLBACK
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit a3f9286556d6d78c1800caae97a9328afb2557e6)

-----------------------------------------------------------------------

Summary of changes:
 crypto/threads/mttest.c    | 365 +++++++++++++++++++++++----------------------
 crypto/threads/pthread2.sh |   3 +-
 2 files changed, 185 insertions(+), 183 deletions(-)

diff --git a/crypto/threads/mttest.c b/crypto/threads/mttest.c
index 8f67db6..dbff4a6 100644
--- a/crypto/threads/mttest.c
+++ b/crypto/threads/mttest.c
@@ -56,7 +56,6 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
@@ -86,17 +85,11 @@
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
-#include "../../e_os.h"
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/rand.h>
 
-#ifdef OPENSSL_NO_FP_API
-# define APPS_WIN16
-# include "../buffer/bss_file.c"
-#endif
-
 #ifdef OPENSSL_SYS_NETWARE
 # define TEST_SERVER_CERT "/openssl/apps/server.pem"
 # define TEST_CLIENT_CERT "/openssl/apps/client.pem"
@@ -107,23 +100,23 @@
 
 #define MAX_THREAD_NUMBER       100
 
-int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *xs);
+int verify_callback(int ok, X509_STORE_CTX *xs);
 void thread_setup(void);
 void thread_cleanup(void);
 void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx);
 
-void irix_locking_callback(int mode, int type, char *file, int line);
-void solaris_locking_callback(int mode, int type, char *file, int line);
-void win32_locking_callback(int mode, int type, char *file, int line);
-void pthreads_locking_callback(int mode, int type, char *file, int line);
-void netware_locking_callback(int mode, int type, char *file, int line);
+void irix_locking_callback(int mode, int type, const char *file, int line);
+void solaris_locking_callback(int mode, int type, const char *file, int line);
+void win32_locking_callback(int mode, int type, const char *file, int line);
+void pthreads_locking_callback(int mode, int type, const char *file, int line);
+void netware_locking_callback(int mode, int type, const char *file, int line);
 void beos_locking_callback(int mode, int type, const char *file, int line);
 
-unsigned long irix_thread_id(void);
-unsigned long solaris_thread_id(void);
-unsigned long pthreads_thread_id(void);
-unsigned long netware_thread_id(void);
-unsigned long beos_thread_id(void);
+void irix_thread_id(CRYPTO_THREADID *tid);
+void solaris_thread_id(CRYPTO_THREADID *tid);
+void pthreads_thread_id(CRYPTO_THREADID *tid);
+void netware_thread_id(CRYPTO_THREADID *tid);
+void beos_thread_id(CRYPTO_THREADID *tid);
 
 #if defined(OPENSSL_SYS_NETWARE)
 static MPKMutex *lock_cs;
@@ -149,39 +142,39 @@ static const char rnd_seed[] =
     "string to make the random number generator think it has entropy";
 
 int doit(char *ctx[4]);
-static void print_stats(FILE *fp, SSL_CTX *ctx)
+static void print_stats(BIO *bio, SSL_CTX *ctx)
 {
-    fprintf(fp, "%4ld items in the session cache\n",
-            SSL_CTX_sess_number(ctx));
-    fprintf(fp, "%4d client connects (SSL_connect())\n",
-            SSL_CTX_sess_connect(ctx));
-    fprintf(fp, "%4d client connects that finished\n",
-            SSL_CTX_sess_connect_good(ctx));
-    fprintf(fp, "%4d server connects (SSL_accept())\n",
-            SSL_CTX_sess_accept(ctx));
-    fprintf(fp, "%4d server connects that finished\n",
-            SSL_CTX_sess_accept_good(ctx));
-    fprintf(fp, "%4d session cache hits\n", SSL_CTX_sess_hits(ctx));
-    fprintf(fp, "%4d session cache misses\n", SSL_CTX_sess_misses(ctx));
-    fprintf(fp, "%4d session cache timeouts\n", SSL_CTX_sess_timeouts(ctx));
+    BIO_printf(bio, "%4ld items in the session cache\n",
+	       SSL_CTX_sess_number(ctx));
+    BIO_printf(bio, "%4d client connects (SSL_connect())\n",
+	       SSL_CTX_sess_connect(ctx));
+    BIO_printf(bio, "%4d client connects that finished\n",
+	       SSL_CTX_sess_connect_good(ctx));
+    BIO_printf(bio, "%4d server connects (SSL_accept())\n",
+	       SSL_CTX_sess_accept(ctx));
+    BIO_printf(bio, "%4d server connects that finished\n",
+	       SSL_CTX_sess_accept_good(ctx));
+    BIO_printf(bio, "%4d session cache hits\n", SSL_CTX_sess_hits(ctx));
+    BIO_printf(bio, "%4d session cache misses\n", SSL_CTX_sess_misses(ctx));
+    BIO_printf(bio, "%4d session cache timeouts\n", SSL_CTX_sess_timeouts(ctx));
 }
 
 static void sv_usage(void)
 {
-    fprintf(stderr, "usage: ssltest [args ...]\n");
-    fprintf(stderr, "\n");
-    fprintf(stderr, " -server_auth  - check server certificate\n");
-    fprintf(stderr, " -client_auth  - do client authentication\n");
-    fprintf(stderr, " -v            - more output\n");
-    fprintf(stderr, " -CApath arg   - PEM format directory of CA's\n");
-    fprintf(stderr, " -CAfile arg   - PEM format file of CA's\n");
-    fprintf(stderr, " -threads arg  - number of threads\n");
-    fprintf(stderr, " -loops arg    - number of 'connections', per thread\n");
-    fprintf(stderr, " -reconnect    - reuse session-id's\n");
-    fprintf(stderr, " -stats        - server session-id cache stats\n");
-    fprintf(stderr, " -cert arg     - server certificate/key\n");
-    fprintf(stderr, " -ccert arg    - client certificate/key\n");
-    fprintf(stderr, " -ssl3         - just SSLv3n\n");
+    BIO_printf(bio_err, "usage: ssltest [args ...]\n");
+    BIO_printf(bio_err, "\n");
+    BIO_printf(bio_err, " -server_auth  - check server certificate\n");
+    BIO_printf(bio_err, " -client_auth  - do client authentication\n");
+    BIO_printf(bio_err, " -v            - more output\n");
+    BIO_printf(bio_err, " -CApath arg   - PEM format directory of CA's\n");
+    BIO_printf(bio_err, " -CAfile arg   - PEM format file of CA's\n");
+    BIO_printf(bio_err, " -threads arg  - number of threads\n");
+    BIO_printf(bio_err, " -loops arg    - number of 'connections', per thread\n");
+    BIO_printf(bio_err, " -reconnect    - reuse session-id's\n");
+    BIO_printf(bio_err, " -stats        - server session-id cache stats\n");
+    BIO_printf(bio_err, " -cert arg     - server certificate/key\n");
+    BIO_printf(bio_err, " -ccert arg    - client certificate/key\n");
+    BIO_printf(bio_err, " -ssl3         - just SSLv3n\n");
 }
 
 int main(int argc, char *argv[])
@@ -195,14 +188,14 @@ int main(int argc, char *argv[])
     SSL_CTX *c_ctx = NULL;
     char *scert = TEST_SERVER_CERT;
     char *ccert = TEST_CLIENT_CERT;
-    SSL_METHOD *ssl_method = SSLv23_method();
+    const SSL_METHOD *ssl_method = SSLv23_method();
 
     RAND_seed(rnd_seed, sizeof rnd_seed);
 
     if (bio_err == NULL)
-        bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
+        bio_err = BIO_new_fd(2, BIO_NOCLOSE);
     if (bio_stdout == NULL)
-        bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE);
+        bio_stdout = BIO_new_fd(1, BIO_NOCLOSE);
     argc--;
     argv++;
 
@@ -250,7 +243,7 @@ int main(int argc, char *argv[])
             if (number_of_loops == 0)
                 number_of_loops = 1;
         } else {
-            fprintf(stderr, "unknown option %s\n", *argv);
+            BIO_printf(bio_err, "unknown option %s\n", *argv);
             badop = 1;
             break;
         }
@@ -284,9 +277,12 @@ int main(int argc, char *argv[])
                                    SSL_SESS_CACHE_SERVER);
 
     if (!SSL_CTX_use_certificate_file(s_ctx, scert, SSL_FILETYPE_PEM)) {
+        BIO_printf(bio_err, "SSL_CTX_use_certificate_file (%s)\n", scert);
         ERR_print_errors(bio_err);
+        goto end;
     } else
         if (!SSL_CTX_use_RSAPrivateKey_file(s_ctx, scert, SSL_FILETYPE_PEM)) {
+        BIO_printf(bio_err, "SSL_CTX_use_RSAPrivateKey_file (%s)\n", scert);
         ERR_print_errors(bio_err);
         goto end;
     }
@@ -300,19 +296,19 @@ int main(int argc, char *argv[])
         (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
         (!SSL_CTX_load_verify_locations(c_ctx, CAfile, CApath)) ||
         (!SSL_CTX_set_default_verify_paths(c_ctx))) {
-        fprintf(stderr, "SSL_load_verify_locations\n");
+        BIO_printf(bio_err, "SSL_load_verify_locations\n");
         ERR_print_errors(bio_err);
         goto end;
     }
 
     if (client_auth) {
-        fprintf(stderr, "client authentication\n");
+        BIO_printf(bio_err, "client authentication\n");
         SSL_CTX_set_verify(s_ctx,
                            SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
                            verify_callback);
     }
     if (server_auth) {
-        fprintf(stderr, "server authentication\n");
+        BIO_printf(bio_err, "server authentication\n");
         SSL_CTX_set_verify(c_ctx, SSL_VERIFY_PEER, verify_callback);
     }
 
@@ -322,24 +318,24 @@ int main(int argc, char *argv[])
  end:
 
     if (c_ctx != NULL) {
-        fprintf(stderr, "Client SSL_CTX stats then free it\n");
-        print_stats(stderr, c_ctx);
+        BIO_printf(bio_err, "Client SSL_CTX stats then free it\n");
+        print_stats(bio_err, c_ctx);
         SSL_CTX_free(c_ctx);
     }
     if (s_ctx != NULL) {
-        fprintf(stderr, "Server SSL_CTX stats then free it\n");
-        print_stats(stderr, s_ctx);
+        BIO_printf(bio_err, "Server SSL_CTX stats then free it\n");
+        print_stats(bio_err, s_ctx);
         if (cache_stats) {
-            fprintf(stderr, "-----\n");
-            lh_stats(SSL_CTX_sessions(s_ctx), stderr);
-            fprintf(stderr, "-----\n");
-    /*-     lh_node_stats(SSL_CTX_sessions(s_ctx),stderr);
-            fprintf(stderr,"-----\n"); */
-            lh_node_usage_stats(SSL_CTX_sessions(s_ctx), stderr);
-            fprintf(stderr, "-----\n");
+            BIO_printf(bio_err, "-----\n");
+            lh_SSL_SESSION_stats_bio(SSL_CTX_sessions(s_ctx), bio_err);
+            BIO_printf(bio_err, "-----\n");
+    /*-     lh_SSL_SESSION_node_stats_bio(SSL_CTX_sessions(s_ctx),bio_err);
+            BIO_printf(bio_err,"-----\n"); */
+            lh_SSL_SESSION_node_usage_stats_bio(SSL_CTX_sessions(s_ctx), bio_err);
+            BIO_printf(bio_err, "-----\n");
         }
         SSL_CTX_free(s_ctx);
-        fprintf(stderr, "done free\n");
+        BIO_printf(bio_err, "done free\n");
     }
     exit(ret);
     return (0);
@@ -355,6 +351,7 @@ int ndoit(SSL_CTX *ssl_ctx[2])
     int i;
     int ret;
     char *ctx[4];
+    CRYPTO_THREADID thread_id;
 
     ctx[0] = (char *)ssl_ctx[0];
     ctx[1] = (char *)ssl_ctx[1];
@@ -367,22 +364,24 @@ int ndoit(SSL_CTX *ssl_ctx[2])
         ctx[3] = NULL;
     }
 
-    fprintf(stdout, "started thread %lu\n", CRYPTO_thread_id());
+    CRYPTO_THREADID_current(&thread_id);
+    BIO_printf(bio_stdout, "started thread %lu\n",
+	       CRYPTO_THREADID_hash(&thread_id));
     for (i = 0; i < number_of_loops; i++) {
-/*-     fprintf(stderr,"%4d %2d ctx->ref (%3d,%3d)\n",
-            CRYPTO_thread_id(),i,
-            ssl_ctx[0]->references,
-            ssl_ctx[1]->references); */
+/*-     BIO_printf(bio_err,"%4d %2d ctx->ref (%3d,%3d)\n",
+                   CRYPTO_THREADID_hash(&thread_id),i,
+                   ssl_ctx[0]->references,
+                   ssl_ctx[1]->references); */
 /*      pthread_delay_np(&tm); */
 
         ret = doit(ctx);
         if (ret != 0) {
-            fprintf(stdout, "error[%d] %lu - %d\n",
-                    i, CRYPTO_thread_id(), ret);
+            BIO_printf(bio_stdout, "error[%d] %lu - %d\n",
+                       i, CRYPTO_THREADID_hash(&thread_id), ret);
             return (ret);
         }
     }
-    fprintf(stdout, "DONE %lu\n", CRYPTO_thread_id());
+    BIO_printf(bio_stdout, "DONE %lu\n", CRYPTO_THREADID_hash(&thread_id));
     if (reconnect) {
         SSL_free((SSL *)ctx[2]);
         SSL_free((SSL *)ctx[3]);
@@ -467,26 +466,26 @@ int doit(char *ctx[4])
 
         if (do_server && verbose) {
             if (SSL_in_init(s_ssl))
-                printf("server waiting in SSL_accept - %s\n",
-                       SSL_state_string_long(s_ssl));
+                BIO_printf(bio_stdout, "server waiting in SSL_accept - %s\n",
+                           SSL_state_string_long(s_ssl));
             else if (s_write)
-                printf("server:SSL_write()\n");
+                BIO_printf(bio_stdout, "server:SSL_write()\n");
             else
-                printf("server:SSL_read()\n");
+                BIO_printf(bio_stdout, "server:SSL_read()\n");
         }
 
         if (do_client && verbose) {
             if (SSL_in_init(c_ssl))
-                printf("client waiting in SSL_connect - %s\n",
-                       SSL_state_string_long(c_ssl));
+                BIO_printf(bio_stdout, "client waiting in SSL_connect - %s\n",
+                           SSL_state_string_long(c_ssl));
             else if (c_write)
-                printf("client:SSL_write()\n");
+                BIO_printf(bio_stdout, "client:SSL_write()\n");
             else
-                printf("client:SSL_read()\n");
+                BIO_printf(bio_stdout, "client:SSL_read()\n");
         }
 
         if (!do_client && !do_server) {
-            fprintf(stdout, "ERROR IN STARTUP\n");
+            BIO_printf(bio_stdout, "ERROR IN STARTUP\n");
             break;
         }
         if (do_client && !(done & C_DONE)) {
@@ -501,12 +500,12 @@ int doit(char *ctx[4])
                         if (BIO_should_write(c_bio))
                             c_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in CLIENT\n");
+                        BIO_printf(bio_err, "ERROR in CLIENT\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL CLIENT STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL CLIENT STARTUP FAILED\n");
                     return (1);
                 } else {
                     /* ok */
@@ -523,19 +522,19 @@ int doit(char *ctx[4])
                         if (BIO_should_write(c_bio))
                             c_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in CLIENT\n");
+                        BIO_printf(bio_err, "ERROR in CLIENT\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL CLIENT STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL CLIENT STARTUP FAILED\n");
                     return (1);
                 } else {
                     done |= C_DONE;
 #ifdef undef
-                    fprintf(stdout, "CLIENT:from server:");
-                    fwrite(cbuf, 1, i, stdout);
-                    fflush(stdout);
+                    BIO_printf(bio_stdout, "CLIENT:from server:");
+                    BIO_write(bio_stdout, cbuf, i);
+                    BIO_flush(bio_stdout);
 #endif
                 }
             }
@@ -553,20 +552,20 @@ int doit(char *ctx[4])
                         if (BIO_should_write(s_bio))
                             s_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in SERVER\n");
+                        BIO_printf(bio_err, "ERROR in SERVER\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL SERVER STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL SERVER STARTUP FAILED\n");
                     return (1);
                 } else {
                     s_write = 1;
                     s_w = 1;
 #ifdef undef
-                    fprintf(stdout, "SERVER:from client:");
-                    fwrite(sbuf, 1, i, stdout);
-                    fflush(stdout);
+                    BIO_printf(bio_stdout, "SERVER:from client:");
+                    BIO_write(bio_stdout, sbuf, i);
+                    BIO_flush(bio_stdout);
 #endif
                 }
             } else {
@@ -580,12 +579,12 @@ int doit(char *ctx[4])
                         if (BIO_should_write(s_bio))
                             s_w = 1;
                     } else {
-                        fprintf(stderr, "ERROR in SERVER\n");
+                        BIO_printf(bio_err, "ERROR in SERVER\n");
                         ERR_print_errors_fp(stderr);
                         return (1);
                     }
                 } else if (i == 0) {
-                    fprintf(stderr, "SSL SERVER STARTUP FAILED\n");
+                    BIO_printf(bio_err, "SSL SERVER STARTUP FAILED\n");
                     return (1);
                 } else {
                     s_write = 0;
@@ -606,7 +605,7 @@ int doit(char *ctx[4])
     SSL_set_shutdown(s_ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
 
 #ifdef undef
-    fprintf(stdout, "DONE\n");
+    BIO_printf(bio_stdout, "DONE\n");
 #endif
  err:
     /*
@@ -640,7 +639,7 @@ int doit(char *ctx[4])
     return (0);
 }
 
-int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
+int verify_callback(int ok, X509_STORE_CTX *ctx)
 {
     char *s, buf[256];
 
@@ -649,9 +648,9 @@ int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
                               buf, 256);
         if (s != NULL) {
             if (ok)
-                fprintf(stderr, "depth=%d %s\n", ctx->error_depth, buf);
+                BIO_printf(bio_err, "depth=%d %s\n", ctx->error_depth, buf);
             else
-                fprintf(stderr, "depth=%d error=%d %s\n",
+                BIO_printf(bio_err, "depth=%d error=%d %s\n",
                         ctx->error_depth, ctx->error, buf);
         }
     }
@@ -688,7 +687,7 @@ void thread_cleanup(void)
     OPENSSL_free(lock_cs);
 }
 
-void win32_locking_callback(int mode, int type, char *file, int line)
+void win32_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
         WaitForSingleObject(lock_cs[type], INFINITE);
@@ -717,7 +716,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                                         (void *)ssl_ctx, 0L, &(thread_id[i]));
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i += 50) {
         int j;
 
@@ -727,7 +726,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                                    (CONST HANDLE *) & (thread_handle[i]),
                                    TRUE, INFINITE)
             == WAIT_FAILED) {
-            fprintf(stderr, "WaitForMultipleObjects failed:%d\n",
+            BIO_printf(bio_err, "WaitForMultipleObjects failed:%d\n",
                     GetLastError());
             exit(1);
         }
@@ -743,7 +742,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
     ret = (ret + end.wSecond - start.wSecond);
     ret += (end.wMilliseconds - start.wMilliseconds) / 1000.0;
 
-    printf("win32 threads done - %.3f seconds\n", ret);
+    BIO_printf(bio_stdout, "win32 threads done - %.3f seconds\n", ret);
 }
 
 #endif                          /* OPENSSL_SYS_WIN32 */
@@ -768,8 +767,8 @@ void thread_setup(void)
         mutex_init(&(lock_cs[i]), USYNC_THREAD, NULL);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())solaris_thread_id);
-    CRYPTO_set_locking_callback((void (*)())solaris_locking_callback);
+    CRYPTO_set_id_callback(solaris_thread_id);
+    CRYPTO_set_locking_callback(solaris_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -778,34 +777,34 @@ void thread_cleanup(void)
 
     CRYPTO_set_locking_callback(NULL);
 
-    fprintf(stderr, "cleanup\n");
+    BIO_printf(bio_err, "cleanup\n");
 
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         /* rwlock_destroy(&(lock_cs[i])); */
         mutex_destroy(&(lock_cs[i]));
-        fprintf(stderr, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_err, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
-    fprintf(stderr, "done cleanup\n");
+    BIO_printf(bio_err, "done cleanup\n");
 
 }
 
-void solaris_locking_callback(int mode, int type, char *file, int line)
+void solaris_locking_callback(int mode, int type, const char *file, int line)
 {
 # ifdef undef
-    fprintf(stderr, "thread=%4d mode=%s lock=%s %s:%d\n",
-            CRYPTO_thread_id(),
-            (mode & CRYPTO_LOCK) ? "l" : "u",
-            (type & CRYPTO_READ) ? "r" : "w", file, line);
+    BIO_printf(bio_err, "thread=%4d mode=%s lock=%s %s:%d\n",
+               CRYPTO_thread_id(),
+               (mode & CRYPTO_LOCK) ? "l" : "u",
+               (type & CRYPTO_READ) ? "r" : "w", file, line);
 # endif
 
     /*-
     if (CRYPTO_LOCK_SSL_CERT == type)
-    fprintf(stderr,"(t,m,f,l) %ld %d %s %d\n",
-            CRYPTO_thread_id(),
-            mode,file,line);
+    BIO_printf(bio_err,"(t,m,f,l) %ld %d %s %d\n",
+               CRYPTO_thread_id(),
+               mode,file,line);
     */
     if (mode & CRYPTO_LOCK) {
         /*-
@@ -837,21 +836,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                    (void *(*)())ndoit, (void *)ssl_ctx, 0L, &(thread_ctx[i]));
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         thr_join(thread_ctx[i], NULL, NULL);
     }
 
-    printf("solaris threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "solaris threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "solaris threads done\n");
+#endif
 }
 
-unsigned long solaris_thread_id(void)
+void solaris_thread_id(CRYPTO_THREADID *tid)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)thr_self();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)thr_self());
 }
 #endif                          /* SOLARIS */
 
@@ -880,8 +880,8 @@ void thread_setup(void)
         lock_cs[i] = usnewsema(arena, 1);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())irix_thread_id);
-    CRYPTO_set_locking_callback((void (*)())irix_locking_callback);
+    CRYPTO_set_id_callback(irix_thread_id);
+    CRYPTO_set_locking_callback(irix_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -899,13 +899,13 @@ void thread_cleanup(void)
     OPENSSL_free(lock_cs);
 }
 
-void irix_locking_callback(int mode, int type, char *file, int line)
+void irix_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
-        printf("lock %d\n", type);
+        BIO_printf(bio_stdout, "lock %d\n", type);
         uspsema(lock_cs[type]);
     } else {
-        printf("unlock %d\n", type);
+        BIO_printf(bio_stdout, "unlock %d\n", type);
         usvsema(lock_cs[type]);
     }
 }
@@ -924,21 +924,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                               PR_SADDR | PR_SFDS, (void *)ssl_ctx);
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         wait(NULL);
     }
 
-    printf("irix threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "irix threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "irix threads done\n");
+#endif
 }
 
 unsigned long irix_thread_id(void)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)getpid();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)getpid());
 }
 #endif                          /* IRIX */
 
@@ -958,8 +959,8 @@ void thread_setup(void)
         pthread_mutex_init(&(lock_cs[i]), NULL);
     }
 
-    CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
-    CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
+    CRYPTO_THREADID_set_callback(pthreads_thread_id);
+    CRYPTO_set_locking_callback(pthreads_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -967,30 +968,30 @@ void thread_cleanup(void)
     int i;
 
     CRYPTO_set_locking_callback(NULL);
-    fprintf(stderr, "cleanup\n");
+    BIO_printf(bio_err, "cleanup\n");
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         pthread_mutex_destroy(&(lock_cs[i]));
-        fprintf(stderr, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_err, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
-    fprintf(stderr, "done cleanup\n");
+    BIO_printf(bio_err, "done cleanup\n");
 }
 
-void pthreads_locking_callback(int mode, int type, char *file, int line)
+void pthreads_locking_callback(int mode, int type, const char *file, int line)
 {
 # ifdef undef
-    fprintf(stderr, "thread=%4d mode=%s lock=%s %s:%d\n",
-            CRYPTO_thread_id(),
-            (mode & CRYPTO_LOCK) ? "l" : "u",
-            (type & CRYPTO_READ) ? "r" : "w", file, line);
+    BIO_printf(bio_err, "thread=%4d mode=%s lock=%s %s:%d\n",
+               CRYPTO_thread_id(),
+               (mode & CRYPTO_LOCK) ? "l" : "u",
+               (type & CRYPTO_READ) ? "r" : "w", file, line);
 # endif
 /*-
     if (CRYPTO_LOCK_SSL_CERT == type)
-            fprintf(stderr,"(t,m,f,l) %ld %d %s %d\n",
-            CRYPTO_thread_id(),
-            mode,file,line);
+            BIO_printf(bio_err,"(t,m,f,l) %ld %d %s %d\n",
+                       CRYPTO_thread_id(),
+                       mode,file,line);
 */
     if (mode & CRYPTO_LOCK) {
         pthread_mutex_lock(&(lock_cs[type]));
@@ -1017,21 +1018,22 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                        (void *(*)())ndoit, (void *)ssl_ctx);
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
     for (i = 0; i < thread_number; i++) {
         pthread_join(thread_ctx[i], NULL);
     }
 
-    printf("pthreads threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "pthreads threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "pthreads threads done\n");
+#endif
 }
 
-unsigned long pthreads_thread_id(void)
+void pthreads_thread_id(CRYPTO_THREADID *tid)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)pthread_self();
-    return (ret);
+    CRYPTO_THREADID_set_numeric(tid, (unsigned long)pthread_self());
 }
 
 #endif                          /* PTHREADS */
@@ -1051,8 +1053,8 @@ void thread_setup(void)
 
     ThreadSem = MPKSemaphoreAlloc("OpenSSL mttest semaphore", 0);
 
-    CRYPTO_set_id_callback((unsigned long (*)())netware_thread_id);
-    CRYPTO_set_locking_callback((void (*)())netware_locking_callback);
+    CRYPTO_set_id_callback(netware_thread_id);
+    CRYPTO_set_locking_callback(netware_locking_callback);
 }
 
 void thread_cleanup(void)
@@ -1061,21 +1063,21 @@ void thread_cleanup(void)
 
     CRYPTO_set_locking_callback(NULL);
 
-    fprintf(stdout, "thread_cleanup\n");
+    BIO_printf(bio_stdout, "thread_cleanup\n");
 
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         MPKMutexFree(lock_cs[i]);
-        fprintf(stdout, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_stdout, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
     MPKSemaphoreFree(ThreadSem);
 
-    fprintf(stdout, "done cleanup\n");
+    BIO_printf(bio_stdout, "done cleanup\n");
 }
 
-void netware_locking_callback(int mode, int type, char *file, int line)
+void netware_locking_callback(int mode, int type, const char *file, int line)
 {
     if (mode & CRYPTO_LOCK) {
         MPKMutexLock(lock_cs[type]);
@@ -1097,22 +1099,23 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
         ThreadSwitchWithDelay();
     }
 
-    printf("reaping\n");
+    BIO_printf(bio_stdout, "reaping\n");
 
     /* loop until all threads have signaled the semaphore */
     for (i = 0; i < thread_number; i++) {
         MPKSemaphoreWait(ThreadSem);
     }
-    printf("netware threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+#if 0 /* We can't currently find out the reference amount */
+    BIO_printf(bio_stdout, "netware threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
+#else
+    BIO_printf(bio_stdout, "netware threads done\n");
+#endif
 }
 
 unsigned long netware_thread_id(void)
 {
-    unsigned long ret;
-
-    ret = (unsigned long)GetThreadID();
-    return (ret);
+    CRYPTO_THREADID_set_numeric((unsigned long)GetThreadID());
 }
 #endif                          /* NETWARE */
 
@@ -1144,24 +1147,24 @@ void thread_cleanup(void)
     int i;
 
     CRYPTO_set_locking_callback(NULL);
-    fprintf(stderr, "cleanup\n");
+    BIO_printf(bio_err, "cleanup\n");
     for (i = 0; i < CRYPTO_num_locks(); i++) {
         delete lock_cs[i];
-        fprintf(stderr, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
+        BIO_printf(bio_err, "%8ld:%s\n", lock_count[i], CRYPTO_get_lock_name(i));
     }
     OPENSSL_free(lock_cs);
     OPENSSL_free(lock_count);
 
-    fprintf(stderr, "done cleanup\n");
+    BIO_printf(bio_err, "done cleanup\n");
 }
 
 void beos_locking_callback(int mode, int type, const char *file, int line)
 {
 # if 0
-    fprintf(stderr, "thread=%4d mode=%s lock=%s %s:%d\n",
-            CRYPTO_thread_id(),
-            (mode & CRYPTO_LOCK) ? "l" : "u",
-            (type & CRYPTO_READ) ? "r" : "w", file, line);
+    BIO_printf(bio_err, "thread=%4d mode=%s lock=%s %s:%d\n",
+               CRYPTO_thread_id(),
+               (mode & CRYPTO_LOCK) ? "l" : "u",
+               (type & CRYPTO_READ) ? "r" : "w", file, line);
 # endif
     if (mode & CRYPTO_LOCK) {
         lock_cs[type]->Lock();
@@ -1187,14 +1190,14 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
         resume_thread(thread_ctx[i]);
     }
 
-    printf("waiting...\n");
+    BIO_printf(bio_stdout, "waiting...\n");
     for (i = 0; i < thread_number; i++) {
         status_t result;
         wait_for_thread(thread_ctx[i], &result);
     }
 
-    printf("beos threads done (%d,%d)\n",
-           s_ctx->references, c_ctx->references);
+    BIO_printf(bio_stdout, "beos threads done (%d,%d)\n",
+               s_ctx->references, c_ctx->references);
 }
 
 unsigned long beos_thread_id(void)
diff --git a/crypto/threads/pthread2.sh b/crypto/threads/pthread2.sh
index 41264c6..ec945c4 100755
--- a/crypto/threads/pthread2.sh
+++ b/crypto/threads/pthread2.sh
@@ -3,5 +3,4 @@
 # build using pthreads where it's already built into the system
 #
 /bin/rm -f mttest
-gcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto -lpthread
-
+gcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto -lpthread -ldl

From rsalz at openssl.org  Sun Jun 21 21:52:19 2015
From: rsalz at openssl.org (Rich Salz)
Date: Sun, 21 Jun 2015 21:52:19 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434923539.753823.5200.nullmailer@dev.openssl.org>

The branch master has been updated
       via  7fba8407cc72e09dbd8d768100617286b0740b03 (commit)
      from  8ca96efd24b73f917837fdd45b1c22d7b8ff8cbd (commit)


- Log -----------------------------------------------------------------
commit 7fba8407cc72e09dbd8d768100617286b0740b03
Author: Rich Salz <rsalz at akamai.com>
Date:   Sun Jun 21 15:37:53 2015 -0400

    RT3917: add cleanup on an error path
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/cms/cms_smime.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c
index 0d97d3e..b33bc1d 100644
--- a/crypto/cms/cms_smime.c
+++ b/crypto/cms/cms_smime.c
@@ -386,7 +386,7 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
         tmpin = BIO_new_mem_buf(ptr, len);
         if (tmpin == NULL) {
             CMSerr(CMS_F_CMS_VERIFY, ERR_R_MALLOC_FAILURE);
-            return 0;
+            goto err2;
         }
     } else
         tmpin = dcont;
@@ -455,6 +455,7 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
     if (out != tmpout)
         BIO_free_all(tmpout);
 
+ err2:
     sk_X509_pop_free(cms_certs, X509_free);
     sk_X509_CRL_pop_free(crls, X509_CRL_free);
 

From rsalz at openssl.org  Sun Jun 21 21:55:12 2015
From: rsalz at openssl.org (Rich Salz)
Date: Sun, 21 Jun 2015 21:55:12 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1434923712.576139.7016.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  44754511646614b0be4c53ac9f1893f5eca3ed64 (commit)
      from  220b9519eb48c5e3f969123508976f777f897330 (commit)


- Log -----------------------------------------------------------------
commit 44754511646614b0be4c53ac9f1893f5eca3ed64
Author: Rich Salz <rsalz at akamai.com>
Date:   Sun Jun 21 15:37:53 2015 -0400

    RT3917: add cleanup on an error path
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit 7fba8407cc72e09dbd8d768100617286b0740b03)

-----------------------------------------------------------------------

Summary of changes:
 crypto/cms/cms_smime.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c
index b39ed48..5522a37 100644
--- a/crypto/cms/cms_smime.c
+++ b/crypto/cms/cms_smime.c
@@ -374,7 +374,7 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
         tmpin = BIO_new_mem_buf(ptr, len);
         if (tmpin == NULL) {
             CMSerr(CMS_F_CMS_VERIFY, ERR_R_MALLOC_FAILURE);
-            return 0;
+            goto err2;
         }
     } else
         tmpin = dcont;
@@ -405,6 +405,7 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
     else
         BIO_free_all(cmsbio);
 
+ err2:
     if (cms_certs)
         sk_X509_pop_free(cms_certs, X509_free);
     if (crls)

From steve at openssl.org  Mon Jun 22 12:55:38 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 22 Jun 2015 12:55:38 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1434977738.659279.31043.nullmailer@dev.openssl.org>

The branch master has been updated
       via  389ebcecae2575188a4ff9566389ce694352be43 (commit)
       via  c34b0f9930563f905412a00b6d8a7280c83eb811 (commit)
       via  8df53b7a7cf00908747e5730b19fe8fed8937b38 (commit)
       via  a273c6eeee6690d7061d3e647a5e648bbd3a997a (commit)
       via  8d92c1f8a381a3be7fe5b3a2c2aa9bfce22f5c72 (commit)
      from  7fba8407cc72e09dbd8d768100617286b0740b03 (commit)


- Log -----------------------------------------------------------------
commit 389ebcecae2575188a4ff9566389ce694352be43
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sun Jun 21 19:42:04 2015 +0100

    Remove SESS_CERT entirely.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit c34b0f9930563f905412a00b6d8a7280c83eb811
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sun Jun 21 19:34:33 2015 +0100

    Move peer chain to SSL_SESSION structure.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit 8df53b7a7cf00908747e5730b19fe8fed8937b38
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sun Jun 21 19:18:50 2015 +0100

    Remove unnuecessary ifdefs.
    
    If RSA or DSA is disabled we will never use a ciphersuite with
    RSA/DSA authentication as it is already filtered out by the cipher
    list logic.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit a273c6eeee6690d7061d3e647a5e648bbd3a997a
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sun Jun 21 19:08:57 2015 +0100

    Remove certificates from sess_cert
    
    As numerous comments indicate the certificate and key array is not an
    appopriate structure to store the peers certificate: so remove it and
    just the s->session->peer instead.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit 8d92c1f8a381a3be7fe5b3a2c2aa9bfce22f5c72
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sun Jun 21 16:26:08 2015 +0100

    Remove peer temp keys from SESS_CERT
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_clnt.c  | 170 +++++++++++++--------------------------------------------
 ssl/s3_lib.c   |  35 ++++++++----
 ssl/s3_srvr.c  |  15 +----
 ssl/ssl_cert.c |  70 ------------------------
 ssl/ssl_lib.c  |   5 +-
 ssl/ssl_locl.h |  49 ++++++-----------
 ssl/ssl_sess.c |   5 +-
 7 files changed, 84 insertions(+), 265 deletions(-)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 935a621..6b4c860 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1243,7 +1243,6 @@ int ssl3_get_server_certificate(SSL *s)
     const unsigned char *q, *p;
     unsigned char *d;
     STACK_OF(X509) *sk = NULL;
-    SESS_CERT *sc;
     EVP_PKEY *pkey = NULL;
 
     n = s->method->ssl_get_message(s,
@@ -1322,14 +1321,7 @@ int ssl3_get_server_certificate(SSL *s)
         goto f_err;
     }
 
-    sc = ssl_sess_cert_new();
-    if (sc == NULL)
-        goto err;
-
-    ssl_sess_cert_free(s->session->sess_cert);
-    s->session->sess_cert = sc;
-
-    sc->cert_chain = sk;
+    s->session->peer_chain = sk;
     /*
      * Inconsistency alert: cert_chain does include the peer's certificate,
      * which we don't include in s3_srvr.c
@@ -1367,15 +1359,7 @@ int ssl3_get_server_certificate(SSL *s)
                SSL_R_WRONG_CERTIFICATE_TYPE);
         goto f_err;
     }
-    sc->peer_cert_type = i;
-    CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
-    /*
-     * Why would the following ever happen? We just created sc a couple
-     * of lines ago.
-     */
-    X509_free(sc->peer_pkeys[i].x509);
-    sc->peer_pkeys[i].x509 = x;
-    sc->peer_key = &(sc->peer_pkeys[i]);
+    s->session->peer_type = i;
 
     X509_free(s->session->peer);
     CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
@@ -1454,7 +1438,6 @@ int ssl3_get_key_exchange(SSL *s)
          * problems later.
          */
         if (alg_k & SSL_kPSK) {
-            s->session->sess_cert = ssl_sess_cert_new();
             OPENSSL_free(s->ctx->psk_identity_hint);
             s->ctx->psk_identity_hint = NULL;
         }
@@ -1464,22 +1447,19 @@ int ssl3_get_key_exchange(SSL *s)
     }
 
     param = p = (unsigned char *)s->init_msg;
-    if (s->session->sess_cert != NULL) {
+
 #ifndef OPENSSL_NO_RSA
-        RSA_free(s->session->sess_cert->peer_rsa_tmp);
-        s->session->sess_cert->peer_rsa_tmp = NULL;
+    RSA_free(s->s3->peer_rsa_tmp);
+    s->s3->peer_rsa_tmp = NULL;
 #endif
 #ifndef OPENSSL_NO_DH
-        DH_free(s->session->sess_cert->peer_dh_tmp);
-        s->session->sess_cert->peer_dh_tmp = NULL;
+    DH_free(s->s3->peer_dh_tmp);
+    s->s3->peer_dh_tmp = NULL;
 #endif
 #ifndef OPENSSL_NO_EC
-        EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp);
-        s->session->sess_cert->peer_ecdh_tmp = NULL;
+    EC_KEY_free(s->s3->peer_ecdh_tmp);
+    s->s3->peer_ecdh_tmp = NULL;
 #endif
-    } else {
-        s->session->sess_cert = ssl_sess_cert_new();
-    }
 
     /* Total length of the parameters including the length prefix */
     param_len = 0;
@@ -1625,21 +1605,8 @@ int ssl3_get_key_exchange(SSL *s)
         }
 
 /* We must check if there is a certificate */
-# ifndef OPENSSL_NO_RSA
-        if (alg_a & SSL_aRSA)
-            pkey =
-                X509_get_pubkey(s->session->
-                                sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
-# else
-        if (0) ;
-# endif
-# ifndef OPENSSL_NO_DSA
-        else if (alg_a & SSL_aDSS)
-            pkey =
-                X509_get_pubkey(s->session->
-                                sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].
-                                x509);
-# endif
+        if (alg_a & (SSL_aRSA|SSL_aDSS))
+            pkey = X509_get_pubkey(s->session->peer);
     } else
 #endif                          /* !OPENSSL_NO_SRP */
 #ifndef OPENSSL_NO_RSA
@@ -1697,9 +1664,7 @@ int ssl3_get_key_exchange(SSL *s)
 
         /* this should be because we are using an export cipher */
         if (alg_a & SSL_aRSA)
-            pkey =
-                X509_get_pubkey(s->session->
-                                sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+            pkey = X509_get_pubkey(s->session->peer);
         else {
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto err;
@@ -1711,7 +1676,7 @@ int ssl3_get_key_exchange(SSL *s)
             goto f_err;
         }
 
-        s->session->sess_cert->peer_rsa_tmp = rsa;
+        s->s3->peer_rsa_tmp = rsa;
         rsa = NULL;
     }
 #else                           /* OPENSSL_NO_RSA */
@@ -1789,24 +1754,11 @@ int ssl3_get_key_exchange(SSL *s)
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_DH_KEY_TOO_SMALL);
             goto f_err;
         }
-# ifndef OPENSSL_NO_RSA
-        if (alg_a & SSL_aRSA)
-            pkey =
-                X509_get_pubkey(s->session->
-                                sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
-# else
-        if (0) ;
-# endif
-# ifndef OPENSSL_NO_DSA
-        else if (alg_a & SSL_aDSS)
-            pkey =
-                X509_get_pubkey(s->session->
-                                sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].
-                                x509);
-# endif
+        if (alg_a & (SSL_aRSA|SSL_aDSS))
+            pkey = X509_get_pubkey(s->session->peer);
         /* else anonymous DH, so no certificate or pkey. */
 
-        s->session->sess_cert->peer_dh_tmp = dh;
+        s->s3->peer_dh_tmp = dh;
         dh = NULL;
     }
 #endif                          /* !OPENSSL_NO_DH */
@@ -1905,19 +1857,15 @@ int ssl3_get_key_exchange(SSL *s)
         if (0) ;
 # ifndef OPENSSL_NO_RSA
         else if (alg_a & SSL_aRSA)
-            pkey =
-                X509_get_pubkey(s->session->
-                                sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+            pkey = X509_get_pubkey(s->session->peer);
 # endif
 # ifndef OPENSSL_NO_EC
         else if (alg_a & SSL_aECDSA)
-            pkey =
-                X509_get_pubkey(s->session->
-                                sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+            pkey = X509_get_pubkey(s->session->peer);
 # endif
         /* else anonymous ECDH, so no certificate or pkey. */
         EC_KEY_set_public_key(ecdh, srvr_ecpoint);
-        s->session->sess_cert->peer_ecdh_tmp = ecdh;
+        s->s3->peer_ecdh_tmp = ecdh;
         ecdh = NULL;
         BN_CTX_free(bn_ctx);
         bn_ctx = NULL;
@@ -2437,7 +2385,7 @@ int ssl3_send_client_key_exchange(SSL *s)
             if (!pms)
                 goto memerr;
 
-            if (s->session->sess_cert == NULL) {
+            if (s->session->peer == NULL) {
                 /*
                  * We should always have a server certificate with SSL_kRSA.
                  */
@@ -2446,13 +2394,10 @@ int ssl3_send_client_key_exchange(SSL *s)
                 goto err;
             }
 
-            if (s->session->sess_cert->peer_rsa_tmp != NULL)
-                rsa = s->session->sess_cert->peer_rsa_tmp;
+            if (s->s3->peer_rsa_tmp != NULL)
+                rsa = s->s3->peer_rsa_tmp;
             else {
-                pkey =
-                    X509_get_pubkey(s->session->
-                                    sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].
-                                    x509);
+                pkey = X509_get_pubkey(s->session->peer);
                 if ((pkey == NULL) || (pkey->type != EVP_PKEY_RSA)
                     || (pkey->pkey.rsa == NULL)) {
                     SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
@@ -2495,24 +2440,13 @@ int ssl3_send_client_key_exchange(SSL *s)
 #ifndef OPENSSL_NO_DH
         else if (alg_k & (SSL_kDHE | SSL_kDHr | SSL_kDHd)) {
             DH *dh_srvr, *dh_clnt;
-            SESS_CERT *scert = s->session->sess_cert;
-
-            if (scert == NULL) {
-                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
-                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
-                       SSL_R_UNEXPECTED_MESSAGE);
-                goto err;
-            }
-
-            if (scert->peer_dh_tmp != NULL)
-                dh_srvr = scert->peer_dh_tmp;
+            if (s->s3->peer_dh_tmp != NULL)
+                dh_srvr = s->s3->peer_dh_tmp;
             else {
                 /* we get them from the cert */
-                int idx = scert->peer_cert_type;
                 EVP_PKEY *spkey = NULL;
                 dh_srvr = NULL;
-                if (idx >= 0)
-                    spkey = X509_get_pubkey(scert->peer_pkeys[idx].x509);
+                spkey = X509_get_pubkey(s->session->peer);
                 if (spkey) {
                     dh_srvr = EVP_PKEY_get1_DH(spkey);
                     EVP_PKEY_free(spkey);
@@ -2558,7 +2492,7 @@ int ssl3_send_client_key_exchange(SSL *s)
              */
 
             n = DH_compute_key(pms, dh_srvr->pub_key, dh_clnt);
-            if (scert->peer_dh_tmp == NULL)
+            if (s->s3->peer_dh_tmp == NULL)
                 DH_free(dh_srvr);
 
             if (n <= 0) {
@@ -2588,14 +2522,6 @@ int ssl3_send_client_key_exchange(SSL *s)
             EC_KEY *tkey;
             int ecdh_clnt_cert = 0;
             int field_size = 0;
-
-            if (s->session->sess_cert == NULL) {
-                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
-                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
-                       SSL_R_UNEXPECTED_MESSAGE);
-                goto err;
-            }
-
             /*
              * Did we send out the client's ECDH share for use in premaster
              * computation as part of client certificate? If so, set
@@ -2624,13 +2550,11 @@ int ssl3_send_client_key_exchange(SSL *s)
                  */
             }
 
-            if (s->session->sess_cert->peer_ecdh_tmp != NULL) {
-                tkey = s->session->sess_cert->peer_ecdh_tmp;
+            if (s->s3->peer_ecdh_tmp != NULL) {
+                tkey = s->s3->peer_ecdh_tmp;
             } else {
                 /* Get the Server Public Key from Cert */
-                srvr_pub_pkey =
-                    X509_get_pubkey(s->session->
-                                    sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+                srvr_pub_pkey = X509_get_pubkey(s->session->peer);
                 if ((srvr_pub_pkey == NULL)
                     || (srvr_pub_pkey->type != EVP_PKEY_EC)
                     || (srvr_pub_pkey->pkey.ec == NULL)) {
@@ -2758,7 +2682,6 @@ int ssl3_send_client_key_exchange(SSL *s)
             X509 *peer_cert;
             size_t msglen;
             unsigned int md_len;
-            int keytype;
             unsigned char shared_ukm[32], tmp[256];
             EVP_MD_CTX *ukm_hash;
             EVP_PKEY *pub_key;
@@ -2771,13 +2694,7 @@ int ssl3_send_client_key_exchange(SSL *s)
             /*
              * Get server sertificate PKEY and create ctx from it
              */
-            peer_cert =
-                s->session->
-                sess_cert->peer_pkeys[(keytype = SSL_PKEY_GOST01)].x509;
-            if (!peer_cert)
-                peer_cert =
-                    s->session->
-                    sess_cert->peer_pkeys[(keytype = SSL_PKEY_GOST94)].x509;
+            peer_cert = s->session->peer;
             if (!peer_cert) {
                 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
                        SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
@@ -3218,15 +3135,14 @@ static int ssl3_check_client_certificate(SSL *s)
     alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
     /* See if we can use client certificate for fixed DH */
     if (alg_k & (SSL_kDHr | SSL_kDHd)) {
-        SESS_CERT *scert = s->session->sess_cert;
-        int i = scert->peer_cert_type;
+        int i = s->session->peer_type;
         EVP_PKEY *clkey = NULL, *spkey = NULL;
         clkey = s->cert->key->privatekey;
         /* If client key not DH assume it can be used */
         if (EVP_PKEY_id(clkey) != EVP_PKEY_DH)
             return 1;
         if (i >= 0)
-            spkey = X509_get_pubkey(scert->peer_pkeys[i].x509);
+            spkey = X509_get_pubkey(s->session->peer);
         if (spkey) {
             /* Compare server and client parameters */
             i = EVP_PKEY_cmp_parameters(clkey, spkey);
@@ -3335,7 +3251,6 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     long alg_k, alg_a;
     EVP_PKEY *pkey = NULL;
     int pkey_bits;
-    SESS_CERT *sc;
 #ifndef OPENSSL_NO_RSA
     RSA *rsa;
 #endif
@@ -3350,25 +3265,19 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     /* we don't have a certificate */
     if ((alg_a & SSL_aNULL) || (alg_k & SSL_kPSK))
         return (1);
-
-    sc = s->session->sess_cert;
-    if (sc == NULL) {
-        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
-        goto err;
-    }
 #ifndef OPENSSL_NO_RSA
-    rsa = s->session->sess_cert->peer_rsa_tmp;
+    rsa = s->s3->peer_rsa_tmp;
 #endif
 #ifndef OPENSSL_NO_DH
-    dh = s->session->sess_cert->peer_dh_tmp;
+    dh = s->s3->peer_dh_tmp;
 #endif
 
     /* This is the passed certificate */
 
-    idx = sc->peer_cert_type;
+    idx = s->session->peer_type;
 #ifndef OPENSSL_NO_EC
     if (idx == SSL_PKEY_ECC) {
-        if (ssl_check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509, s) == 0) {
+        if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s) == 0) {
             /* check failed */
             SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_BAD_ECC_CERT);
             goto f_err;
@@ -3384,9 +3293,9 @@ int ssl3_check_cert_and_algorithm(SSL *s)
         goto f_err;
     }
 #endif
-    pkey = X509_get_pubkey(sc->peer_pkeys[idx].x509);
+    pkey = X509_get_pubkey(s->session->peer);
     pkey_bits = EVP_PKEY_bits(pkey);
-    i = X509_certificate_type(sc->peer_pkeys[idx].x509, pkey);
+    i = X509_certificate_type(s->session->peer, pkey);
     EVP_PKEY_free(pkey);
 
     /* Check that we have a certificate if we require one */
@@ -3492,7 +3401,6 @@ int ssl3_check_cert_and_algorithm(SSL *s)
     return (1);
  f_err:
     ssl3_send_alert(s, SSL3_AL_FATAL, al);
- err:
     return (0);
 }
 
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 0307801..6febd4e 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -2894,11 +2894,17 @@ void ssl3_free(SSL *s)
         return;
 
     ssl3_cleanup_key_block(s);
+
+#ifndef OPENSSL_NO_RSA
+    RSA_free(s->s3->peer_rsa_tmp);
+#endif
 #ifndef OPENSSL_NO_DH
     DH_free(s->s3->tmp.dh);
+    DH_free(s->s3->peer_dh_tmp);
 #endif
 #ifndef OPENSSL_NO_EC
     EC_KEY_free(s->s3->tmp.ecdh);
+    EC_KEY_free(s->s3->peer_ecdh_tmp);
 #endif
 
     sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
@@ -2929,13 +2935,22 @@ void ssl3_clear(SSL *s)
     OPENSSL_free(s->s3->tmp.peer_sigalgs);
     s->s3->tmp.peer_sigalgs = NULL;
 
+#ifndef OPENSSL_NO_RSA
+    RSA_free(s->s3->peer_rsa_tmp);
+    s->s3->peer_rsa_tmp = NULL;
+#endif
+
 #ifndef OPENSSL_NO_DH
     DH_free(s->s3->tmp.dh);
     s->s3->tmp.dh = NULL;
+    DH_free(s->s3->peer_dh_tmp);
+    s->s3->peer_dh_tmp = NULL;
 #endif
 #ifndef OPENSSL_NO_EC
     EC_KEY_free(s->s3->tmp.ecdh);
     s->s3->tmp.ecdh = NULL;
+    EC_KEY_free(s->s3->peer_ecdh_tmp);
+    s->s3->peer_ecdh_tmp = NULL;
     s->s3->is_probably_safari = 0;
 #endif                         /* !OPENSSL_NO_EC */
 
@@ -3312,7 +3327,7 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
 
     case SSL_CTRL_GET_PEER_SIGNATURE_NID:
         if (SSL_USE_SIGALGS(s)) {
-            if (s->session && s->session->sess_cert) {
+            if (s->session) {
                 const EVP_MD *sig;
                 sig = s->s3->tmp.peer_md;
                 if (sig) {
@@ -3327,31 +3342,29 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
             return 0;
 
     case SSL_CTRL_GET_SERVER_TMP_KEY:
-        if (s->server || !s->session || !s->session->sess_cert)
+        if (s->server || !s->session)
             return 0;
         else {
-            SESS_CERT *sc;
             EVP_PKEY *ptmp;
             int rv = 0;
-            sc = s->session->sess_cert;
 #if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC)
-            if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp && !sc->peer_ecdh_tmp)
+            if (!s->s3->peer_rsa_tmp && !s->s3->peer_dh_tmp && !s->s3->peer_ecdh_tmp)
                 return 0;
 #endif
             ptmp = EVP_PKEY_new();
             if (!ptmp)
                 return 0;
 #ifndef OPENSSL_NO_RSA
-            else if (sc->peer_rsa_tmp)
-                rv = EVP_PKEY_set1_RSA(ptmp, sc->peer_rsa_tmp);
+            else if (s->s3->peer_rsa_tmp)
+                rv = EVP_PKEY_set1_RSA(ptmp, s->s3->peer_rsa_tmp);
 #endif
 #ifndef OPENSSL_NO_DH
-            else if (sc->peer_dh_tmp)
-                rv = EVP_PKEY_set1_DH(ptmp, sc->peer_dh_tmp);
+            else if (s->s3->peer_dh_tmp)
+                rv = EVP_PKEY_set1_DH(ptmp, s->s3->peer_dh_tmp);
 #endif
 #ifndef OPENSSL_NO_EC
-            else if (sc->peer_ecdh_tmp)
-                rv = EVP_PKEY_set1_EC_KEY(ptmp, sc->peer_ecdh_tmp);
+            else if (s->s3->peer_ecdh_tmp)
+                rv = EVP_PKEY_set1_EC_KEY(ptmp, s->s3->peer_ecdh_tmp);
 #endif
             if (rv) {
                 *(EVP_PKEY **)parg = ptmp;
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 90a67d1..b98beac 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -3195,19 +3195,8 @@ int ssl3_get_client_certificate(SSL *s)
     s->session->peer = sk_X509_shift(sk);
     s->session->verify_result = s->verify_result;
 
-    /*
-     * With the current implementation, sess_cert will always be NULL when we
-     * arrive here.
-     */
-    if (s->session->sess_cert == NULL) {
-        s->session->sess_cert = ssl_sess_cert_new();
-        if (s->session->sess_cert == NULL) {
-            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
-            goto done;
-        }
-    }
-    sk_X509_pop_free(s->session->sess_cert->cert_chain, X509_free);
-    s->session->sess_cert->cert_chain = sk;
+    sk_X509_pop_free(s->session->peer_chain, X509_free);
+    s->session->peer_chain = sk;
     /*
      * Inconsistency alert: cert_chain does *not* include the peer's own
      * certificate, while we do include it in s3_clnt.c
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 6b39e25..5e9b8ff 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -519,76 +519,6 @@ void ssl_cert_set_cert_cb(CERT *c, int (*cb) (SSL *ssl, void *arg), void *arg)
     c->cert_cb_arg = arg;
 }
 
-SESS_CERT *ssl_sess_cert_new(void)
-{
-    SESS_CERT *ret;
-
-    ret = OPENSSL_malloc(sizeof(*ret));
-    if (ret == NULL) {
-        SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
-        return NULL;
-    }
-
-    memset(ret, 0, sizeof(*ret));
-    ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
-    ret->references = 1;
-
-    return ret;
-}
-
-void ssl_sess_cert_free(SESS_CERT *sc)
-{
-    int i;
-
-    if (sc == NULL)
-        return;
-
-    i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT);
-#ifdef REF_PRINT
-    REF_PRINT("SESS_CERT", sc);
-#endif
-    if (i > 0)
-        return;
-#ifdef REF_CHECK
-    if (i < 0) {
-        fprintf(stderr, "ssl_sess_cert_free, bad reference count\n");
-        abort();                /* ok */
-    }
-#endif
-
-    /* i == 0 */
-    sk_X509_pop_free(sc->cert_chain, X509_free);
-    for (i = 0; i < SSL_PKEY_NUM; i++) {
-        X509_free(sc->peer_pkeys[i].x509);
-#if 0
-        /*
-         * We don't have the peer's private key. This line is just
-         * here as a reminder that we're still using a not-quite-appropriate
-         *  data structure.
-         */
-        EVP_PKEY_free(sc->peer_pkeys[i].privatekey);
-#endif
-    }
-
-#ifndef OPENSSL_NO_RSA
-    RSA_free(sc->peer_rsa_tmp);
-#endif
-#ifndef OPENSSL_NO_DH
-    DH_free(sc->peer_dh_tmp);
-#endif
-#ifndef OPENSSL_NO_EC
-    EC_KEY_free(sc->peer_ecdh_tmp);
-#endif
-
-    OPENSSL_free(sc);
-}
-
-int ssl_set_peer_cert_type(SESS_CERT *sc, int type)
-{
-    sc->peer_cert_type = type;
-    return (1);
-}
-
 int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)
 {
     X509 *x;
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 5c814fd..ceba30f 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -834,11 +834,10 @@ STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s)
 {
     STACK_OF(X509) *r;
 
-    if ((s == NULL) || (s->session == NULL)
-        || (s->session->sess_cert == NULL))
+    if ((s == NULL) || (s->session == NULL))
         r = NULL;
     else
-        r = s->session->sess_cert->cert_chain;
+        r = s->session->peer_chain;
 
     /*
      * If we are a client, cert_chain includes the peer's own certificate; if
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 3252631..f1046c5 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -624,15 +624,11 @@ struct ssl_session_st {
      * to disable session caching and tickets.
      */
     int not_resumable;
-    /* The cert is the certificate used to establish this connection */
-    struct sess_cert_st /* SESS_CERT */ *sess_cert;
-    /*
-     * This is the cert for the other end. On clients, it will be the same as
-     * sess_cert->peer_key->x509 (the latter is not enough as sess_cert is
-     * not retained in the external representation of sessions, see
-     * ssl_asn1.c).
-     */
+    /* This is the cert and type for the other end. */
     X509 *peer;
+    int peer_type;
+    /* Certificate chain of peer */
+    STACK_OF(X509) *peer_chain;
     /*
      * when app_verify_callback accepts a session where the peer's
      * certificate is not ok, we must remember the error for session reuse:
@@ -1340,6 +1336,18 @@ typedef struct ssl3_state_st {
      */
     char is_probably_safari;
 #   endif                       /* !OPENSSL_NO_EC */
+
+    /* For clients: peer temporary key */
+# ifndef OPENSSL_NO_RSA
+    RSA *peer_rsa_tmp;
+# endif
+# ifndef OPENSSL_NO_DH
+    DH *peer_dh_tmp;
+# endif
+# ifndef OPENSSL_NO_EC
+    EC_KEY *peer_ecdh_tmp;
+# endif
+
 } SSL3_STATE;
 
 
@@ -1578,28 +1586,6 @@ typedef struct cert_st {
     int references;             /* >1 only if SSL_copy_session_id is used */
 } CERT;
 
-typedef struct sess_cert_st {
-    STACK_OF(X509) *cert_chain; /* as received from peer */
-    /* The 'peer_...' members are used only by clients. */
-    int peer_cert_type;
-    CERT_PKEY *peer_key;        /* points to an element of peer_pkeys (never
-                                 * NULL!) */
-    CERT_PKEY peer_pkeys[SSL_PKEY_NUM];
-    /*
-     * Obviously we don't have the private keys of these, so maybe we
-     * shouldn't even use the CERT_PKEY type here.
-     */
-# ifndef OPENSSL_NO_RSA
-    RSA *peer_rsa_tmp;          /* not used for SSL 2 */
-# endif
-# ifndef OPENSSL_NO_DH
-    DH *peer_dh_tmp;            /* not used for SSL 2 */
-# endif
-# ifndef OPENSSL_NO_EC
-    EC_KEY *peer_ecdh_tmp;
-# endif
-    int references;             /* actually always 1 at the moment */
-} SESS_CERT;
 /* Structure containing decoded values of signature algorithms extension */
 struct tls_sigalgs_st {
     /* NID of hash algorithm */
@@ -1854,9 +1840,6 @@ __owur CERT *ssl_cert_new(void);
 __owur CERT *ssl_cert_dup(CERT *cert);
 void ssl_cert_clear_certs(CERT *c);
 void ssl_cert_free(CERT *c);
-__owur SESS_CERT *ssl_sess_cert_new(void);
-void ssl_sess_cert_free(SESS_CERT *sc);
-__owur int ssl_set_peer_cert_type(SESS_CERT *c, int type);
 __owur int ssl_get_new_session(SSL *s, int session);
 __owur int ssl_get_prev_session(SSL *s, unsigned char *session, int len,
                          const unsigned char *limit);
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index c639e53..03c6ac0 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -265,9 +265,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
 
     dest->references = 1;
 
-    if (src->sess_cert != NULL)
-        CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
-
     if (src->peer != NULL)
         CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
 
@@ -843,8 +840,8 @@ void SSL_SESSION_free(SSL_SESSION *ss)
 
     OPENSSL_cleanse(ss->master_key, sizeof ss->master_key);
     OPENSSL_cleanse(ss->session_id, sizeof ss->session_id);
-    ssl_sess_cert_free(ss->sess_cert);
     X509_free(ss->peer);
+    sk_X509_pop_free(ss->peer_chain, X509_free);
     sk_SSL_CIPHER_free(ss->ciphers);
     OPENSSL_free(ss->tlsext_hostname);
     OPENSSL_free(ss->tlsext_tick);

From rsalz at openssl.org  Mon Jun 22 19:49:41 2015
From: rsalz at openssl.org (Rich Salz)
Date: Mon, 22 Jun 2015 19:49:41 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435002581.169693.1777.nullmailer@dev.openssl.org>

The branch master has been updated
       via  75ba5c58c6b3b3326a6c3198100830afa120e7c3 (commit)
      from  389ebcecae2575188a4ff9566389ce694352be43 (commit)


- Log -----------------------------------------------------------------
commit 75ba5c58c6b3b3326a6c3198100830afa120e7c3
Author: Rich Salz <rsalz at akamai.com>
Date:   Sat Jun 13 17:18:47 2015 -0400

    RT3907: avoid "local" in testssl script
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/test/testssl b/test/testssl
index 7e834a7..cb8e56a 100644
--- a/test/testssl
+++ b/test/testssl
@@ -118,11 +118,10 @@ echo test sslv2/sslv3 with both client and server authentication via BIO pair an
 $ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
 
 test_cipher() {
-  local cipher=$1
-  local protocol=$2
+    _cipher=$1
     echo "Testing $cipher"
     prot=""
-    if [ $protocol = "SSLv3" ] ; then
+    if [ $2 = "SSLv3" ] ; then
       prot="-ssl3"
     fi
     $ssltest -cipher $cipher $prot

From rsalz at openssl.org  Mon Jun 22 19:50:08 2015
From: rsalz at openssl.org (Rich Salz)
Date: Mon, 22 Jun 2015 19:50:08 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435002608.518902.2599.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  57bd71b45b39d4eedece0b0289c3a8173280e540 (commit)
      from  44754511646614b0be4c53ac9f1893f5eca3ed64 (commit)


- Log -----------------------------------------------------------------
commit 57bd71b45b39d4eedece0b0289c3a8173280e540
Author: Rich Salz <rsalz at akamai.com>
Date:   Sat Jun 13 17:18:47 2015 -0400

    RT3907: avoid "local" in testssl script
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit 75ba5c58c6b3b3326a6c3198100830afa120e7c3)

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/test/testssl b/test/testssl
index ddebf08..699ce14 100644
--- a/test/testssl
+++ b/test/testssl
@@ -146,11 +146,10 @@ echo test sslv2/sslv3 with both client and server authentication via BIO pair an
 $ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
 
 test_cipher() {
-  local cipher=$1
-  local protocol=$2
+    _cipher=$1
     echo "Testing $cipher"
     prot=""
-    if [ $protocol = "SSLv3" ] ; then
+    if [ $2 = "SSLv3" ] ; then
       prot="-ssl3"
     fi
     $ssltest -cipher $cipher $prot

From rsalz at openssl.org  Mon Jun 22 19:50:21 2015
From: rsalz at openssl.org (Rich Salz)
Date: Mon, 22 Jun 2015 19:50:21 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1435002621.837139.2980.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  9ad2eb6a6e0f75af16078d47df04b1fb16cae143 (commit)
      from  f4961dc2af340f87747c739269fa2b3b704bfe3f (commit)


- Log -----------------------------------------------------------------
commit 9ad2eb6a6e0f75af16078d47df04b1fb16cae143
Author: Rich Salz <rsalz at akamai.com>
Date:   Sat Jun 13 17:18:47 2015 -0400

    RT3907: avoid "local" in testssl script
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit 75ba5c58c6b3b3326a6c3198100830afa120e7c3)

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/test/testssl b/test/testssl
index b9b86b3..f41a60c 100644
--- a/test/testssl
+++ b/test/testssl
@@ -120,11 +120,10 @@ echo test sslv2/sslv3 with both client and server authentication via BIO pair an
 $ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
 
 test_cipher() {
-  local cipher=$1
-  local protocol=$2
+    _cipher=$1
     echo "Testing $cipher"
     prot=""
-    if [ $protocol = "SSLv3" ] ; then
+    if [ $2 = "SSLv3" ] ; then
       prot="-ssl3"
     fi
     $ssltest -cipher $cipher $prot

From rsalz at openssl.org  Tue Jun 23 00:49:28 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 00:49:28 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435020568.263191.14907.nullmailer@dev.openssl.org>

The branch master has been updated
       via  cc3f3fc2b1c94d65824ab8d69595b6d89b17cf8d (commit)
      from  75ba5c58c6b3b3326a6c3198100830afa120e7c3 (commit)


- Log -----------------------------------------------------------------
commit cc3f3fc2b1c94d65824ab8d69595b6d89b17cf8d
Author: Rich Salz <rsalz at akamai.com>
Date:   Mon Jun 22 19:26:50 2015 -0400

    RT3907-fix
    
    Typo in local variable name; introduced by previous fix.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/testssl b/test/testssl
index cb8e56a..dd89204 100644
--- a/test/testssl
+++ b/test/testssl
@@ -119,14 +119,14 @@ $ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
 
 test_cipher() {
     _cipher=$1
-    echo "Testing $cipher"
+    echo "Testing $_cipher"
     prot=""
     if [ $2 = "SSLv3" ] ; then
       prot="-ssl3"
     fi
-    $ssltest -cipher $cipher $prot
+    $ssltest -cipher $_cipher $prot
     if [ $? -ne 0 ] ; then
-	  echo "Failed $cipher"
+	  echo "Failed $_cipher"
 	  exit 1
     fi
 }

From rsalz at openssl.org  Tue Jun 23 00:50:27 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 00:50:27 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435020627.165053.15663.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  0abf6104476db172dd82a66e1a4567876270e0ef (commit)
      from  57bd71b45b39d4eedece0b0289c3a8173280e540 (commit)


- Log -----------------------------------------------------------------
commit 0abf6104476db172dd82a66e1a4567876270e0ef
Author: Rich Salz <rsalz at akamai.com>
Date:   Mon Jun 22 19:26:50 2015 -0400

    RT3907-fix
    
    Typo in local variable name; introduced by previous fix.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit cc3f3fc2b1c94d65824ab8d69595b6d89b17cf8d)

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/testssl b/test/testssl
index 699ce14..c3461b0 100644
--- a/test/testssl
+++ b/test/testssl
@@ -147,14 +147,14 @@ $ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
 
 test_cipher() {
     _cipher=$1
-    echo "Testing $cipher"
+    echo "Testing $_cipher"
     prot=""
     if [ $2 = "SSLv3" ] ; then
       prot="-ssl3"
     fi
-    $ssltest -cipher $cipher $prot
+    $ssltest -cipher $_cipher $prot
     if [ $? -ne 0 ] ; then
-	  echo "Failed $cipher"
+	  echo "Failed $_cipher"
 	  exit 1
     fi
 }

From rsalz at openssl.org  Tue Jun 23 00:53:21 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 00:53:21 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1435020801.454308.17805.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  ae2f46597a01f3e7042493d09bd0559028bb5699 (commit)
      from  9ad2eb6a6e0f75af16078d47df04b1fb16cae143 (commit)


- Log -----------------------------------------------------------------
commit ae2f46597a01f3e7042493d09bd0559028bb5699
Author: Rich Salz <rsalz at akamai.com>
Date:   Mon Jun 22 19:26:50 2015 -0400

    RT3907-fix
    
    Typo in local variable name; introduced by previous fix.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit cc3f3fc2b1c94d65824ab8d69595b6d89b17cf8d)

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/testssl b/test/testssl
index f41a60c..d5b1c9a 100644
--- a/test/testssl
+++ b/test/testssl
@@ -121,14 +121,14 @@ $ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
 
 test_cipher() {
     _cipher=$1
-    echo "Testing $cipher"
+    echo "Testing $_cipher"
     prot=""
     if [ $2 = "SSLv3" ] ; then
       prot="-ssl3"
     fi
-    $ssltest -cipher $cipher $prot
+    $ssltest -cipher $_cipher $prot
     if [ $? -ne 0 ] ; then
-	  echo "Failed $cipher"
+	  echo "Failed $_cipher"
 	  exit 1
     fi
 }

From levitte at openssl.org  Tue Jun 23 00:59:55 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 23 Jun 2015 00:59:55 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435021195.925732.20556.nullmailer@dev.openssl.org>

The branch master has been updated
       via  a1c506ae9ecb493bb1ae3226100b489e56c4d307 (commit)
       via  ed45f3c24212f612a3d029760fa5fa7dc0907074 (commit)
      from  cc3f3fc2b1c94d65824ab8d69595b6d89b17cf8d (commit)


- Log -----------------------------------------------------------------
commit a1c506ae9ecb493bb1ae3226100b489e56c4d307
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Jun 23 01:58:10 2015 +0200

    make update
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit ed45f3c24212f612a3d029760fa5fa7dc0907074
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Jun 23 01:55:46 2015 +0200

    Rearrange rsaz
    
    A small rearrangement so the inclusion of rsaz_exp.h would be
    unconditional, but what that header defines becomes conditional.
    
    This solves the weirdness where rsaz_exp.h gets in and out of the
    dependency list for bn_exp.c, depending on the present architecture.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/Makefile   |  2 +-
 crypto/bn/bn_exp.c   |  8 +-------
 crypto/bn/rsaz_exp.c | 10 ++++++++++
 crypto/bn/rsaz_exp.h | 11 ++++++++++-
 4 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/crypto/bn/Makefile b/crypto/bn/Makefile
index 8875c41..7d55778 100644
--- a/crypto/bn/Makefile
+++ b/crypto/bn/Makefile
@@ -247,7 +247,7 @@ bn_exp.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
 bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 bn_exp.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bn_exp.o: ../../include/openssl/symhacks.h ../include/internal/bn_int.h
-bn_exp.o: ../include/internal/cryptlib.h bn_exp.c bn_lcl.h
+bn_exp.o: ../include/internal/cryptlib.h bn_exp.c bn_lcl.h rsaz_exp.h
 bn_exp2.o: ../../e_os.h ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_exp2.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_exp2.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
diff --git a/crypto/bn/bn_exp.c b/crypto/bn/bn_exp.c
index 6ce6f8d..10dc3eb 100644
--- a/crypto/bn/bn_exp.c
+++ b/crypto/bn/bn_exp.c
@@ -126,13 +126,7 @@
 # include <alloca.h>
 #endif
 
-#undef RSAZ_ENABLED
-#if defined(OPENSSL_BN_ASM_MONT) && \
-        (defined(__x86_64) || defined(__x86_64__) || \
-         defined(_M_AMD64) || defined(_M_X64))
-# include "rsaz_exp.h"
-# define RSAZ_ENABLED
-#endif
+#include "rsaz_exp.h"
 
 #undef SPARC_T4_MONT
 #if defined(OPENSSL_BN_ASM_MONT) && (defined(__sparc__) || defined(__sparc))
diff --git a/crypto/bn/rsaz_exp.c b/crypto/bn/rsaz_exp.c
index a486b15..c54c6fe 100644
--- a/crypto/bn/rsaz_exp.c
+++ b/crypto/bn/rsaz_exp.c
@@ -42,6 +42,8 @@
 
 #include "rsaz_exp.h"
 
+#ifdef RSAZ_ENABLED
+
 /*
  * See crypto/bn/asm/rsaz-avx2.pl for further details.
  */
@@ -334,3 +336,11 @@ void RSAZ_512_mod_exp(BN_ULONG result[8],
 
     OPENSSL_cleanse(storage, sizeof(storage));
 }
+
+#else
+
+# if defined(PEDANTIC) || defined(__DECC) || defined(__clang__)
+static void *dummy = &dummy;
+# endif
+
+#endif
diff --git a/crypto/bn/rsaz_exp.h b/crypto/bn/rsaz_exp.h
index bb71fb1..33361de 100644
--- a/crypto/bn/rsaz_exp.h
+++ b/crypto/bn/rsaz_exp.h
@@ -31,7 +31,13 @@
 #ifndef RSAZ_EXP_H
 # define RSAZ_EXP_H
 
-# include <openssl/bn.h>
+# undef RSAZ_ENABLED
+# if defined(OPENSSL_BN_ASM_MONT) && \
+        (defined(__x86_64) || defined(__x86_64__) || \
+         defined(_M_AMD64) || defined(_M_X64))
+#  define RSAZ_ENABLED
+
+#  include <openssl/bn.h>
 
 void RSAZ_1024_mod_exp_avx2(BN_ULONG result[16],
                             const BN_ULONG base_norm[16],
@@ -44,4 +50,7 @@ void RSAZ_512_mod_exp(BN_ULONG result[8],
                       const BN_ULONG base_norm[8], const BN_ULONG exponent[8],
                       const BN_ULONG m_norm[8], BN_ULONG k0,
                       const BN_ULONG RR[8]);
+
+# endif
+
 #endif

From levitte at openssl.org  Tue Jun 23 01:07:13 2015
From: levitte at openssl.org (Richard Levitte)
Date: Tue, 23 Jun 2015 01:07:13 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435021633.848027.25413.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  c61bb1abafaaa90a475fb0be87bdde1a21b7677b (commit)
       via  f59186e4361e553d5f117c213ce25e9594f10244 (commit)
      from  0abf6104476db172dd82a66e1a4567876270e0ef (commit)


- Log -----------------------------------------------------------------
commit c61bb1abafaaa90a475fb0be87bdde1a21b7677b
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Jun 23 03:03:10 2015 +0200

    make update
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit f59186e4361e553d5f117c213ce25e9594f10244
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Jun 23 01:55:46 2015 +0200

    Rearrange rsaz
    
    A small rearrangement so the inclusion of rsaz_exp.h would be
    unconditional, but what that header defines becomes conditional.
    
    This solves the weirdness where rsaz_exp.h gets in and out of the
    dependency list for bn_exp.c, depending on the present architecture.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/Makefile   |  1 +
 crypto/bn/bn_exp.c   |  8 +-------
 crypto/bn/rsaz_exp.c | 10 ++++++++++
 crypto/bn/rsaz_exp.h | 11 ++++++++++-
 4 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/crypto/bn/Makefile b/crypto/bn/Makefile
index 61dce05..215855e 100644
--- a/crypto/bn/Makefile
+++ b/crypto/bn/Makefile
@@ -253,6 +253,7 @@ bn_exp.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
 bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 bn_exp.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bn_exp.o: ../../include/openssl/symhacks.h ../cryptlib.h bn_exp.c bn_lcl.h
+bn_exp.o: rsaz_exp.h
 bn_exp2.o: ../../e_os.h ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_exp2.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_exp2.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
diff --git a/crypto/bn/bn_exp.c b/crypto/bn/bn_exp.c
index 8c46e50..24afdd6 100644
--- a/crypto/bn/bn_exp.c
+++ b/crypto/bn/bn_exp.c
@@ -126,13 +126,7 @@
 # include <alloca.h>
 #endif
 
-#undef RSAZ_ENABLED
-#if defined(OPENSSL_BN_ASM_MONT) && \
-        (defined(__x86_64) || defined(__x86_64__) || \
-         defined(_M_AMD64) || defined(_M_X64))
-# include "rsaz_exp.h"
-# define RSAZ_ENABLED
-#endif
+#include "rsaz_exp.h"
 
 #undef SPARC_T4_MONT
 #if defined(OPENSSL_BN_ASM_MONT) && (defined(__sparc__) || defined(__sparc))
diff --git a/crypto/bn/rsaz_exp.c b/crypto/bn/rsaz_exp.c
index a486b15..c54c6fe 100644
--- a/crypto/bn/rsaz_exp.c
+++ b/crypto/bn/rsaz_exp.c
@@ -42,6 +42,8 @@
 
 #include "rsaz_exp.h"
 
+#ifdef RSAZ_ENABLED
+
 /*
  * See crypto/bn/asm/rsaz-avx2.pl for further details.
  */
@@ -334,3 +336,11 @@ void RSAZ_512_mod_exp(BN_ULONG result[8],
 
     OPENSSL_cleanse(storage, sizeof(storage));
 }
+
+#else
+
+# if defined(PEDANTIC) || defined(__DECC) || defined(__clang__)
+static void *dummy = &dummy;
+# endif
+
+#endif
diff --git a/crypto/bn/rsaz_exp.h b/crypto/bn/rsaz_exp.h
index bb71fb1..33361de 100644
--- a/crypto/bn/rsaz_exp.h
+++ b/crypto/bn/rsaz_exp.h
@@ -31,7 +31,13 @@
 #ifndef RSAZ_EXP_H
 # define RSAZ_EXP_H
 
-# include <openssl/bn.h>
+# undef RSAZ_ENABLED
+# if defined(OPENSSL_BN_ASM_MONT) && \
+        (defined(__x86_64) || defined(__x86_64__) || \
+         defined(_M_AMD64) || defined(_M_X64))
+#  define RSAZ_ENABLED
+
+#  include <openssl/bn.h>
 
 void RSAZ_1024_mod_exp_avx2(BN_ULONG result[16],
                             const BN_ULONG base_norm[16],
@@ -44,4 +50,7 @@ void RSAZ_512_mod_exp(BN_ULONG result[8],
                       const BN_ULONG base_norm[8], const BN_ULONG exponent[8],
                       const BN_ULONG m_norm[8], BN_ULONG k0,
                       const BN_ULONG RR[8]);
+
+# endif
+
 #endif

From rsalz at openssl.org  Tue Jun 23 11:59:35 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 11:59:35 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435060775.604366.24817.nullmailer@dev.openssl.org>

The branch master has been updated
       via  2d540402aac7a05af9c99b58864d53c0201a0b42 (commit)
      from  a1c506ae9ecb493bb1ae3226100b489e56c4d307 (commit)


- Log -----------------------------------------------------------------
commit 2d540402aac7a05af9c99b58864d53c0201a0b42
Author: Russell Webb <russell.webb at intel.com>
Date:   Sat Jun 13 10:35:55 2015 -0400

    RT3856: Fix memory leaks in test code
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 test/bntest.c   | 3 +--
 test/hmactest.c | 3 +++
 test/srptest.c  | 1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/test/bntest.c b/test/bntest.c
index 1ce6db1..cf4d2ab 100644
--- a/test/bntest.c
+++ b/test/bntest.c
@@ -1043,7 +1043,6 @@ int test_mod_exp_mont_consttime(BIO *bp, BN_CTX *ctx)
 int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
 {
     BIGNUM *a, *p, *m, *d, *e;
-
     BN_MONT_CTX *mont;
 
     a = BN_new();
@@ -1051,7 +1050,6 @@ int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
     m = BN_new();
     d = BN_new();
     e = BN_new();
-
     mont = BN_MONT_CTX_new();
 
     BN_bntest_rand(m, 1024, 0, 1); /* must be odd for montgomery */
@@ -1100,6 +1098,7 @@ int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
         fprintf(stderr, "Modular exponentiation test failed!\n");
         return 0;
     }
+    BN_MONT_CTX_free(mont);
     BN_free(a);
     BN_free(p);
     BN_free(m);
diff --git a/test/hmactest.c b/test/hmactest.c
index a9b829d..f8d5350 100644
--- a/test/hmactest.c
+++ b/test/hmactest.c
@@ -188,6 +188,7 @@ int main(int argc, char *argv[])
     }
     printf("test 4 ok\n");
 test5:
+    HMAC_CTX_cleanup(&ctx);
     HMAC_CTX_init(&ctx);
     if (HMAC_Init_ex(&ctx, test[4].key, test[4].key_len, NULL, NULL)) {
         printf("Should fail to initialise HMAC with empty MD (test 5)\n");
@@ -277,6 +278,7 @@ test5:
         printf("test 5 ok\n");
     }
 test6:
+    HMAC_CTX_cleanup(&ctx);
     HMAC_CTX_init(&ctx);
     if (!HMAC_Init_ex(&ctx, test[7].key, test[7].key_len, EVP_sha1(), NULL)) {
         printf("Failed to initialise HMAC (test 6)\n");
@@ -307,6 +309,7 @@ test6:
         printf("test 6 ok\n");
     }
 end:
+    HMAC_CTX_cleanup(&ctx);
     EXIT(err);
 }
 
diff --git a/test/srptest.c b/test/srptest.c
index 1d463cd..8075218 100644
--- a/test/srptest.c
+++ b/test/srptest.c
@@ -148,6 +148,7 @@ int main(int argc, char **argv)
     ERR_remove_thread_state(NULL);
     ERR_free_strings();
     CRYPTO_mem_leaks(bio_err);
+    BIO_free(bio_err);
 
     return 0;
 }

From rsalz at openssl.org  Tue Jun 23 12:04:26 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 12:04:26 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435061066.560999.26259.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  295c629ab1676647c53166db96657e1fccad1508 (commit)
      from  c61bb1abafaaa90a475fb0be87bdde1a21b7677b (commit)


- Log -----------------------------------------------------------------
commit 295c629ab1676647c53166db96657e1fccad1508
Author: Russell Webb <russell.webb at intel.com>
Date:   Sat Jun 13 10:35:55 2015 -0400

    RT3856: Fix memory leaks in test code
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 2d540402aac7a05af9c99b58864d53c0201a0b42)

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/bntest.c     | 3 +--
 crypto/hmac/hmactest.c | 3 +++
 crypto/srp/srptest.c   | 1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/crypto/bn/bntest.c b/crypto/bn/bntest.c
index 06662c5..470d5da 100644
--- a/crypto/bn/bntest.c
+++ b/crypto/bn/bntest.c
@@ -1042,7 +1042,6 @@ int test_mod_exp_mont_consttime(BIO *bp, BN_CTX *ctx)
 int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
 {
     BIGNUM *a, *p, *m, *d, *e;
-
     BN_MONT_CTX *mont;
 
     a = BN_new();
@@ -1050,7 +1049,6 @@ int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
     m = BN_new();
     d = BN_new();
     e = BN_new();
-
     mont = BN_MONT_CTX_new();
 
     BN_bntest_rand(m, 1024, 0, 1); /* must be odd for montgomery */
@@ -1099,6 +1097,7 @@ int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
         fprintf(stderr, "Modular exponentiation test failed!\n");
         return 0;
     }
+    BN_MONT_CTX_free(mont);
     BN_free(a);
     BN_free(p);
     BN_free(m);
diff --git a/crypto/hmac/hmactest.c b/crypto/hmac/hmactest.c
index 271d0eb..5a57395 100644
--- a/crypto/hmac/hmactest.c
+++ b/crypto/hmac/hmactest.c
@@ -195,6 +195,7 @@ int main(int argc, char *argv[])
     }
     printf("test 4 ok\n");
 test5:
+    HMAC_CTX_cleanup(&ctx);
     HMAC_CTX_init(&ctx);
     if (HMAC_Init_ex(&ctx, test[4].key, test[4].key_len, NULL, NULL)) {
         printf("Should fail to initialise HMAC with empty MD (test 5)\n");
@@ -284,6 +285,7 @@ test5:
         printf("test 5 ok\n");
     }
 test6:
+    HMAC_CTX_cleanup(&ctx);
     HMAC_CTX_init(&ctx);
     if (!HMAC_Init_ex(&ctx, test[7].key, test[7].key_len, EVP_sha1(), NULL)) {
         printf("Failed to initialise HMAC (test 6)\n");
@@ -314,6 +316,7 @@ test6:
         printf("test 6 ok\n");
     }
 end:
+    HMAC_CTX_cleanup(&ctx);
     EXIT(err);
     return (0);
 }
diff --git a/crypto/srp/srptest.c b/crypto/srp/srptest.c
index 451c70e..00e001b 100644
--- a/crypto/srp/srptest.c
+++ b/crypto/srp/srptest.c
@@ -148,6 +148,7 @@ int main(int argc, char **argv)
     ERR_remove_thread_state(NULL);
     ERR_free_strings();
     CRYPTO_mem_leaks(bio_err);
+    BIO_free(bio_err);
 
     return 0;
 }

From rsalz at openssl.org  Tue Jun 23 12:12:23 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 12:12:23 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435061543.569444.28496.nullmailer@dev.openssl.org>

The branch master has been updated
       via  4b8d8e2ad30e773e2229775ab0b8c35deb5e7c1c (commit)
      from  2d540402aac7a05af9c99b58864d53c0201a0b42 (commit)


- Log -----------------------------------------------------------------
commit 4b8d8e2ad30e773e2229775ab0b8c35deb5e7c1c
Author: Rich Salz <rsalz at akamai.com>
Date:   Sat Jun 13 09:29:10 2015 -0400

    RT3682: Avoid double-free on OCSP parse error
    
    Found by Kurt Cancemi.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/ocsp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/ocsp.c b/apps/ocsp.c
index 5d3e646..b6397b8 100644
--- a/apps/ocsp.c
+++ b/apps/ocsp.c
@@ -275,6 +275,7 @@ int ocsp_main(int argc, char **argv)
             OPENSSL_free(thost);
             OPENSSL_free(tport);
             OPENSSL_free(tpath);
+            thost = tport = tpath = NULL;
             if (!OCSP_parse_url(opt_arg(), &host, &port, &path, &use_ssl)) {
                 BIO_printf(bio_err, "%s Error parsing URL\n", prog);
                 goto end;

From rsalz at openssl.org  Tue Jun 23 12:15:21 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 12:15:21 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435061721.762243.30768.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  4ce5ed5f3970a1973c4cba41901294632a3c617d (commit)
      from  295c629ab1676647c53166db96657e1fccad1508 (commit)


- Log -----------------------------------------------------------------
commit 4ce5ed5f3970a1973c4cba41901294632a3c617d
Author: Rich Salz <rsalz at openssl.org>
Date:   Tue Jun 23 08:14:24 2015 -0400

    RT3682: Avoid double-free on OCSP parse error
    
    Found by Kurt Cancemi
    
    (Manual cherry-pick of f8e427154bbc0c33f29fa7aad001b1b655e5995b)
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/ocsp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/ocsp.c b/apps/ocsp.c
index b858b8d..926083d 100644
--- a/apps/ocsp.c
+++ b/apps/ocsp.c
@@ -209,6 +209,7 @@ int MAIN(int argc, char **argv)
                 OPENSSL_free(tport);
             if (tpath)
                 OPENSSL_free(tpath);
+            thost = tport = tpath = NULL;
             if (args[1]) {
                 args++;
                 if (!OCSP_parse_url(*args, &host, &port, &path, &use_ssl)) {

From rsalz at openssl.org  Tue Jun 23 12:18:08 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 12:18:08 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435061888.940756.32381.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  c00206c3269d75013ea3e41dec76d6b179502036 (commit)
      from  4ce5ed5f3970a1973c4cba41901294632a3c617d (commit)


- Log -----------------------------------------------------------------
commit c00206c3269d75013ea3e41dec76d6b179502036
Author: Vitezslav Cizek <ciz at github.com>
Date:   Tue Jun 16 15:57:59 2015 -0400

    GH297: Fix NAME section of SSL_CTX_use_serverinfo.pod
    
    Signed-off-by: Rich Salz <rsalz at akamai.com>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 doc/ssl/SSL_CTX_use_serverinfo.pod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/ssl/SSL_CTX_use_serverinfo.pod b/doc/ssl/SSL_CTX_use_serverinfo.pod
index da7935c..318e052 100644
--- a/doc/ssl/SSL_CTX_use_serverinfo.pod
+++ b/doc/ssl/SSL_CTX_use_serverinfo.pod
@@ -2,7 +2,7 @@
 
 =head1 NAME
 
-SSL_CTX_use_serverinfo, SSL_CTX_use_serverinfo_file
+SSL_CTX_use_serverinfo, SSL_CTX_use_serverinfo_file - use serverinfo extension
 
 =head1 SYNOPSIS
 

From rsalz at openssl.org  Tue Jun 23 12:19:12 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 12:19:12 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435061952.646135.472.nullmailer@dev.openssl.org>

The branch master has been updated
       via  4ba81134dc2ee1a169e39d6bc2a942ca1004aa8e (commit)
      from  4b8d8e2ad30e773e2229775ab0b8c35deb5e7c1c (commit)


- Log -----------------------------------------------------------------
commit 4ba81134dc2ee1a169e39d6bc2a942ca1004aa8e
Author: Vitezslav Cizek <ciz at github.com>
Date:   Tue Jun 16 15:57:59 2015 -0400

    GH297: Fix NAME section of SSL_CTX_use_serverinfo.pod
    
    Signed-off-by: Rich Salz <rsalz at akamai.com>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 doc/ssl/SSL_CTX_use_serverinfo.pod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/ssl/SSL_CTX_use_serverinfo.pod b/doc/ssl/SSL_CTX_use_serverinfo.pod
index da7935c..318e052 100644
--- a/doc/ssl/SSL_CTX_use_serverinfo.pod
+++ b/doc/ssl/SSL_CTX_use_serverinfo.pod
@@ -2,7 +2,7 @@
 
 =head1 NAME
 
-SSL_CTX_use_serverinfo, SSL_CTX_use_serverinfo_file
+SSL_CTX_use_serverinfo, SSL_CTX_use_serverinfo_file - use serverinfo extension
 
 =head1 SYNOPSIS
 

From rsalz at openssl.org  Tue Jun 23 12:40:00 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 12:40:00 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435063200.069200.19069.nullmailer@dev.openssl.org>

The branch master has been updated
       via  ce7e647bc2c328404b1e3cdac6211773afdefe07 (commit)
      from  4ba81134dc2ee1a169e39d6bc2a942ca1004aa8e (commit)


- Log -----------------------------------------------------------------
commit ce7e647bc2c328404b1e3cdac6211773afdefe07
Author: Rich Salz <rsalz at akamai.com>
Date:   Tue Jun 23 07:27:23 2015 -0400

    Add $! to errors, use script basename.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/objects/objxref.pl | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/crypto/objects/objxref.pl b/crypto/objects/objxref.pl
index 1913b9d..a1900ca 100644
--- a/crypto/objects/objxref.pl
+++ b/crypto/objects/objxref.pl
@@ -7,7 +7,7 @@ my %oid_tbl;
 
 my ($mac_file, $xref_file) = @ARGV;
 
-open(IN, $mac_file) || die "Can't open $mac_file";
+open(IN, $mac_file) || die "Can't open $mac_file, $!\n";
 
 # Read in OID nid values for a lookup table.
 
@@ -19,7 +19,7 @@ while (<IN>)
 	}
 close IN;
 
-open(IN, $xref_file) || die "Can't open $xref_file";
+open(IN, $xref_file) || die "Can't open $xref_file, $!\n";
 
 my $ln = 1;
 
@@ -57,8 +57,7 @@ my @srt2 = sort
 	} @xrkeys;
 
 my $pname = $0;
-
-$pname =~ s|^.[^/]/||;
+$pname =~ s|.*/||;
 
 print <<EOF;
 /* AUTOGENERATED BY $pname, DO NOT EDIT */
@@ -111,6 +110,6 @@ sub check_oid
 	my ($chk) = @_;
 	if (!exists $oid_tbl{$chk})
 		{
-		die "Not Found \"$chk\"\n";
+		die "Can't find \"$chk\", $!\n";
 		}
 	}

From rsalz at openssl.org  Tue Jun 23 21:10:08 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 21:10:08 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435093808.056055.14152.nullmailer@dev.openssl.org>

The branch master has been updated
       via  74924dcb3802640d7e2ae2e80ca6515d0a53de7a (commit)
      from  ce7e647bc2c328404b1e3cdac6211773afdefe07 (commit)


- Log -----------------------------------------------------------------
commit 74924dcb3802640d7e2ae2e80ca6515d0a53de7a
Author: Rich Salz <rsalz at akamai.com>
Date:   Fri Apr 24 16:39:40 2015 -0400

    More secure storage of key material.
    
    Add secure heap for storage of private keys (when possible).
    Add BIO_s_secmem(), CBIGNUM, etc.
    Add BIO_CTX_secure_new so all BIGNUM's in the context are secure.
    Contributed by Akamai Technologies under the Corporate CLA.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES                             |   5 +
 crypto/Makefile                     |   8 +-
 crypto/asn1/x_bignum.c              |  32 ++-
 crypto/bio/bss_mem.c                |  36 ++-
 crypto/bn/bn_ctx.c                  |  79 +++---
 crypto/bn/bn_lib.c                  |  37 ++-
 crypto/buffer/buffer.c              |  42 ++-
 crypto/dh/dh_ameth.c                |   3 +-
 crypto/dh/dh_key.c                  |   2 +-
 crypto/dsa/dsa_ameth.c              |   3 +-
 crypto/dsa/dsa_asn1.c               |   2 +-
 crypto/dsa/dsa_key.c                |   2 +-
 crypto/ec/ec_asn1.c                 |   2 +
 crypto/mem.c                        |  73 ++++-
 crypto/rsa/rsa_asn1.c               |  12 +-
 crypto/rsa/rsa_gen.c                |  12 +-
 crypto/sec_mem.c                    | 513 ++++++++++++++++++++++++++++++++++++
 doc/crypto/BIO_s_mem.pod            |   7 +
 doc/crypto/BN_CTX_new.pod           |  15 +-
 doc/crypto/CRYPTO_secure_malloc.pod |  91 +++++++
 doc/crypto/bio.pod                  |   1 +
 doc/crypto/bn.pod                   |   1 +
 doc/crypto/buffer.pod               |  14 +-
 include/openssl/bio.h               |   1 +
 include/openssl/bn.h                |   3 +
 include/openssl/buffer.h            |   4 +
 include/openssl/crypto.h            |  23 +-
 test/Makefile                       |  14 +-
 test/secmemtest.c                   |  34 +++
 util/libeay.num                     |  14 +
 30 files changed, 1009 insertions(+), 76 deletions(-)
 create mode 100644 crypto/sec_mem.c
 create mode 100644 doc/crypto/CRYPTO_secure_malloc.pod
 create mode 100644 test/secmemtest.c

diff --git a/CHANGES b/CHANGES
index fae1123..88b3d67 100644
--- a/CHANGES
+++ b/CHANGES
@@ -126,6 +126,11 @@
         NULL.  Remove the non-null checks from callers.  Save much code.
      [Rich Salz]
 
+  *) Add secure heap for storage of private keys (when possible).
+     Add BIO_s_secmem(), CBIGNUM, etc.
+     Contributed by Akamai Technologies under our Corporate CLA.
+     [Rich Salz]
+
   *) Experimental support for a new, fast, unbiased prime candidate generator,
      bn_probable_prime_dh_coprime(). Not currently used by any prime generator.
      [Felix Laurie von Massenbach <felix at erbridge.co.uk>]
diff --git a/crypto/Makefile b/crypto/Makefile
index 99cd65c..b2cf528 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -36,10 +36,10 @@ LIB= $(TOP)/libcrypto.a
 SHARED_LIB= libcrypto$(SHLIB_EXT)
 LIBSRC=	cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c \
 	ebcdic.c uid.c o_time.c o_str.c o_dir.c thr_id.c lock.c fips_ers.c \
-	o_init.c o_fips.c
+	o_init.c o_fips.c sec_mem.c
 LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o \
 	ebcdic.o uid.o o_time.o o_str.o o_dir.o thr_id.o lock.o fips_ers.o \
-	o_init.o o_fips.o $(CPUID_OBJ)
+	o_init.o o_fips.o sec_mem.o $(CPUID_OBJ)
 
 SRC= $(LIBSRC)
 
@@ -208,6 +208,10 @@ o_time.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
 o_time.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 o_time.o: ../include/openssl/ossl_typ.h ../include/openssl/safestack.h
 o_time.o: ../include/openssl/stack.h ../include/openssl/symhacks.h o_time.c
+sec_mem.o: ../e_os.h ../include/openssl/crypto.h ../include/openssl/e_os2.h
+sec_mem.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+sec_mem.o: ../include/openssl/ossl_typ.h ../include/openssl/safestack.h
+sec_mem.o: ../include/openssl/stack.h ../include/openssl/symhacks.h sec_mem.c
 thr_id.o: ../e_os.h ../include/openssl/bio.h ../include/openssl/buffer.h
 thr_id.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
 thr_id.o: ../include/openssl/err.h ../include/openssl/lhash.h
diff --git a/crypto/asn1/x_bignum.c b/crypto/asn1/x_bignum.c
index 8307a2d..66ce000 100644
--- a/crypto/asn1/x_bignum.c
+++ b/crypto/asn1/x_bignum.c
@@ -72,12 +72,15 @@
 #define BN_SENSITIVE    1
 
 static int bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
+static int bn_secure_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
 static void bn_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 static int bn_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype,
                   const ASN1_ITEM *it);
 static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
                   int utype, char *free_cont, const ASN1_ITEM *it);
+static int bn_secure_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
+                         int utype, char *free_cont, const ASN1_ITEM *it);
 
 static ASN1_PRIMITIVE_FUNCS bignum_pf = {
     NULL, 0,
@@ -88,12 +91,21 @@ static ASN1_PRIMITIVE_FUNCS bignum_pf = {
     bn_i2c
 };
 
+static ASN1_PRIMITIVE_FUNCS cbignum_pf = {
+    NULL, 0,
+    bn_secure_new,
+    bn_free,
+    0,
+    bn_secure_c2i,
+    bn_i2c
+};
+
 ASN1_ITEM_start(BIGNUM)
         ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &bignum_pf, 0, "BIGNUM"
 ASN1_ITEM_end(BIGNUM)
 
 ASN1_ITEM_start(CBIGNUM)
-        ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &bignum_pf, BN_SENSITIVE, "BIGNUM"
+        ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &cbignum_pf, BN_SENSITIVE, "CBIGNUM"
 ASN1_ITEM_end(CBIGNUM)
 
 static int bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
@@ -105,6 +117,15 @@ static int bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
         return 0;
 }
 
+static int bn_secure_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
+{
+    *pval = (ASN1_VALUE *)BN_secure_new();
+    if (*pval)
+        return 1;
+    else
+        return 0;
+}
+
 static void bn_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
 {
     if (!*pval)
@@ -141,6 +162,7 @@ static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
                   int utype, char *free_cont, const ASN1_ITEM *it)
 {
     BIGNUM *bn;
+
     if (!*pval)
         bn_new(pval, it);
     bn = (BIGNUM *)*pval;
@@ -150,3 +172,11 @@ static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
     }
     return 1;
 }
+
+static int bn_secure_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
+                         int utype, char *free_cont, const ASN1_ITEM *it)
+{
+    if (!*pval)
+        bn_secure_new(pval, it);
+    return bn_c2i(pval, cont, len, utype, free_cont, it);
+}
diff --git a/crypto/bio/bss_mem.c b/crypto/bio/bss_mem.c
index a1f5e8d..485a8bf 100644
--- a/crypto/bio/bss_mem.c
+++ b/crypto/bio/bss_mem.c
@@ -67,6 +67,7 @@ static int mem_puts(BIO *h, const char *str);
 static int mem_gets(BIO *h, char *str, int size);
 static long mem_ctrl(BIO *h, int cmd, long arg1, void *arg2);
 static int mem_new(BIO *h);
+static int secmem_new(BIO *h);
 static int mem_free(BIO *data);
 static BIO_METHOD mem_method = {
     BIO_TYPE_MEM,
@@ -80,6 +81,18 @@ static BIO_METHOD mem_method = {
     mem_free,
     NULL,
 };
+static BIO_METHOD secmem_method = {
+    BIO_TYPE_MEM,
+    "secure memory buffer",
+    mem_write,
+    mem_read,
+    mem_puts,
+    mem_gets,
+    mem_ctrl,
+    secmem_new,
+    mem_free,
+    NULL,
+};
 
 /*
  * bio->num is used to hold the value to return on 'empty', if it is 0,
@@ -91,6 +104,11 @@ BIO_METHOD *BIO_s_mem(void)
     return (&mem_method);
 }
 
+BIO_METHOD *BIO_s_secmem(void)
+{
+    return(&secmem_method);
+}
+
 BIO *BIO_new_mem_buf(void *buf, int len)
 {
     BIO *ret;
@@ -114,17 +132,27 @@ BIO *BIO_new_mem_buf(void *buf, int len)
     return ret;
 }
 
-static int mem_new(BIO *bi)
+static int mem_init(BIO *bi, unsigned long flags)
 {
     BUF_MEM *b;
 
-    if ((b = BUF_MEM_new()) == NULL)
-        return (0);
+    if ((b = BUF_MEM_new_ex(flags)) == NULL)
+        return(0);
     bi->shutdown = 1;
     bi->init = 1;
     bi->num = -1;
     bi->ptr = (char *)b;
-    return (1);
+    return(1);
+}
+
+static int mem_new(BIO *bi)
+{
+    return (mem_init(bi, 0L));
+}
+
+static int secmem_new(BIO *bi)
+{
+    return (mem_init(bi, BUF_MEM_FLAG_SECURE));
 }
 
 static int mem_free(BIO *a)
diff --git a/crypto/bn/bn_ctx.c b/crypto/bn/bn_ctx.c
index c023303..660e626 100644
--- a/crypto/bn/bn_ctx.c
+++ b/crypto/bn/bn_ctx.c
@@ -103,7 +103,7 @@ typedef struct bignum_pool {
 } BN_POOL;
 static void BN_POOL_init(BN_POOL *);
 static void BN_POOL_finish(BN_POOL *);
-static BIGNUM *BN_POOL_get(BN_POOL *);
+static BIGNUM *BN_POOL_get(BN_POOL *, int);
 static void BN_POOL_release(BN_POOL *, unsigned int);
 
 /************/
@@ -138,6 +138,8 @@ struct bignum_ctx {
     int err_stack;
     /* Block "gets" until an "end" (compatibility behaviour) */
     int too_many;
+    /* Flags. */
+    int flags;
 };
 
 /* Enable this to find BN_CTX bugs */
@@ -186,8 +188,9 @@ static void ctxdbg(BN_CTX *ctx)
 
 BN_CTX *BN_CTX_new(void)
 {
-    BN_CTX *ret = OPENSSL_malloc(sizeof(*ret));
-    if (!ret) {
+    BN_CTX *ret;
+
+    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL) {
         BNerr(BN_F_BN_CTX_NEW, ERR_R_MALLOC_FAILURE);
         return NULL;
     }
@@ -197,6 +200,16 @@ BN_CTX *BN_CTX_new(void)
     ret->used = 0;
     ret->err_stack = 0;
     ret->too_many = 0;
+    ret->flags = 0;
+    return ret;
+}
+
+BN_CTX *BN_CTX_secure_new(void)
+{
+    BN_CTX *ret = BN_CTX_new();
+
+    if (ret)
+        ret->flags = BN_FLG_SECURE;
     return ret;
 }
 
@@ -258,10 +271,11 @@ void BN_CTX_end(BN_CTX *ctx)
 BIGNUM *BN_CTX_get(BN_CTX *ctx)
 {
     BIGNUM *ret;
+
     CTXDBG_ENTRY("BN_CTX_get", ctx);
     if (ctx->err_stack || ctx->too_many)
         return NULL;
-    if ((ret = BN_POOL_get(&ctx->pool)) == NULL) {
+    if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {
         /*
          * Setting too_many prevents repeated "get" attempts from cluttering
          * the error stack.
@@ -289,26 +303,23 @@ static void BN_STACK_init(BN_STACK *st)
 
 static void BN_STACK_finish(BN_STACK *st)
 {
-    if (st->size)
-        OPENSSL_free(st->indexes);
+    OPENSSL_free(st->indexes);
+    st->indexes = NULL;
 }
 
 
 static int BN_STACK_push(BN_STACK *st, unsigned int idx)
 {
-    if (st->depth == st->size)
+    if (st->depth == st->size) {
         /* Need to expand */
-    {
-        unsigned int newsize = (st->size ?
-                                (st->size * 3 / 2) : BN_CTX_START_FRAMES);
-        unsigned int *newitems = OPENSSL_malloc(newsize *
-                                                sizeof(unsigned int));
-        if (!newitems)
+        unsigned int newsize =
+            st->size ? (st->size * 3 / 2) : BN_CTX_START_FRAMES;
+        unsigned int *newitems = OPENSSL_malloc(sizeof(*newitems) * newsize);
+        if (newitems == NULL)
             return 0;
         if (st->depth)
-            memcpy(newitems, st->indexes, st->depth * sizeof(unsigned int));
-        if (st->size)
-            OPENSSL_free(st->indexes);
+            memcpy(newitems, st->indexes, sizeof(*newitems) * st->depth);
+        OPENSSL_free(st->indexes);
         st->indexes = newitems;
         st->size = newsize;
     }
@@ -333,14 +344,13 @@ static void BN_POOL_init(BN_POOL *p)
 
 static void BN_POOL_finish(BN_POOL *p)
 {
+    unsigned int loop;
+    BIGNUM *bn;
+
     while (p->head) {
-        unsigned int loop = 0;
-        BIGNUM *bn = p->head->vals;
-        while (loop++ < BN_CTX_POOL_SIZE) {
+        for (loop = 0, bn = p->head->vals; loop++ < BN_CTX_POOL_SIZE; bn++)
             if (bn->d)
                 BN_clear_free(bn);
-            bn++;
-        }
         p->current = p->head->next;
         OPENSSL_free(p->head);
         p->head = p->current;
@@ -348,22 +358,25 @@ static void BN_POOL_finish(BN_POOL *p)
 }
 
 
-static BIGNUM *BN_POOL_get(BN_POOL *p)
+static BIGNUM *BN_POOL_get(BN_POOL *p, int flag)
 {
+    BIGNUM *bn;
+    unsigned int loop;
+
+    /* Full; allocate a new pool item and link it in. */
     if (p->used == p->size) {
-        BIGNUM *bn;
-        unsigned int loop = 0;
         BN_POOL_ITEM *item = OPENSSL_malloc(sizeof(*item));
-        if (!item)
+        if (item == NULL)
             return NULL;
-        /* Initialise the structure */
-        bn = item->vals;
-        while (loop++ < BN_CTX_POOL_SIZE)
-            BN_init(bn++);
+        for (loop = 0, bn = item->vals; loop++ < BN_CTX_POOL_SIZE; bn++) {
+            BN_init(bn);
+            if ((flag & BN_FLG_SECURE) != 0)
+                BN_set_flags(bn, BN_FLG_SECURE);
+        }
         item->prev = p->tail;
         item->next = NULL;
-        /* Link it in */
-        if (!p->head)
+
+        if (p->head == NULL)
             p->head = p->current = p->tail = item;
         else {
             p->tail->next = item;
@@ -375,6 +388,7 @@ static BIGNUM *BN_POOL_get(BN_POOL *p)
         /* Return the first bignum from the new pool */
         return item->vals;
     }
+
     if (!p->used)
         p->current = p->head;
     else if ((p->used % BN_CTX_POOL_SIZE) == 0)
@@ -385,10 +399,11 @@ static BIGNUM *BN_POOL_get(BN_POOL *p)
 static void BN_POOL_release(BN_POOL *p, unsigned int num)
 {
     unsigned int offset = (p->used - 1) % BN_CTX_POOL_SIZE;
+
     p->used -= num;
     while (num--) {
         bn_check_top(p->current->vals + offset);
-        if (!offset) {
+        if (offset == 0) {
             offset = BN_CTX_POOL_SIZE - 1;
             p->current = p->current->prev;
         } else
diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c
index 4dabe26..b5f827a 100644
--- a/crypto/bn/bn_lib.c
+++ b/crypto/bn/bn_lib.c
@@ -232,8 +232,12 @@ void BN_clear_free(BIGNUM *a)
     bn_check_top(a);
     if (a->d != NULL) {
         OPENSSL_cleanse(a->d, a->dmax * sizeof(a->d[0]));
-        if (!(BN_get_flags(a, BN_FLG_STATIC_DATA)))
-            OPENSSL_free(a->d);
+        if (!(BN_get_flags(a, BN_FLG_STATIC_DATA))) {
+            if (BN_get_flags(a,BN_FLG_SECURE))
+                OPENSSL_secure_free(a->d);
+            else
+                OPENSSL_free(a->d);
+        }
     }
     i = BN_get_flags(a, BN_FLG_MALLOCED);
     OPENSSL_cleanse(a, sizeof(BIGNUM));
@@ -247,7 +251,12 @@ void BN_free(BIGNUM *a)
         return;
     bn_check_top(a);
     if (!BN_get_flags(a, BN_FLG_STATIC_DATA))
-        OPENSSL_free(a->d);
+    if ((a->d != NULL) && !(BN_get_flags(a, BN_FLG_STATIC_DATA))) {
+        if (BN_get_flags(a, BN_FLG_SECURE))
+            OPENSSL_secure_free(a->d);
+        else
+            OPENSSL_free(a->d);
+    }
     if (a->flags & BN_FLG_MALLOCED)
         OPENSSL_free(a);
     else {
@@ -281,6 +290,14 @@ BIGNUM *BN_new(void)
     return (ret);
 }
 
+ BIGNUM *BN_secure_new(void)
+ {
+     BIGNUM *ret = BN_new();
+     if (ret)
+         ret->flags |= BN_FLG_SECURE;
+     return (ret);
+ }
+
 /* This is used both by bn_expand2() and bn_dup_expand() */
 /* The caller MUST check that words > b->dmax before calling this */
 static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
@@ -299,7 +316,10 @@ static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
         BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);
         return (NULL);
     }
-    a = A = OPENSSL_malloc(sizeof(*a) * words);
+    if (BN_get_flags(b,BN_FLG_SECURE))
+        a = A = OPENSSL_secure_malloc(words * sizeof(*a));
+    else
+        a = A = OPENSSL_malloc(words * sizeof(*a));
     if (A == NULL) {
         BNerr(BN_F_BN_EXPAND_INTERNAL, ERR_R_MALLOC_FAILURE);
         return (NULL);
@@ -378,7 +398,12 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)
         BN_ULONG *a = bn_expand_internal(b, words);
         if (!a)
             return NULL;
-        OPENSSL_free(b->d);
+        if (b->d) {
+            if (BN_get_flags(b,BN_FLG_SECURE))
+                OPENSSL_secure_free(b->d);
+            else
+                OPENSSL_free(b->d);
+        }
         b->d = a;
         b->dmax = words;
     }
@@ -395,7 +420,7 @@ BIGNUM *BN_dup(const BIGNUM *a)
         return NULL;
     bn_check_top(a);
 
-    t = BN_new();
+    t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();
     if (t == NULL)
         return NULL;
     if (!BN_copy(t, a)) {
diff --git a/crypto/buffer/buffer.c b/crypto/buffer/buffer.c
index 2beacce..5ee11f4 100644
--- a/crypto/buffer/buffer.c
+++ b/crypto/buffer/buffer.c
@@ -67,6 +67,16 @@
  */
 #define LIMIT_BEFORE_EXPANSION 0x5ffffffc
 
+BUF_MEM *BUF_MEM_new_ex(unsigned long flags)
+{
+    BUF_MEM *ret;
+
+    ret = BUF_MEM_new();
+    if (ret != NULL)
+        ret->flags = flags;
+    return (ret);
+}
+
 BUF_MEM *BUF_MEM_new(void)
 {
     BUF_MEM *ret;
@@ -76,6 +86,7 @@ BUF_MEM *BUF_MEM_new(void)
         BUFerr(BUF_F_BUF_MEM_NEW, ERR_R_MALLOC_FAILURE);
         return (NULL);
     }
+    ret->flags = 0;
     ret->length = 0;
     ret->max = 0;
     ret->data = NULL;
@@ -88,11 +99,30 @@ void BUF_MEM_free(BUF_MEM *a)
         return;
 
     if (a->data != NULL) {
-        OPENSSL_clear_free(a->data, a->max);
+        memset(a->data, 0, (unsigned int)a->max);
+        if (a->flags & BUF_MEM_FLAG_SECURE)
+            OPENSSL_secure_free(a->data);
+        else
+            OPENSSL_clear_free(a->data, a->max);
     }
     OPENSSL_free(a);
 }
 
+/* Allocate a block of secure memory; copy over old data if there
+ * was any, and then free it. */
+static char *sec_alloc_realloc(BUF_MEM *str, size_t len)
+{
+    char *ret;
+
+    ret = OPENSSL_secure_malloc(len);
+    if (str->data != NULL) {
+        if (ret != NULL)
+            memcpy(ret, str->data, str->length);
+        OPENSSL_secure_free(str->data);
+    }
+    return (ret);
+}
+
 size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
 {
     char *ret;
@@ -113,7 +143,10 @@ size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
         return 0;
     }
     n = (len + 3) / 3 * 4;
-    ret = OPENSSL_realloc(str->data, n);
+    if ((str->flags & BUF_MEM_FLAG_SECURE))
+        ret = sec_alloc_realloc(str, n);
+    else
+        ret = OPENSSL_realloc(str->data, n);
     if (ret == NULL) {
         BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);
         len = 0;
@@ -147,7 +180,10 @@ size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
         return 0;
     }
     n = (len + 3) / 3 * 4;
-    ret = OPENSSL_realloc_clean(str->data, str->max, n);
+    if ((str->flags & BUF_MEM_FLAG_SECURE))
+        ret = sec_alloc_realloc(str, n);
+    else
+        ret = OPENSSL_realloc_clean(str->data, str->max, n);
     if (ret == NULL) {
         BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);
         len = 0;
diff --git a/crypto/dh/dh_ameth.c b/crypto/dh/dh_ameth.c
index 98f8570..efb3d80 100644
--- a/crypto/dh/dh_ameth.c
+++ b/crypto/dh/dh_ameth.c
@@ -228,7 +228,8 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
         goto decerr;
 
     /* We have parameters now set private key */
-    if ((dh->priv_key = ASN1_INTEGER_to_BN(privkey, NULL)) == NULL) {
+    if ((dh->priv_key = BN_secure_new()) == NULL
+        || !ASN1_INTEGER_to_BN(privkey, dh->priv_key)) {
         DHerr(DH_F_DH_PRIV_DECODE, DH_R_BN_ERROR);
         goto dherr;
     }
diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
index ff91d41..b6c3038 100644
--- a/crypto/dh/dh_key.c
+++ b/crypto/dh/dh_key.c
@@ -125,7 +125,7 @@ static int generate_key(DH *dh)
         goto err;
 
     if (dh->priv_key == NULL) {
-        priv_key = BN_new();
+        priv_key = BN_secure_new();
         if (priv_key == NULL)
             goto err;
         generate_new_key = 1;
diff --git a/crypto/dsa/dsa_ameth.c b/crypto/dsa/dsa_ameth.c
index 01b3497..73dd158 100644
--- a/crypto/dsa/dsa_ameth.c
+++ b/crypto/dsa/dsa_ameth.c
@@ -245,7 +245,8 @@ static int dsa_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
     if ((dsa = d2i_DSAparams(NULL, &pm, pmlen)) == NULL)
         goto decerr;
     /* We have parameters now set private key */
-    if ((dsa->priv_key = ASN1_INTEGER_to_BN(privkey, NULL)) == NULL) {
+    if ((dsa->priv_key = BN_secure_new()) == NULL
+        || !ASN1_INTEGER_to_BN(privkey, dsa->priv_key)) {
         DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);
         goto dsaerr;
     }
diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c
index bb2434e..85db147 100644
--- a/crypto/dsa/dsa_asn1.c
+++ b/crypto/dsa/dsa_asn1.c
@@ -113,7 +113,7 @@ ASN1_SEQUENCE_cb(DSAPrivateKey, dsa_cb) = {
         ASN1_SIMPLE(DSA, q, BIGNUM),
         ASN1_SIMPLE(DSA, g, BIGNUM),
         ASN1_SIMPLE(DSA, pub_key, BIGNUM),
-        ASN1_SIMPLE(DSA, priv_key, BIGNUM)
+        ASN1_SIMPLE(DSA, priv_key, CBIGNUM)
 } ASN1_SEQUENCE_END_cb(DSA, DSAPrivateKey)
 
 IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(DSA, DSAPrivateKey, DSAPrivateKey)
diff --git a/crypto/dsa/dsa_key.c b/crypto/dsa/dsa_key.c
index 01a83e0..19d21ea 100644
--- a/crypto/dsa/dsa_key.c
+++ b/crypto/dsa/dsa_key.c
@@ -82,7 +82,7 @@ static int dsa_builtin_keygen(DSA *dsa)
         goto err;
 
     if (dsa->priv_key == NULL) {
-        if ((priv_key = BN_new()) == NULL)
+        if ((priv_key = BN_secure_new()) == NULL)
             goto err;
     } else
         priv_key = dsa->priv_key;
diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c
index ebafc10..3f971aa 100644
--- a/crypto/ec/ec_asn1.c
+++ b/crypto/ec/ec_asn1.c
@@ -1023,6 +1023,8 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigned char **in, long len)
     ret->version = priv_key->version;
 
     if (priv_key->privateKey) {
+        if (ret->priv_key == NULL)
+            ret->priv_key = BN_secure_new();
         ret->priv_key = BN_bin2bn(ASN1_STRING_data(priv_key->privateKey),
                                   ASN1_STRING_length(priv_key->privateKey),
                                   ret->priv_key);
diff --git a/crypto/mem.c b/crypto/mem.c
index b98e44f..56c3585 100644
--- a/crypto/mem.c
+++ b/crypto/mem.c
@@ -94,6 +94,15 @@ static void *(*realloc_ex_func) (void *, size_t, const char *file, int line)
 
 static void (*free_func) (void *) = free;
 
+static void *(*malloc_secure_func)(size_t) = malloc;
+static void *default_malloc_secure_ex(size_t num, const char *file, int line)
+{
+    return malloc_secure_func(num);
+}
+static void *(*malloc_secure_ex_func)(size_t, const char *file, int line)
+    = default_malloc_secure_ex;
+static void (*free_secure_func)(void *) = free;
+
 static void *(*malloc_locked_func) (size_t) = malloc;
 static void *default_malloc_locked_ex(size_t num, const char *file, int line)
 {
@@ -145,6 +154,11 @@ int CRYPTO_set_mem_functions(void *(*m) (size_t), void *(*r) (void *, size_t),
     realloc_func = r;
     realloc_ex_func = default_realloc_ex;
     free_func = f;
+    /* If user wants to intercept the secure or locked functions, do it
+     * after the basic functions. */
+    malloc_secure_func = m;
+    malloc_secure_ex_func = default_malloc_secure_ex;
+    free_secure_func = f;
     malloc_locked_func = m;
     malloc_locked_ex_func = default_malloc_locked_ex;
     free_locked_func = f;
@@ -164,6 +178,44 @@ int CRYPTO_set_mem_ex_functions(void *(*m) (size_t, const char *, int),
     realloc_func = 0;
     realloc_ex_func = r;
     free_func = f;
+    malloc_secure_func = 0;
+    malloc_secure_ex_func = m;
+    free_secure_func = f;
+    malloc_locked_func = 0;
+    malloc_locked_ex_func = m;
+    free_locked_func = f;
+    return 1;
+}
+
+int CRYPTO_set_secure_mem_functions(void *(*m)(size_t), void (*f)(void *))
+{
+    /* Dummy call just to ensure OPENSSL_init() gets linked in */
+    OPENSSL_init();
+    if (!allow_customize)
+        return 0;
+    if ((m == 0) || (f == 0))
+        return 0;
+    malloc_secure_func = m;
+    malloc_secure_ex_func = default_malloc_secure_ex;
+    free_secure_func = f;
+    /* If user wants to intercept the locked functions, do it after
+     * the secure functions. */
+    malloc_locked_func = m;
+    malloc_locked_ex_func = default_malloc_secure_ex;
+    free_locked_func = f;
+    return 1;
+}
+
+int CRYPTO_set_secure_mem_ex_functions(void *(*m)(size_t, const char *, int),
+                                       void (*f)(void *))
+{
+    if (!allow_customize)
+        return 0;
+    if ((m == NULL) || (f == NULL))
+        return 0;
+    malloc_secure_func = 0;
+    malloc_secure_ex_func = m;
+    free_secure_func = f;
     malloc_locked_func = 0;
     malloc_locked_ex_func = m;
     free_locked_func = f;
@@ -191,7 +243,7 @@ int CRYPTO_set_locked_mem_ex_functions(void *(*m) (size_t, const char *, int),
         return 0;
     malloc_locked_func = 0;
     malloc_locked_ex_func = m;
-    free_func = f;
+    free_locked_func = f;
     return 1;
 }
 
@@ -236,6 +288,25 @@ void CRYPTO_get_mem_ex_functions(void *(**m) (size_t, const char *, int),
         *f = free_func;
 }
 
+void CRYPTO_get_secure_mem_functions(void *(**m)(size_t), void (**f)(void *))
+{
+    if (m != NULL)
+        *m = (malloc_secure_ex_func == default_malloc_secure_ex) ?
+            malloc_secure_func : 0;
+    if (f != NULL)
+        *f=free_secure_func;
+	}
+
+void CRYPTO_get_secure_mem_ex_functions(void *(**m)(size_t,const char *,int),
+                                        void (**f)(void *))
+{
+    if (m != NULL)
+        *m = (malloc_secure_ex_func != default_malloc_secure_ex) ?
+            malloc_secure_ex_func : 0;
+    if (f != NULL)
+        *f=free_secure_func;
+}
+
 void CRYPTO_get_locked_mem_functions(void *(**m) (size_t),
                                      void (**f) (void *))
 {
diff --git a/crypto/rsa/rsa_asn1.c b/crypto/rsa/rsa_asn1.c
index 0cf1b2a..8061aed 100644
--- a/crypto/rsa/rsa_asn1.c
+++ b/crypto/rsa/rsa_asn1.c
@@ -85,12 +85,12 @@ ASN1_SEQUENCE_cb(RSAPrivateKey, rsa_cb) = {
         ASN1_SIMPLE(RSA, version, LONG),
         ASN1_SIMPLE(RSA, n, BIGNUM),
         ASN1_SIMPLE(RSA, e, BIGNUM),
-        ASN1_SIMPLE(RSA, d, BIGNUM),
-        ASN1_SIMPLE(RSA, p, BIGNUM),
-        ASN1_SIMPLE(RSA, q, BIGNUM),
-        ASN1_SIMPLE(RSA, dmp1, BIGNUM),
-        ASN1_SIMPLE(RSA, dmq1, BIGNUM),
-        ASN1_SIMPLE(RSA, iqmp, BIGNUM)
+        ASN1_SIMPLE(RSA, d, CBIGNUM),
+        ASN1_SIMPLE(RSA, p, CBIGNUM),
+        ASN1_SIMPLE(RSA, q, CBIGNUM),
+        ASN1_SIMPLE(RSA, dmp1, CBIGNUM),
+        ASN1_SIMPLE(RSA, dmq1, CBIGNUM),
+        ASN1_SIMPLE(RSA, iqmp, CBIGNUM)
 } ASN1_SEQUENCE_END_cb(RSA, RSAPrivateKey)
 
 
diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
index e81be75..e40186a 100644
--- a/crypto/rsa/rsa_gen.c
+++ b/crypto/rsa/rsa_gen.c
@@ -117,19 +117,19 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
     /* We need the RSA components non-NULL */
     if (!rsa->n && ((rsa->n = BN_new()) == NULL))
         goto err;
-    if (!rsa->d && ((rsa->d = BN_new()) == NULL))
+    if (!rsa->d && ((rsa->d = BN_secure_new()) == NULL))
         goto err;
     if (!rsa->e && ((rsa->e = BN_new()) == NULL))
         goto err;
-    if (!rsa->p && ((rsa->p = BN_new()) == NULL))
+    if (!rsa->p && ((rsa->p = BN_secure_new()) == NULL))
         goto err;
-    if (!rsa->q && ((rsa->q = BN_new()) == NULL))
+    if (!rsa->q && ((rsa->q = BN_secure_new()) == NULL))
         goto err;
-    if (!rsa->dmp1 && ((rsa->dmp1 = BN_new()) == NULL))
+    if (!rsa->dmp1 && ((rsa->dmp1 = BN_secure_new()) == NULL))
         goto err;
-    if (!rsa->dmq1 && ((rsa->dmq1 = BN_new()) == NULL))
+    if (!rsa->dmq1 && ((rsa->dmq1 = BN_secure_new()) == NULL))
         goto err;
-    if (!rsa->iqmp && ((rsa->iqmp = BN_new()) == NULL))
+    if (!rsa->iqmp && ((rsa->iqmp = BN_secure_new()) == NULL))
         goto err;
 
     BN_copy(rsa->e, e_value);
diff --git a/crypto/sec_mem.c b/crypto/sec_mem.c
new file mode 100644
index 0000000..ea9523b
--- /dev/null
+++ b/crypto/sec_mem.c
@@ -0,0 +1,513 @@
+/*
+ * Copyright 2004-2014, Akamai Technologies. All Rights Reserved.
+ * This file is distributed under the terms of the OpenSSL license.
+ */
+
+/*
+ * This file is in two halves. The first half implements the public API
+ * to be used by external consumers, and to be used by OpenSSL to store
+ * data in a "secure arena." The second half implements the secure arena.
+ * For details on that implementation, see below (look for uppercase
+ * "SECURE HEAP IMPLEMENTATION").
+ */
+#include <openssl/crypto.h>
+#include <e_os.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <assert.h>
+
+#if defined(OPENSSL_SYS_LINUX) || defined(OPENSSL_SYS_UNIX)
+# define IMPLEMENTED
+# include <sys/mman.h>
+# include <sys/param.h>
+#endif
+
+#define LOCK()      CRYPTO_w_lock(CRYPTO_LOCK_MALLOC)
+#define UNLOCK()    CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC)
+#define CLEAR(p, s) OPENSSL_cleanse(p, s)
+#define PAGE_SIZE    4096
+
+#ifdef IMPLEMENTED
+size_t secure_mem_used;
+
+static int secure_mem_initialized;
+static int too_late;
+
+/*
+ * These are the functions that must be implemented by a secure heap (sh).
+ */
+static int sh_init(size_t size, int minsize);
+static char *sh_malloc(size_t size);
+static void sh_free(char *ptr);
+static void sh_done(void);
+static int sh_actual_size(char *ptr);
+static int sh_allocated(const char *ptr);
+#endif
+
+int CRYPTO_secure_malloc_init(size_t size, int minsize)
+{
+#ifdef IMPLEMENTED
+    int ret = 0;
+
+    if (too_late)
+        return ret;
+    LOCK();
+    OPENSSL_assert(!secure_mem_initialized);
+    if (!secure_mem_initialized) {
+        ret = sh_init(size, minsize);
+        secure_mem_initialized = 1;
+    }
+    UNLOCK();
+    return ret;
+#else
+    return 0;
+#endif /* IMPLEMENTED */
+}
+
+void CRYPTO_secure_malloc_done()
+{
+#ifdef IMPLEMENTED
+    LOCK();
+    sh_done();
+    secure_mem_initialized = 0;
+    UNLOCK();
+#endif /* IMPLEMENTED */
+}
+
+int CRYPTO_secure_malloc_initialized()
+{
+#ifdef IMPLEMENTED
+    return secure_mem_initialized;
+#else
+    return 0;
+#endif /* IMPLEMENTED */
+}
+
+void *CRYPTO_secure_malloc(int num, const char *file, int line)
+{
+#ifdef IMPLEMENTED
+    void *ret;
+    size_t actual_size;
+
+    if (!secure_mem_initialized) {
+        too_late = 1;
+        return CRYPTO_malloc(num, file, line);
+    }
+    LOCK();
+    ret = sh_malloc(num);
+    actual_size = ret ? sh_actual_size(ret) : 0;
+    secure_mem_used += actual_size;
+    UNLOCK();
+    return ret;
+#else
+    return CRYPTO_malloc(num, file, line);
+#endif /* IMPLEMENTED */
+}
+
+void CRYPTO_secure_free(void *ptr)
+{
+#ifdef IMPLEMENTED
+    size_t actual_size;
+
+    if (ptr == NULL)
+        return;
+    if (!secure_mem_initialized) {
+        CRYPTO_free(ptr);
+        return;
+    }
+    LOCK();
+    actual_size = sh_actual_size(ptr);
+    CLEAR(ptr, actual_size);
+    secure_mem_used -= actual_size;
+    sh_free(ptr);
+    UNLOCK();
+#else
+    CRYPTO_free(ptr);
+#endif /* IMPLEMENTED */
+}
+
+int CRYPTO_secure_allocated(const void *ptr)
+{
+#ifdef IMPLEMENTED
+    int ret;
+
+    if (!secure_mem_initialized)
+        return 0;
+    LOCK();
+    ret = sh_allocated(ptr);
+    UNLOCK();
+    return ret;
+#else
+    return 0;
+#endif /* IMPLEMENTED */
+}
+
+/* END OF PAGE ...
+
+   ... START OF PAGE */
+
+/*
+ * SECURE HEAP IMPLEMENTATION
+ */
+#ifdef IMPLEMENTED
+
+
+/*
+ * The implementation provided here uses a fixed-sized mmap() heap,
+ * which is locked into memory, not written to core files, and protected
+ * on either side by an unmapped page, which will catch pointer overruns
+ * (or underruns) and an attempt to read data out of the secure heap.
+ * Free'd memory is zero'd or otherwise cleansed.
+ *
+ * This is a pretty standard buddy allocator.  We keep areas in a multiple
+ * of "sh.minsize" units.  The freelist and bitmaps are kept separately,
+ * so all (and only) data is kept in the mmap'd heap.
+ *
+ * This code assumes eight-bit bytes.  The numbers 3 and 7 are all over the
+ * place.
+ */
+
+# define TESTBIT(t, b)  (t[(b) >> 3] &  (1 << ((b) & 7)))
+# define SETBIT(t, b)   (t[(b) >> 3] |= (1 << ((b) & 7)))
+# define CLEARBIT(t, b) (t[(b) >> 3] &= (0xFF & ~(1 << ((b) & 7))))
+
+#define WITHIN_ARENA(p) \
+    ((char*)(p) >= sh.arena && (char*)(p) < &sh.arena[sh.arena_size])
+#define WITHIN_FREELIST(p) \
+    ((char*)(p) >= (char*)sh.freelist && (char*)(p) < (char*)&sh.freelist[sh.freelist_size])
+
+
+typedef struct sh_list_st
+{
+    struct sh_list_st *next;
+    struct sh_list_st **p_next;
+} SH_LIST;
+
+typedef struct sh_st
+{
+    char* map_result;
+    size_t map_size;
+    char *arena;
+    int arena_size;
+    char **freelist;
+    int freelist_size;
+    int minsize;
+    unsigned char *bittable;
+    unsigned char *bitmalloc;
+    int bittable_size; /* size in bits */
+} SH;
+
+static SH sh;
+
+static int sh_getlist(char *ptr)
+{
+    int list = sh.freelist_size - 1;
+    int bit = (sh.arena_size + ptr - sh.arena) / sh.minsize;
+
+    for (; bit; bit >>= 1, list--) {
+        if (TESTBIT(sh.bittable, bit))
+            break;
+        OPENSSL_assert((bit & 1) == 0);
+    }
+
+    return list;
+}
+
+
+static int sh_testbit(char *ptr, int list, unsigned char *table)
+{
+    int bit;
+
+    OPENSSL_assert(list >= 0 && list < sh.freelist_size);
+    OPENSSL_assert(((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0);
+    bit = (1 << list) + ((ptr - sh.arena) / (sh.arena_size >> list));
+    OPENSSL_assert(bit > 0 && bit < sh.bittable_size);
+    return TESTBIT(table, bit);
+}
+
+static void sh_clearbit(char *ptr, int list, unsigned char *table)
+{
+    int bit;
+
+    OPENSSL_assert(list >= 0 && list < sh.freelist_size);
+    OPENSSL_assert(((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0);
+    bit = (1 << list) + ((ptr - sh.arena) / (sh.arena_size >> list));
+    OPENSSL_assert(bit > 0 && bit < sh.bittable_size);
+    OPENSSL_assert(TESTBIT(table, bit));
+    CLEARBIT(table, bit);
+}
+
+static void sh_setbit(char *ptr, int list, unsigned char *table)
+{
+    int bit;
+
+    OPENSSL_assert(list >= 0 && list < sh.freelist_size);
+    OPENSSL_assert(((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0);
+    bit = (1 << list) + ((ptr - sh.arena) / (sh.arena_size >> list));
+    OPENSSL_assert(bit > 0 && bit < sh.bittable_size);
+    OPENSSL_assert(!TESTBIT(table, bit));
+    SETBIT(table, bit);
+}
+
+static void sh_add_to_list(char **list, char *ptr)
+{
+    SH_LIST *temp;
+
+    OPENSSL_assert(WITHIN_FREELIST(list));
+    OPENSSL_assert(WITHIN_ARENA(ptr));
+
+    temp = (SH_LIST *)ptr;
+    temp->next = *(SH_LIST **)list;
+    OPENSSL_assert(temp->next == NULL || WITHIN_ARENA(temp->next));
+    temp->p_next = (SH_LIST **)list;
+
+    if (temp->next != NULL) {
+        OPENSSL_assert((char **)temp->next->p_next == list);
+        temp->next->p_next = &(temp->next);
+    }
+
+    *list = ptr;
+}
+
+static void sh_remove_from_list(char *ptr, char *list)
+{
+    SH_LIST *temp, *temp2;
+
+    temp = (SH_LIST *)ptr;
+    if (temp->next != NULL)
+        temp->next->p_next = temp->p_next;
+    *temp->p_next = temp->next;
+    if (temp->next == NULL)
+        return;
+
+    temp2 = temp->next;
+    OPENSSL_assert(WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next));
+}
+
+
+static int sh_init(size_t size, int minsize)
+{
+    int i, ret;
+    size_t pgsize;
+    size_t aligned;
+
+    memset(&sh, 0, sizeof sh);
+
+    /* make sure size and minsize are powers of 2 */
+    OPENSSL_assert(size > 0);
+    OPENSSL_assert((size & (size - 1)) == 0);
+    OPENSSL_assert(minsize > 0);
+    OPENSSL_assert((minsize & (minsize - 1)) == 0);
+    if (size <= 0 || (size & (size - 1)) != 0)
+        goto err;
+    if (minsize <= 0 || (minsize & (minsize - 1)) != 0)
+        goto err;
+
+    sh.arena_size = size;
+    sh.minsize = minsize;
+    sh.bittable_size = (sh.arena_size / sh.minsize) * 2;
+
+    sh.freelist_size = -1;
+    for (i = sh.bittable_size; i; i >>= 1)
+        sh.freelist_size++;
+
+    sh.freelist = OPENSSL_malloc(sh.freelist_size * sizeof (char *));
+    OPENSSL_assert(sh.freelist != NULL);
+    if (sh.freelist == NULL)
+        goto err;
+    memset(sh.freelist, 0, sh.freelist_size * sizeof (char *));
+
+    sh.bittable = OPENSSL_malloc(sh.bittable_size >> 3);
+    OPENSSL_assert(sh.bittable != NULL);
+    if (sh.bittable == NULL)
+        goto err;
+    memset(sh.bittable, 0, sh.bittable_size >> 3);
+
+    sh.bitmalloc = OPENSSL_malloc(sh.bittable_size >> 3);
+    OPENSSL_assert(sh.bitmalloc != NULL);
+    if (sh.bitmalloc == NULL)
+        goto err;
+    memset(sh.bitmalloc, 0, sh.bittable_size >> 3);
+
+    /* Allocate space for heap, and two extra pages as guards */
+#ifdef _SC_PAGE_SIZE
+    pgsize = (size_t)sysconf(_SC_PAGE_SIZE);
+#else
+    pgsize = PAGE_SIZE;
+#endif
+    sh.map_size = pgsize + sh.arena_size + pgsize;
+    sh.map_result = mmap(NULL, sh.map_size,
+                         PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, -1, 0);
+    OPENSSL_assert(sh.map_result != MAP_FAILED);
+    if (sh.map_result == MAP_FAILED)
+        goto err;
+    sh.arena = (char *)(sh.map_result + pgsize);
+    sh_setbit(sh.arena, 0, sh.bittable);
+    sh_add_to_list(&sh.freelist[0], sh.arena);
+
+    /* Now try to add guard pages and lock into memory. */
+    ret = 1;
+
+    /* Starting guard is already aligned from mmap. */
+    if (mprotect(sh.map_result, pgsize, PROT_NONE) < 0)
+        ret = 2;
+
+    /* Ending guard page - need to round up to page boundary */
+    aligned = (pgsize + sh.arena_size + (pgsize - 1)) & ~(pgsize - 1);
+    if (mprotect(sh.map_result + aligned, pgsize, PROT_NONE) < 0)
+        ret = 2;
+
+    if (mlock(sh.arena, sh.arena_size) < 0)
+        ret = 2;
+#ifdef MADV_DONTDUMP
+    if (madvise(sh.arena, sh.arena_size, MADV_DONTDUMP) < 0)
+        ret = 2;
+#endif
+
+    return ret;
+
+ err:
+    sh_done();
+    return 0;
+}
+
+static void sh_done()
+{
+    OPENSSL_free(sh.freelist);
+    OPENSSL_free(sh.bittable);
+    OPENSSL_free(sh.bitmalloc);
+    if (sh.map_result != NULL && sh.map_size)
+        munmap(sh.map_result, sh.map_size);
+    memset(&sh, 0, sizeof sh);
+}
+
+static int sh_allocated(const char *ptr)
+{
+    return WITHIN_ARENA(ptr) ? 1 : 0;
+}
+
+static char *sh_find_my_buddy(char *ptr, int list)
+{
+    int bit;
+    char *chunk = NULL;
+
+    bit = (1 << list) + (ptr - sh.arena) / (sh.arena_size >> list);
+    bit ^= 1;
+
+    if (TESTBIT(sh.bittable, bit) && !TESTBIT(sh.bitmalloc, bit))
+        chunk = sh.arena + ((bit & ((1 << list) - 1)) * (sh.arena_size >> list));
+
+    return chunk;
+}
+
+static char *sh_malloc(size_t size)
+{
+    int list, slist;
+    size_t i;
+    char *chunk;
+
+    list = sh.freelist_size - 1;
+    for (i = sh.minsize; i < size; i <<= 1)
+        list--;
+    if (list < 0)
+        return NULL;
+
+    /* try to find a larger entry to split */
+    for (slist = list; slist >= 0; slist--)
+        if (sh.freelist[slist] != NULL)
+            break;
+    if (slist < 0)
+        return NULL;
+
+    /* split larger entry */
+    while (slist != list) {
+        char *temp = sh.freelist[slist];
+
+        /* remove from bigger list */
+        OPENSSL_assert(!sh_testbit(temp, slist, sh.bitmalloc));
+        sh_clearbit(temp, slist, sh.bittable);
+        sh_remove_from_list(temp, sh.freelist[slist]);
+        OPENSSL_assert(temp != sh.freelist[slist]);
+
+        /* done with bigger list */
+        slist++;
+
+        /* add to smaller list */
+        OPENSSL_assert(!sh_testbit(temp, slist, sh.bitmalloc));
+        sh_setbit(temp, slist, sh.bittable);
+        sh_add_to_list(&sh.freelist[slist], temp);
+        OPENSSL_assert(sh.freelist[slist] == temp);
+
+        /* split in 2 */
+        temp += sh.arena_size >> slist;
+        OPENSSL_assert(!sh_testbit(temp, slist, sh.bitmalloc));
+        sh_setbit(temp, slist, sh.bittable);
+        sh_add_to_list(&sh.freelist[slist], temp);
+        OPENSSL_assert(sh.freelist[slist] == temp);
+
+        OPENSSL_assert(temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist));
+    }
+
+    /* peel off memory to hand back */
+    chunk = sh.freelist[list];
+    OPENSSL_assert(sh_testbit(chunk, list, sh.bittable));
+    sh_setbit(chunk, list, sh.bitmalloc);
+    sh_remove_from_list(chunk, sh.freelist[list]);
+
+    OPENSSL_assert(WITHIN_ARENA(chunk));
+
+    return chunk;
+}
+
+static void sh_free(char *ptr)
+{
+    int list;
+    char *buddy;
+
+    if (ptr == NULL)
+        return;
+    OPENSSL_assert(WITHIN_ARENA(ptr));
+    if (!WITHIN_ARENA(ptr))
+        return;
+
+    list = sh_getlist(ptr);
+    OPENSSL_assert(sh_testbit(ptr, list, sh.bittable));
+    sh_clearbit(ptr, list, sh.bitmalloc);
+    sh_add_to_list(&sh.freelist[list], ptr);
+
+    /* Try to coalesce two adjacent free areas. */
+    while ((buddy = sh_find_my_buddy(ptr, list)) != NULL) {
+        OPENSSL_assert(ptr == sh_find_my_buddy(buddy, list));
+        OPENSSL_assert(ptr != NULL);
+        OPENSSL_assert(!sh_testbit(ptr, list, sh.bitmalloc));
+        sh_clearbit(ptr, list, sh.bittable);
+        sh_remove_from_list(ptr, sh.freelist[list]);
+        OPENSSL_assert(!sh_testbit(ptr, list, sh.bitmalloc));
+        sh_clearbit(buddy, list, sh.bittable);
+        sh_remove_from_list(buddy, sh.freelist[list]);
+
+        list--;
+
+        if (ptr > buddy)
+            ptr = buddy;
+
+        OPENSSL_assert(!sh_testbit(ptr, list, sh.bitmalloc));
+        sh_setbit(ptr, list, sh.bittable);
+        sh_add_to_list(&sh.freelist[list], ptr);
+        OPENSSL_assert(sh.freelist[list] == ptr);
+    }
+}
+
+static int sh_actual_size(char *ptr)
+{
+    int list;
+
+    OPENSSL_assert(WITHIN_ARENA(ptr));
+    if (!WITHIN_ARENA(ptr))
+        return 0;
+    list = sh_getlist(ptr);
+    OPENSSL_assert(sh_testbit(ptr, list, sh.bittable));
+    return sh.arena_size / (1 << list);
+}
+#endif /* IMPLEMENTED */
diff --git a/doc/crypto/BIO_s_mem.pod b/doc/crypto/BIO_s_mem.pod
index 8f85e0d..1aa7e6e 100644
--- a/doc/crypto/BIO_s_mem.pod
+++ b/doc/crypto/BIO_s_mem.pod
@@ -10,6 +10,7 @@ BIO_get_mem_ptr, BIO_new_mem_buf - memory BIO
  #include <openssl/bio.h>
 
  BIO_METHOD *	BIO_s_mem(void);
+ BIO_METHOD *	BIO_s_secmem(void);
 
  BIO_set_mem_eof_return(BIO *b,int v)
  long BIO_get_mem_data(BIO *b, char **pp)
@@ -26,6 +27,9 @@ A memory BIO is a source/sink BIO which uses memory for its I/O. Data
 written to a memory BIO is stored in a BUF_MEM structure which is extended
 as appropriate to accommodate the stored data.
 
+BIO_s_secmem() is like BIO_s_mem() except that the secure heap is used
+for buffer storage.
+
 Any data written to a memory BIO can be recalled by reading from it.
 Unless the memory BIO is read only any data read from it is deleted from
 the BIO.
@@ -79,6 +83,9 @@ read in small chunks the operation can be very slow. The use of a read only
 memory BIO avoids this problem. If the BIO must be read write then adding
 a buffering BIO to the chain will speed up the process.
 
+Calling BIO_set_mem_buf() on a BIO created with BIO_new_secmem() will
+give undefined results, including perhaps a program crash.
+
 =head1 BUGS
 
 There should be an option to set the maximum size of a memory BIO.
diff --git a/doc/crypto/BN_CTX_new.pod b/doc/crypto/BN_CTX_new.pod
index 5da8433..958e551 100644
--- a/doc/crypto/BN_CTX_new.pod
+++ b/doc/crypto/BN_CTX_new.pod
@@ -2,7 +2,7 @@
 
 =head1 NAME
 
-BN_CTX_new, BN_CTX_init, BN_CTX_free - allocate and free BN_CTX structures
+BN_CTX_new, BN_CTX_secure_new, BN_CTX_init, BN_CTX_free - allocate and free BN_CTX structures
 
 =head1 SYNOPSIS
 
@@ -10,6 +10,8 @@ BN_CTX_new, BN_CTX_init, BN_CTX_free - allocate and free BN_CTX structures
 
  BN_CTX *BN_CTX_new(void);
 
+ BN_CTX *BN_CTX_secure_new(void);
+
  void BN_CTX_free(BN_CTX *c);
 
 =head1 DESCRIPTION
@@ -19,8 +21,10 @@ library functions. Since dynamic memory allocation to create B<BIGNUM>s
 is rather expensive when used in conjunction with repeated subroutine
 calls, the B<BN_CTX> structure is used.
 
-BN_CTX_new() allocates and initializes a B<BN_CTX>
-structure. 
+BN_CTX_new() allocates and initializes a B<BN_CTX> structure.
+BN_CTX_secure_new() allocates and initializes a B<BN_CTX> structure
+but uses the secure heap (see L<CRYPTO_secure_malloc(3)>) to hold the
+B<BIGNUM>s.
 
 BN_CTX_free() frees the components of the B<BN_CTX>, and if it was
 created by BN_CTX_new(), also the structure itself.
@@ -31,8 +35,9 @@ If B<c> is NULL, nothing is done.
 
 =head1 RETURN VALUES
 
-BN_CTX_new() returns a pointer to the B<BN_CTX>. If the allocation fails,
-it returns B<NULL> and sets an error code that can be obtained by
+BN_CTX_new() and BN_CTX_secure_new() return a pointer to the B<BN_CTX>.
+If the allocation fails,
+they return B<NULL> and sets an error code that can be obtained by
 L<ERR_get_error(3)|ERR_get_error(3)>.
 
 BN_CTX_free() has no return values.
diff --git a/doc/crypto/CRYPTO_secure_malloc.pod b/doc/crypto/CRYPTO_secure_malloc.pod
new file mode 100644
index 0000000..a3b416e
--- /dev/null
+++ b/doc/crypto/CRYPTO_secure_malloc.pod
@@ -0,0 +1,91 @@
+=pod
+
+=head1 NAME
+
+CRYPTO_secure_malloc_init, CRYPTO_secure_malloc_done, OPENSSL_secure_malloc, OPENSSL_secure_free, OPENSSL_secure_allocated - use secure heap storage
+
+=head1 SYNOPSIS
+
+ #include <openssl/crypto.h>
+
+ int CRYPTO_secure_malloc_init(size_t size, int minsize);
+
+ int CRYPTO_secure_malloc_initialized();
+
+ void CRYPTO_secure_malloc_done();
+
+ void *OPENSSL_secure_malloc(int num);
+
+ void OPENSSL_secure_free(void* ptr);
+
+ int OPENSSL_secure_allocated(const void* ptr);
+
+=head1 DESCRIPTION
+
+In order to help protect applications (particularly long-running servers)
+from pointer overruns or underruns that could return arbitrary data from
+the program's dynamic memory area, where keys and other sensitive
+information might be stored, OpenSSL supports the concept of a "secure heap."
+The level and type of security guarantees depend on the operating system.
+It is a good idea to review the code and see if it addresses your
+threat model and concerns.
+
+If a secure heap is used, then private key B<BIGNUM> values are stored there.
+This protects long-term storage of private keys, but will not necessarily
+put all intermediate values and computations there.
+
+B<CRYPTO_secure_malloc_init> creates the secure heap, with the specified
+C<size> in bytes. The C<minsize> parameter is the minimum size to
+allocate from the heap. Both C<size> and C<minsize> must be a power
+of two.  It is an error to call this after any B<OPENSSL_secure_malloc>
+calls have been made.
+
+B<CRYPTO_secure_malloc_initialized> indicates whether or not the secure
+heap as been initialized and is available.
+
+B<CRYPTO_secure_malloc_done> releases the heap and makes the memory unavailable
+to the process. It can take noticeably long to complete.
+
+B<OPENSSL_secure_malloc> allocates C<num> bytes from the heap.
+If B<CRYPTO_secure_malloc_init> is not called, this is equivalent to
+calling B<OPENSSL_malloc>.
+
+B<OPENSSL_secure_free> releases the memory at C<ptr> back to the heap.
+It must be called with a value previously obtained from
+B<OPENSSL_secure_malloc>.
+If B<CRYPTO_secure_malloc_init> is not called, this is equivalent to
+calling B<OPENSSL_free>.
+
+B<OPENSSL_secure_allocated> tells whether or not a pointer is within
+the secure heap.
+
+=head1 RETURN VALUES
+
+B<CRYPTO_secure_malloc_init> returns 0 on failure, 1 if successful,
+and 2 if successful but the heap could not be protected by memory
+mapping.
+
+B<CRYPTO_secure_malloc_initialized> returns 1 if the secure heap is
+available (that is, if B<CRYPTO_secure_malloc_init> has been called,
+but B<CRYPTO_secure_malloc_done> has not) or 0 if not.
+
+B<OPENSSL_secure_malloc> returns a pointer into the secure heap of
+the requested size, or C<NULL> if memory could not be allocated.
+
+B<CRYPTO_secure_allocated> returns 1 if the pointer is in the
+the secure heap, or 0 if not.
+
+B<CRYPTO_secure_malloc_done> and B<OPENSSL_secure_free>
+return no values.
+
+=head1 SEE ALSO
+
+L<BN_new(3)|BN_new(3)>,
+L<bn_internal(3)|bn_internal(3)>
+
+=head1 HISTORY
+
+These functions were contributed to the OpenSSL project by
+Akamai Technologies in April, 2014.
+
+=cut
diff --git a/doc/crypto/bio.pod b/doc/crypto/bio.pod
index f923922..9debe4f 100644
--- a/doc/crypto/bio.pod
+++ b/doc/crypto/bio.pod
@@ -49,6 +49,7 @@ L<BIO_push(3)|BIO_push(3)>, L<BIO_read(3)|BIO_read(3)>,
 L<BIO_s_accept(3)|BIO_s_accept(3)>, L<BIO_s_bio(3)|BIO_s_bio(3)>,
 L<BIO_s_connect(3)|BIO_s_connect(3)>, L<BIO_s_fd(3)|BIO_s_fd(3)>,
 L<BIO_s_file(3)|BIO_s_file(3)>, L<BIO_s_mem(3)|BIO_s_mem(3)>,
+L<BIO_s_secmem(3)|BIO_s_mem(3)>,
 L<BIO_s_null(3)|BIO_s_null(3)>, L<BIO_s_socket(3)|BIO_s_socket(3)>,
 L<BIO_set_callback(3)|BIO_set_callback(3)>,
 L<BIO_should_retry(3)|BIO_should_retry(3)>
diff --git a/doc/crypto/bn.pod b/doc/crypto/bn.pod
index b52916b..ab809f9 100644
--- a/doc/crypto/bn.pod
+++ b/doc/crypto/bn.pod
@@ -14,6 +14,7 @@ bn - multiprecision integer arithmetics
  void BN_clear_free(BIGNUM *a);
 
  BN_CTX *BN_CTX_new(void);
+ BN_CTX *BN_CTX_secure_new(void);
  void BN_CTX_free(BN_CTX *c);
 
  BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b);
diff --git a/doc/crypto/buffer.pod b/doc/crypto/buffer.pod
index 781f5b1..3804c56 100644
--- a/doc/crypto/buffer.pod
+++ b/doc/crypto/buffer.pod
@@ -11,6 +11,10 @@ character arrays structure
 
  BUF_MEM *BUF_MEM_new(void);
 
+ #define BUF_MEM_FLAG_SECURE
+
+ BUF_MEM * BUF_MEM_new_ex(unsigned long flags);
+
  void	BUF_MEM_free(BUF_MEM *a);
 
  int	BUF_MEM_grow(BUF_MEM *str, int len);
@@ -37,6 +41,10 @@ and one "miscellaneous" function.
 
 BUF_MEM_new() allocates a new buffer of zero size.
 
+BUF_MEM_new_ex() allocates a buffer with the specified flags.
+The flag B<BUF_MEM_FLAG_SECURE> specifies that the B<data> pointer
+should be allocated on the secure heap; see L<CRYPTO_secure_malloc(3)>.
+
 BUF_MEM_free() frees up an already existing buffer. The data is zeroed
 before freeing up in case the buffer contains sensitive data.
 
@@ -63,11 +71,15 @@ BUF_MEM_grow() returns zero on error or the new size (i.e. B<len>).
 
 =head1 SEE ALSO
 
-L<bio(3)|bio(3)>
+L<bio(3)|bio(3)>,
+L<CRYPTO_secure_malloc(3)>.
 
 =head1 HISTORY
 
 BUF_MEM_new(), BUF_MEM_free() and BUF_MEM_grow() are available in all
 versions of SSLeay and OpenSSL. BUF_strdup() was added in SSLeay 0.8.
 
+BUF_MEM_new_ex() was contributed to OpenSSL by Akamai Technologies
+in May, 2014.
+
 =cut
diff --git a/include/openssl/bio.h b/include/openssl/bio.h
index 7fe88ec..2da93bd 100644
--- a/include/openssl/bio.h
+++ b/include/openssl/bio.h
@@ -670,6 +670,7 @@ long BIO_debug_callback(BIO *bio, int cmd, const char *argp, int argi,
                         long argl, long ret);
 
 BIO_METHOD *BIO_s_mem(void);
+BIO_METHOD *BIO_s_secmem(void);
 BIO *BIO_new_mem_buf(void *buf, int len);
 BIO_METHOD *BIO_s_socket(void);
 BIO_METHOD *BIO_s_connect(void);
diff --git a/include/openssl/bn.h b/include/openssl/bn.h
index 44f1737..0fcf843 100644
--- a/include/openssl/bn.h
+++ b/include/openssl/bn.h
@@ -268,6 +268,7 @@ extern "C" {
  * BN_mod_inverse() will call BN_mod_inverse_no_branch.
  */
 # define BN_FLG_CONSTTIME        0x04
+# define BN_FLG_SECURE           0x08
 
 # ifdef OPENSSL_USE_DEPRECATED
 /* deprecated name for the flag */
@@ -349,6 +350,7 @@ void BN_zero_ex(BIGNUM *a);
 const BIGNUM *BN_value_one(void);
 char *BN_options(void);
 BN_CTX *BN_CTX_new(void);
+BN_CTX *BN_CTX_secure_new(void);
 void BN_CTX_free(BN_CTX *c);
 void BN_CTX_start(BN_CTX *ctx);
 BIGNUM *BN_CTX_get(BN_CTX *ctx);
@@ -361,6 +363,7 @@ int BN_num_bits(const BIGNUM *a);
 int BN_num_bits_word(BN_ULONG l);
 int BN_security_bits(int L, int N);
 BIGNUM *BN_new(void);
+BIGNUM *BN_secure_new(void);
 void BN_clear_free(BIGNUM *a);
 BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b);
 void BN_swap(BIGNUM *a, BIGNUM *b);
diff --git a/include/openssl/buffer.h b/include/openssl/buffer.h
index 672c06b..af30a90 100644
--- a/include/openssl/buffer.h
+++ b/include/openssl/buffer.h
@@ -78,9 +78,13 @@ struct buf_mem_st {
     size_t length;              /* current number of bytes */
     char *data;
     size_t max;                 /* size of buffer */
+    unsigned long flags;
 };
 
+# define BUF_MEM_FLAG_SECURE  0x01
+
 BUF_MEM *BUF_MEM_new(void);
+BUF_MEM *BUF_MEM_new_ex(unsigned long flags);
 void BUF_MEM_free(BUF_MEM *a);
 size_t BUF_MEM_grow(BUF_MEM *str, size_t len);
 size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len);
diff --git a/include/openssl/crypto.h b/include/openssl/crypto.h
index f05084f..1bda645 100644
--- a/include/openssl/crypto.h
+++ b/include/openssl/crypto.h
@@ -491,12 +491,12 @@ void (*CRYPTO_get_dynlock_destroy_callback(void)) (struct CRYPTO_dynlock_value
 int CRYPTO_set_mem_functions(void *(*m) (size_t), void *(*r) (void *, size_t),
                              void (*f) (void *));
 int CRYPTO_set_locked_mem_functions(void *(*m) (size_t),
-                                    void (*free_func) (void *));
+                                    void (*f) (void *));
 int CRYPTO_set_mem_ex_functions(void *(*m) (size_t, const char *, int),
                                 void *(*r) (void *, size_t, const char *,
                                             int), void (*f) (void *));
 int CRYPTO_set_locked_mem_ex_functions(void *(*m) (size_t, const char *, int),
-                                       void (*free_func) (void *));
+                                       void (*f) (void *));
 int CRYPTO_set_mem_debug_functions(void (*m)
                                     (void *, int, const char *, int, int),
                                    void (*r) (void *, void *, int,
@@ -532,6 +532,25 @@ void *CRYPTO_realloc_clean(void *addr, int old_num, int num, const char *file,
                            int line);
 void *CRYPTO_remalloc(void *addr, int num, const char *file, int line);
 
+# define OPENSSL_secure_malloc(num) \
+        CRYPTO_secure_malloc((int)num,__FILE__,__LINE__)
+# define OPENSSL_secure_free(addr) \
+        CRYPTO_secure_free(addr)
+
+int CRYPTO_secure_malloc_init(size_t sz, int minsize);
+void CRYPTO_secure_malloc_done(void);
+void *CRYPTO_secure_malloc(int num, const char *file, int line);
+void CRYPTO_secure_free(void *ptr);
+int CRYPTO_secure_allocated(const void *ptr);
+int CRYPTO_secure_malloc_initialized(void);
+
+int CRYPTO_set_secure_mem_functions(void *(*m)(size_t), void (*f)(void *));
+int CRYPTO_set_secure_mem_ex_functions(void *(*m)(size_t,const char *,int),
+                                       void (*f)(void *));
+void CRYPTO_get_secure_mem_functions(void *(**m)(size_t), void (**f)(void *));
+void CRYPTO_get_secure_mem_ex_functions(void *(**m)(size_t,const char *,int),
+                                        void (**f)(void *));
+
 void OPENSSL_cleanse(void *ptr, size_t len);
 
 void CRYPTO_set_mem_debug_options(long bits);
diff --git a/test/Makefile b/test/Makefile
index 343c21a..508c53b 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -63,6 +63,7 @@ EVPEXTRATEST=evp_extra_test
 P5_CRPT2_TEST=	p5_crpt2_test
 IGETEST=	igetest
 JPAKETEST=	jpaketest
+SECMEMTEST=	secmemtest
 SRPTEST=	srptest
 V3NAMETEST=	v3nametest
 HEARTBEATTEST=  heartbeat_test
@@ -80,7 +81,8 @@ EXE=	$(BNTEST)$(EXE_EXT) $(ECTEST)$(EXE_EXT)  $(ECDSATEST)$(EXE_EXT) $(ECDHTEST)
 	$(BFTEST)$(EXE_EXT) $(CASTTEST)$(EXE_EXT) $(SSLTEST)$(EXE_EXT) \
 	$(EXPTEST)$(EXE_EXT) $(DSATEST)$(EXE_EXT) $(RSATEST)$(EXE_EXT) \
 	$(EVPTEST)$(EXE_EXT) $(EVPEXTRATEST)$(EXE_EXT) $(IGETEST)$(EXE_EXT) \
-	$(JPAKETEST)$(EXE_EXT) $(SRPTEST)$(EXE_EXT) $(V3NAMETEST)$(EXE_EXT) \
+	$(JPAKETEST)$(EXE_EXT) $(SECMEMTEST)$(EXE_EXT) \
+	$(SRPTEST)$(EXE_EXT) $(V3NAMETEST)$(EXE_EXT) \
 	$(HEARTBEATTEST)$(EXE_EXT) $(P5_CRPT2_TEST)$(EXE_EXT) \
 	$(CONSTTIMETEST)$(EXE_EXT)
 
@@ -145,7 +147,8 @@ alltests: \
 	test_enc test_x509 test_rsa test_crl test_sid \
 	test_gen test_req test_pkcs7 test_verify test_dh test_dsa \
 	test_ss test_ca test_engine test_evp test_evp_extra test_ssl test_tsa \
-	test_ige test_jpake test_srp test_cms test_v3name test_ocsp \
+	test_ige test_jpake test_secmem \
+	test_srp test_cms test_v3name test_ocsp \
 	test_gost2814789 test_heartbeat test_p5_crpt2 \
 	test_constant_time
 
@@ -372,6 +375,10 @@ test_cms: ../apps/openssl$(EXE_EXT) cms-test.pl smcont.txt
 	@echo $(START) $@
 	$(PERL) cms-test.pl
 
+test_secmem: $(SECMEMTEST)$(EXE_EXT)
+	@echo $(START) $@
+	../util/shlib_wrap.sh ./secmemtest
+
 test_srp: $(SRPTEST)$(EXE_EXT)
 	@echo $(START) $@
 	../util/shlib_wrap.sh ./srptest
@@ -564,6 +571,9 @@ $(IGETEST)$(EXE_EXT): $(IGETEST).o $(DLIBCRYPTO)
 $(JPAKETEST)$(EXE_EXT): $(JPAKETEST).o $(DLIBCRYPTO)
 	@target=$(JPAKETEST); $(BUILD_CMD)
 
+$(SECMEMTEST)$(EXE_EXT): $(SECMEMTEST).o $(DLIBCRYPTO)
+	@target=$(SECMEMTEST); $(BUILD_CMD)
+
 $(SRPTEST)$(EXE_EXT): $(SRPTEST).o $(DLIBCRYPTO)
 	@target=$(SRPTEST); $(BUILD_CMD)
 
diff --git a/test/secmemtest.c b/test/secmemtest.c
new file mode 100644
index 0000000..0ec3b92
--- /dev/null
+++ b/test/secmemtest.c
@@ -0,0 +1,34 @@
+
+#include <openssl/crypto.h>
+
+int main(int argc, char **argv)
+{
+#if defined(OPENSSL_SYS_LINUX) || defined(OPENSSL_SYS_UNIX)
+    char *p = NULL, *q = NULL;
+
+    if (!CRYPTO_secure_malloc_init(4096, 32)) {
+        perror("failed");
+        return 1;
+    }
+    p = OPENSSL_secure_malloc(20);
+    if (!CRYPTO_secure_allocated(p)) {
+        perror("failed 1");
+        return 1;
+    }
+    q = OPENSSL_malloc(20);
+    if (CRYPTO_secure_allocated(q)) {
+        perror("failed 1");
+        return 1;
+    }
+    CRYPTO_secure_free(p);
+    CRYPTO_free(q);
+    CRYPTO_secure_malloc_done();
+#else
+    /* Should fail. */
+    if (CRYPTO_secure_malloc_init(4096, 32)) {
+        perror("failed");
+        return 1;
+    }
+#endif
+    return 0;
+}
diff --git a/util/libeay.num b/util/libeay.num
index edeb50d..9933499 100755
--- a/util/libeay.num
+++ b/util/libeay.num
@@ -4573,3 +4573,17 @@ PKCS5_pbe2_set_scrypt                   4931	EXIST::FUNCTION:
 PKCS8_set0_pbe                          4932	EXIST::FUNCTION:
 DH_bits                                 4933	EXIST::FUNCTION:DH
 RSA_bits                                4934	EXIST::FUNCTION:RSA
+CRYPTO_set_secure_mem_ex_functions      4935	EXIST::FUNCTION:
+CRYPTO_secure_allocated                 4936	EXIST::FUNCTION:
+BN_CTX_secure_new                       4937	EXIST::FUNCTION:
+CRYPTO_secure_malloc                    4938	EXIST::FUNCTION:
+CRYPTO_secure_malloc_done               4939	EXIST::FUNCTION:
+BUF_MEM_new_ex                          4940	EXIST::FUNCTION:
+CRYPTO_secure_malloc_initialized        4941	EXIST::FUNCTION:
+CRYPTO_secure_malloc_init               4942	EXIST::FUNCTION:
+CRYPTO_get_secure_mem_functions         4943	EXIST::FUNCTION:
+BN_secure_new                           4944	EXIST::FUNCTION:
+CRYPTO_secure_free                      4945	EXIST::FUNCTION:
+BIO_s_secmem                            4946	EXIST::FUNCTION:
+CRYPTO_get_secure_mem_ex_functions      4947	EXIST::FUNCTION:
+CRYPTO_set_secure_mem_functions         4948	EXIST::FUNCTION:

From steve at openssl.org  Tue Jun 23 21:44:23 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Tue, 23 Jun 2015 21:44:23 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435095863.763046.1553.nullmailer@dev.openssl.org>

The branch master has been updated
       via  a16ca4e8aeef1178ce013569058afcec1f6ac77c (commit)
       via  547dba74f3c07a5d3bdac3e6436207061d781118 (commit)
       via  52f782698df6970e0b56373c3fb4e357f2deb04f (commit)
       via  c72382048f8e6bfea1fbe1b2e25a0423182bb4f0 (commit)
       via  124037fdc0571b5bd9022412348e9979a1726a31 (commit)
      from  74924dcb3802640d7e2ae2e80ca6515d0a53de7a (commit)


- Log -----------------------------------------------------------------
commit a16ca4e8aeef1178ce013569058afcec1f6ac77c
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Mon Jun 22 14:03:08 2015 +0100

    Fix PSK client handling.
    
    The PSK identity hint should be stored in the SSL_SESSION structure
    and not in the parent context (which will overwrite values used
    by other SSL structures with the same SSL_CTX).
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit 547dba74f3c07a5d3bdac3e6436207061d781118
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 17 14:47:53 2015 +0100

    Add PSK GCM ciphersuites from RFC5487
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit 52f782698df6970e0b56373c3fb4e357f2deb04f
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 17 14:47:27 2015 +0100

    PSK trace keyex fixes.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit c72382048f8e6bfea1fbe1b2e25a0423182bb4f0
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Sat Jun 20 15:44:03 2015 +0100

    Avoid duplication.
    
    We always free the handshake buffer when digests are freed so move
    it into ssl_free_digest_list()
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit 124037fdc0571b5bd9022412348e9979a1726a31
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Tue Jun 16 14:44:29 2015 +0100

    Tidy up ssl3_digest_cached_records logic.
    
    Rewrite ssl3_digest_cached_records handling. Only digest cached records
    if digest array is NULL: this means it is safe to call
    ssl3_digest_cached_records multiple times (subsequent calls are no op).
    
    Remove flag TLS1_FLAGS_KEEP_HANDSHAKE instead only update handshake buffer
    if digest array is NULL.
    
    Add additional "keep" parameter to ssl3_digest_cached_records to indicate
    if the handshake buffer should be retained after digesting cached records
    (needed for TLS 1.2 client authentication).
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 include/openssl/ssl3.h |  1 -
 include/openssl/tls1.h |  8 ++++++
 ssl/d1_srvr.c          |  9 +++----
 ssl/s3_clnt.c          | 51 ++++++++----------------------------
 ssl/s3_enc.c           | 71 ++++++++++++++++++++++++++------------------------
 ssl/s3_lib.c           | 37 +++++++++++++++++++++++---
 ssl/s3_srvr.c          | 32 +++++++++--------------
 ssl/ssl_locl.h         |  2 +-
 ssl/t1_enc.c           | 28 ++++++++------------
 ssl/t1_trce.c          | 14 ++++++++++
 10 files changed, 131 insertions(+), 122 deletions(-)

diff --git a/include/openssl/ssl3.h b/include/openssl/ssl3.h
index 138b80c..d56105e 100644
--- a/include/openssl/ssl3.h
+++ b/include/openssl/ssl3.h
@@ -365,7 +365,6 @@ extern "C" {
 /* Removed from OpenSSL 1.1.0 */
 # define TLS1_FLAGS_TLS_PADDING_BUG              0x0
 # define TLS1_FLAGS_SKIP_CERT_VERIFY             0x0010
-# define TLS1_FLAGS_KEEP_HANDSHAKE               0x0020
 /*
  * Set when the handshake is ready to process peer's ChangeCipherSpec message.
  * Cleared after the message has been processed.
diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h
index 40205e1..a172af3 100644
--- a/include/openssl/tls1.h
+++ b/include/openssl/tls1.h
@@ -480,6 +480,10 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 # define TLS1_CK_ADH_WITH_AES_128_GCM_SHA256             0x030000A6
 # define TLS1_CK_ADH_WITH_AES_256_GCM_SHA384             0x030000A7
 
+/* TLS v1.2 PSK GCM ciphersuites from RFC5487 */
+# define TLS1_CK_PSK_WITH_AES_128_GCM_SHA256             0x030000A8
+# define TLS1_CK_PSK_WITH_AES_256_GCM_SHA384             0x030000A9
+
 /* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */
 # define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256                0x030000BA
 # define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256             0x030000BB
@@ -736,6 +740,10 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 # define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256       "ECDH-RSA-AES128-GCM-SHA256"
 # define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384       "ECDH-RSA-AES256-GCM-SHA384"
 
+/* TLS v1.2 PSK GCM ciphersuites from RFC5487 */
+# define TLS1_TXT_PSK_WITH_AES_128_GCM_SHA256            "PSK-AES128-GCM-SHA256"
+# define TLS1_TXT_PSK_WITH_AES_256_GCM_SHA384            "PSK-AES256-GCM-SHA384"
+
 /* Camellia-CBC ciphersuites from RFC6367 */
 # define TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 "ECDHE-ECDSA-CAMELLIA128-SHA256"
 # define TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 "ECDHE-ECDSA-CAMELLIA256-SHA384"
diff --git a/ssl/d1_srvr.c b/ssl/d1_srvr.c
index dfdc573..7a40d66 100644
--- a/ssl/d1_srvr.c
+++ b/ssl/d1_srvr.c
@@ -640,12 +640,9 @@ int dtls1_accept(SSL *s)
                  * For sigalgs freeze the handshake buffer. If we support
                  * extms we've done this already.
                  */
-                if (!(s->s3->flags & SSL_SESS_FLAG_EXTMS)) {
-                    s->s3->flags |= TLS1_FLAGS_KEEP_HANDSHAKE;
-                    if (!ssl3_digest_cached_records(s)) {
-                        s->state = SSL_ST_ERR;
-                        return -1;
-                    }
+                if (!ssl3_digest_cached_records(s, 1)) {
+                    s->state = SSL_ST_ERR;
+                    return -1;
                 }
             } else {
                 s->state = SSL3_ST_SR_CERT_VRFY_A;
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 6b4c860..f912f2c 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1168,7 +1168,7 @@ int ssl3_get_server_hello(SSL *s)
      * Don't digest cached records if no sigalgs: we may need them for client
      * authentication.
      */
-    if (!SSL_USE_SIGALGS(s) && !ssl3_digest_cached_records(s))
+    if (!SSL_USE_SIGALGS(s) && !ssl3_digest_cached_records(s, 0))
         goto f_err;
     /* lets get the compression algorithm */
     /* COMPRESSION */
@@ -1431,17 +1431,7 @@ int ssl3_get_key_exchange(SSL *s)
             al = SSL_AD_UNEXPECTED_MESSAGE;
             goto f_err;
         }
-#ifndef OPENSSL_NO_PSK
-        /*
-         * In plain PSK ciphersuite, ServerKeyExchange can be omitted if no
-         * identity hint is sent. Set session->sess_cert anyway to avoid
-         * problems later.
-         */
-        if (alg_k & SSL_kPSK) {
-            OPENSSL_free(s->ctx->psk_identity_hint);
-            s->ctx->psk_identity_hint = NULL;
-        }
-#endif
+
         s->s3->tmp.reuse_message = 1;
         return (1);
     }
@@ -1504,9 +1494,9 @@ int ssl3_get_key_exchange(SSL *s)
          */
         memcpy(tmp_id_hint, p, i);
         memset(tmp_id_hint + i, 0, PSK_MAX_IDENTITY_LEN + 1 - i);
-        OPENSSL_free(s->ctx->psk_identity_hint);
-        s->ctx->psk_identity_hint = BUF_strdup(tmp_id_hint);
-        if (s->ctx->psk_identity_hint == NULL) {
+        OPENSSL_free(s->session->psk_identity_hint);
+        s->session->psk_identity_hint = BUF_strdup(tmp_id_hint);
+        if (s->session->psk_identity_hint == NULL) {
             al = SSL_AD_HANDSHAKE_FAILURE;
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
             goto f_err;
@@ -2030,10 +2020,8 @@ int ssl3_get_certificate_request(SSL *s)
          * If we get here we don't need any cached handshake records as we
          * wont be doing client auth.
          */
-        if (s->s3->handshake_buffer) {
-            if (!ssl3_digest_cached_records(s))
-                goto err;
-        }
+        if (!ssl3_digest_cached_records(s, 0))
+            goto err;
         return (1);
     }
 
@@ -2832,7 +2820,7 @@ int ssl3_send_client_key_exchange(SSL *s)
             if (!pms)
                 goto memerr;
 
-            psk_len = s->psk_client_callback(s, s->ctx->psk_identity_hint,
+            psk_len = s->psk_client_callback(s, s->session->psk_identity_hint,
                                              identity, sizeof(identity) - 1,
                                              pms, pmslen);
             if (psk_len > PSK_MAX_PSK_LEN) {
@@ -2861,16 +2849,6 @@ int ssl3_send_client_key_exchange(SSL *s)
             t += psk_len;
             s2n(psk_len, t);
 
-            OPENSSL_free(s->session->psk_identity_hint);
-            s->session->psk_identity_hint =
-                BUF_strdup(s->ctx->psk_identity_hint);
-            if (s->ctx->psk_identity_hint != NULL
-                && s->session->psk_identity_hint == NULL) {
-                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
-                       ERR_R_MALLOC_FAILURE);
-                goto psk_err;
-            }
-
             OPENSSL_free(s->session->psk_identity);
             s->session->psk_identity = BUF_strdup(identity);
             if (s->session->psk_identity == NULL) {
@@ -3026,15 +3004,8 @@ int ssl3_send_client_verify(SSL *s)
             }
             s2n(u, p);
             n = u + 4;
-            /*
-             * For extended master secret we've already digested cached
-             * records.
-             */
-            if (s->session->flags & SSL_SESS_FLAG_EXTMS) {
-                BIO_free(s->s3->handshake_buffer);
-                s->s3->handshake_buffer = NULL;
-                s->s3->flags &= ~TLS1_FLAGS_KEEP_HANDSHAKE;
-            } else if (!ssl3_digest_cached_records(s))
+            /* Digest cached records and discard handshake buffer */
+            if (!ssl3_digest_cached_records(s, 0))
                 goto err;
         } else
 #ifndef OPENSSL_NO_RSA
@@ -3216,7 +3187,7 @@ int ssl3_send_client_certificate(SSL *s)
                 return (1);
             } else {
                 s->s3->tmp.cert_req = 2;
-                if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s)) {
+                if (!ssl3_digest_cached_records(s, 0)) {
                     ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
                     s->state = SSL_ST_ERR;
                     return 0;
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index bde19e1..02e07ba 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -476,15 +476,21 @@ void ssl3_cleanup_key_block(SSL *s)
 
 void ssl3_init_finished_mac(SSL *s)
 {
-    BIO_free(s->s3->handshake_buffer);
     ssl3_free_digest_list(s);
     s->s3->handshake_buffer = BIO_new(BIO_s_mem());
     (void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
 }
 
+/*
+ * Free digest list. Also frees handshake buffer since they are always freed
+ * together.
+ */
+
 void ssl3_free_digest_list(SSL *s)
 {
     int i;
+    BIO_free(s->s3->handshake_buffer);
+    s->s3->handshake_buffer = NULL;
     if (!s->s3->handshake_dgst)
         return;
     for (i = 0; i < SSL_MAX_DIGEST; i++) {
@@ -497,8 +503,7 @@ void ssl3_free_digest_list(SSL *s)
 
 void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
 {
-    if (s->s3->handshake_buffer
-        && !(s->s3->flags & TLS1_FLAGS_KEEP_HANDSHAKE)) {
+    if (s->s3->handshake_dgst == NULL) {
         BIO_write(s->s3->handshake_buffer, (void *)buf, len);
     } else {
         int i;
@@ -509,7 +514,7 @@ void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
     }
 }
 
-int ssl3_digest_cached_records(SSL *s)
+int ssl3_digest_cached_records(SSL *s, int keep)
 {
     int i;
     long mask;
@@ -517,38 +522,37 @@ int ssl3_digest_cached_records(SSL *s)
     long hdatalen;
     void *hdata;
 
-    /* Allocate handshake_dgst array */
-    ssl3_free_digest_list(s);
-    s->s3->handshake_dgst =
-        OPENSSL_malloc(sizeof(*s->s3->handshake_dgst) * SSL_MAX_DIGEST);
     if (s->s3->handshake_dgst == NULL) {
-        SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_MALLOC_FAILURE);
-        return 0;
-    }
-    memset(s->s3->handshake_dgst, 0,
-           sizeof(*s->s3->handshake_dgst) * SSL_MAX_DIGEST);
-    hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
-    if (hdatalen <= 0) {
-        SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, SSL_R_BAD_HANDSHAKE_LENGTH);
-        return 0;
-    }
+        /* Allocate handshake_dgst array */
+        s->s3->handshake_dgst =
+            OPENSSL_malloc(sizeof(*s->s3->handshake_dgst) * SSL_MAX_DIGEST);
+        if (s->s3->handshake_dgst == NULL) {
+            SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_MALLOC_FAILURE);
+            return 0;
+        }
+        hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
+        if (hdatalen <= 0) {
+            SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, SSL_R_BAD_HANDSHAKE_LENGTH);
+            return 0;
+        }
 
-    /* Loop through bitso of algorithm2 field and create MD_CTX-es */
-    for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++) {
-        if ((mask & ssl_get_algorithm2(s)) && md) {
-            s->s3->handshake_dgst[i] = EVP_MD_CTX_create();
-            if (EVP_MD_nid(md) == NID_md5) {
-                EVP_MD_CTX_set_flags(s->s3->handshake_dgst[i],
-                                     EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+        /* Loop through bits of algorithm2 field and create MD_CTX-es */
+        for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++) {
+            if ((mask & ssl_get_algorithm2(s)) && md) {
+                s->s3->handshake_dgst[i] = EVP_MD_CTX_create();
+                if (EVP_MD_nid(md) == NID_md5) {
+                    EVP_MD_CTX_set_flags(s->s3->handshake_dgst[i],
+                                         EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+                }
+                EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL);
+                EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata, hdatalen);
+            } else {
+                s->s3->handshake_dgst[i] = NULL;
             }
-            EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL);
-            EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata, hdatalen);
-        } else {
-            s->s3->handshake_dgst[i] = NULL;
         }
+
     }
-    if (!(s->s3->flags & TLS1_FLAGS_KEEP_HANDSHAKE)) {
-        /* Free handshake_buffer BIO */
+    if (keep == 0) {
         BIO_free(s->s3->handshake_buffer);
         s->s3->handshake_buffer = NULL;
     }
@@ -588,9 +592,8 @@ static int ssl3_handshake_mac(SSL *s, int md_nid,
     unsigned char md_buf[EVP_MAX_MD_SIZE];
     EVP_MD_CTX ctx, *d = NULL;
 
-    if (s->s3->handshake_buffer)
-        if (!ssl3_digest_cached_records(s))
-            return 0;
+    if (!ssl3_digest_cached_records(s, 0))
+        return 0;
 
     /*
      * Search for digest of specified type in the handshake_dgst array
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 6febd4e..0550471 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -1612,6 +1612,40 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl3_ciphers[] = {
      256,
      256,
      },
+#ifndef OPENSSL_NO_PSK
+    /* Cipher A8 */
+    {
+     1,
+     TLS1_TXT_PSK_WITH_AES_128_GCM_SHA256,
+     TLS1_CK_PSK_WITH_AES_128_GCM_SHA256,
+     SSL_kPSK,
+     SSL_aPSK,
+     SSL_AES128GCM,
+     SSL_AEAD,
+     SSL_TLSV1_2,
+     SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
+     SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
+     128,
+     128,
+     },
+
+    /* Cipher A9 */
+    {
+     1,
+     TLS1_TXT_PSK_WITH_AES_256_GCM_SHA384,
+     TLS1_CK_PSK_WITH_AES_256_GCM_SHA384,
+     SSL_kPSK,
+     SSL_aPSK,
+     SSL_AES256GCM,
+     SSL_AEAD,
+     SSL_TLSV1_2,
+     SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
+     SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
+     256,
+     256,
+     },
+
+#endif
 
 #ifndef OPENSSL_NO_CAMELLIA
     /* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */
@@ -2911,7 +2945,6 @@ void ssl3_free(SSL *s)
     OPENSSL_free(s->s3->tmp.ciphers_raw);
     OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen);
     OPENSSL_free(s->s3->tmp.peer_sigalgs);
-    BIO_free(s->s3->handshake_buffer);
     ssl3_free_digest_list(s);
     OPENSSL_free(s->s3->alpn_selected);
 
@@ -2955,8 +2988,6 @@ void ssl3_clear(SSL *s)
 #endif                         /* !OPENSSL_NO_EC */
 
     init_extra = s->s3->init_extra;
-    BIO_free(s->s3->handshake_buffer);
-    s->s3->handshake_buffer = NULL;
     ssl3_free_digest_list(s);
 
     if (s->s3->alpn_selected) {
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index b98beac..203e894 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -507,11 +507,9 @@ int ssl3_accept(SSL *s)
                 skip = 1;
                 s->s3->tmp.cert_request = 0;
                 s->state = SSL3_ST_SW_SRVR_DONE_A;
-                if (s->s3->handshake_buffer) {
-                    if (!ssl3_digest_cached_records(s)) {
-                        s->state = SSL_ST_ERR;
-                        return -1;
-                    }
+                if (!ssl3_digest_cached_records(s, 0)) {
+                    s->state = SSL_ST_ERR;
+                    return -1;
                 }
             } else {
                 s->s3->tmp.cert_request = 1;
@@ -598,14 +596,11 @@ int ssl3_accept(SSL *s)
                 }
                 /*
                  * For sigalgs freeze the handshake buffer. If we support
-                 * extms we've done this already.
+                 * extms we've done this already so this is a no-op
                  */
-                if (!(s->s3->flags & SSL_SESS_FLAG_EXTMS)) {
-                    s->s3->flags |= TLS1_FLAGS_KEEP_HANDSHAKE;
-                    if (!ssl3_digest_cached_records(s)) {
-                        s->state = SSL_ST_ERR;
-                        return -1;
-                    }
+                if (!ssl3_digest_cached_records(s, 1)) {
+                    s->state = SSL_ST_ERR;
+                    return -1;
                 }
             } else {
                 int offset = 0;
@@ -620,11 +615,9 @@ int ssl3_accept(SSL *s)
                  * CertificateVerify should be generalized. But it is next
                  * step
                  */
-                if (s->s3->handshake_buffer) {
-                    if (!ssl3_digest_cached_records(s)) {
-                        s->state = SSL_ST_ERR;
-                        return -1;
-                    }
+                if (!ssl3_digest_cached_records(s, 0)) {
+                    s->state = SSL_ST_ERR;
+                    return -1;
                 }
                 for (dgst_num = 0; dgst_num < SSL_MAX_DIGEST; dgst_num++)
                     if (s->s3->handshake_dgst[dgst_num]) {
@@ -1538,7 +1531,7 @@ int ssl3_get_client_hello(SSL *s)
     }
 
     if (!SSL_USE_SIGALGS(s) || !(s->verify_mode & SSL_VERIFY_PEER)) {
-        if (!ssl3_digest_cached_records(s))
+        if (!ssl3_digest_cached_records(s, 0))
             goto f_err;
     }
 
@@ -3055,7 +3048,6 @@ int ssl3_get_cert_verify(SSL *s)
  end:
     BIO_free(s->s3->handshake_buffer);
     s->s3->handshake_buffer = NULL;
-    s->s3->flags &= ~TLS1_FLAGS_KEEP_HANDSHAKE;
     EVP_MD_CTX_cleanup(&mctx);
     EVP_PKEY_free(pkey);
     return (ret);
@@ -3163,7 +3155,7 @@ int ssl3_get_client_certificate(SSL *s)
             goto f_err;
         }
         /* No client certificate so digest cached records */
-        if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s)) {
+        if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s, 0)) {
             al = SSL_AD_INTERNAL_ERROR;
             goto f_err;
         }
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index f1046c5..8f8d997 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -1922,7 +1922,7 @@ void ssl3_free_digest_list(SSL *s);
 __owur unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk);
 __owur SSL_CIPHER *ssl3_choose_cipher(SSL *ssl, STACK_OF(SSL_CIPHER) *clnt,
                                STACK_OF(SSL_CIPHER) *srvr);
-__owur int ssl3_digest_cached_records(SSL *s);
+__owur int ssl3_digest_cached_records(SSL *s, int keep);
 __owur int ssl3_new(SSL *s);
 void ssl3_free(SSL *s);
 __owur int ssl3_accept(SSL *s);
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index e865341..9942bb4 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -679,9 +679,8 @@ int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out)
     EVP_MD_CTX ctx, *d = NULL;
     int i;
 
-    if (s->s3->handshake_buffer)
-        if (!ssl3_digest_cached_records(s))
-            return 0;
+    if (!ssl3_digest_cached_records(s, 0))
+        return 0;
 
     for (i = 0; i < SSL_MAX_DIGEST; i++) {
         if (s->s3->handshake_dgst[i]
@@ -709,9 +708,8 @@ int tls1_final_finish_mac(SSL *s, const char *str, int slen,
     unsigned char hash[2 * EVP_MAX_MD_SIZE];
     unsigned char buf2[12];
 
-    if (s->s3->handshake_buffer)
-        if (!ssl3_digest_cached_records(s))
-            return 0;
+    if (!ssl3_digest_cached_records(s, 0))
+        return 0;
 
     hashlen = ssl_handshake_hash(s, hash, sizeof(hash));
 
@@ -736,17 +734,13 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
     if (s->session->flags & SSL_SESS_FLAG_EXTMS) {
         unsigned char hash[EVP_MAX_MD_SIZE * 2];
         int hashlen;
-        /* If we don't have any digests cache records */
-        if (s->s3->handshake_buffer) {
-            /*
-             * keep record buffer: this wont affect client auth because we're
-             * freezing the buffer at the same point (after client key
-             * exchange and before certificate verify)
-             */
-            s->s3->flags |= TLS1_FLAGS_KEEP_HANDSHAKE;
-            if (!ssl3_digest_cached_records(s))
-                return -1;
-        }
+        /* Digest cached records keeping record buffer (if present):
+         * this wont affect client auth because we're freezing the buffer
+         * at the same point (after client key exchange and before certificate
+         * verify)
+         */
+        if (!ssl3_digest_cached_records(s, 1))
+            return -1;
         hashlen = ssl_handshake_hash(s, hash, sizeof(hash));
 #ifdef SSL_DEBUG
         fprintf(stderr, "Handshake hashes:\n");
diff --git a/ssl/t1_trce.c b/ssl/t1_trce.c
index 97170cd..40c5beb 100644
--- a/ssl/t1_trce.c
+++ b/ssl/t1_trce.c
@@ -986,6 +986,13 @@ static int ssl_print_client_keyex(BIO *bio, int indent, SSL *ssl,
         if (!ssl_print_hexbuf(bio, indent + 2, "ecdh_Yc", 1, &msg, &msglen))
             return 0;
         break;
+
+    case SSL_kPSK:
+        if (!ssl_print_hexbuf(bio, indent + 2,
+                              "psk_identity", 2, &msg, &msglen))
+            return 0;
+        break;
+
     }
 
     return 1;
@@ -1049,6 +1056,13 @@ static int ssl_print_server_keyex(BIO *bio, int indent, SSL *ssl,
                 return 0;
         }
         break;
+
+    case SSL_kPSK:
+        if (!ssl_print_hexbuf(bio, indent + 2,
+                              "psk_identity_hint", 2, &msg, &msglen))
+            return 0;
+        /* No signature */
+        return 1;
     }
     return ssl_print_signature(bio, indent, ssl, &msg, &msglen);
 }

From rsalz at openssl.org  Tue Jun 23 22:40:25 2015
From: rsalz at openssl.org (Rich Salz)
Date: Tue, 23 Jun 2015 22:40:25 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435099225.469485.19863.nullmailer@dev.openssl.org>

The branch master has been updated
       via  d4dfb0baf9d112ff4bdecf996348808bf806bb5f (commit)
      from  a16ca4e8aeef1178ce013569058afcec1f6ac77c (commit)


- Log -----------------------------------------------------------------
commit d4dfb0baf9d112ff4bdecf996348808bf806bb5f
Author: Rich Salz <rsalz at akamai.com>
Date:   Tue Jun 23 18:33:02 2015 -0400

    Fix windows build
    
    Move #include's inside the #ifdef.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/sec_mem.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/crypto/sec_mem.c b/crypto/sec_mem.c
index ea9523b..5bf8baa 100644
--- a/crypto/sec_mem.c
+++ b/crypto/sec_mem.c
@@ -12,13 +12,13 @@
  */
 #include <openssl/crypto.h>
 #include <e_os.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <assert.h>
 
 #if defined(OPENSSL_SYS_LINUX) || defined(OPENSSL_SYS_UNIX)
 # define IMPLEMENTED
+# include <stdlib.h>
+# include <string.h>
+# include <assert.h>
+# include <unistd.h>
 # include <sys/mman.h>
 # include <sys/param.h>
 #endif

From steve at openssl.org  Wed Jun 24 21:22:07 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Wed, 24 Jun 2015 21:22:07 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435180927.233544.10209.nullmailer@dev.openssl.org>

The branch master has been updated
       via  77672802a665b26a44524a7a8091e56ee84bdf39 (commit)
      from  d4dfb0baf9d112ff4bdecf996348808bf806bb5f (commit)


- Log -----------------------------------------------------------------
commit 77672802a665b26a44524a7a8091e56ee84bdf39
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 17 15:51:41 2015 +0100

    Add docs for ssl verification parameter functions.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 doc/ssl/SSL_CTX_get0_param.pod | 55 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 doc/ssl/SSL_CTX_get0_param.pod

diff --git a/doc/ssl/SSL_CTX_get0_param.pod b/doc/ssl/SSL_CTX_get0_param.pod
new file mode 100644
index 0000000..332f181
--- /dev/null
+++ b/doc/ssl/SSL_CTX_get0_param.pod
@@ -0,0 +1,55 @@
+=pod
+
+=head1 NAME
+
+SSL_CTX_get0_param, SSL_get0_param, SSL_CTX_set1_param, SSL_set1_param -
+get and set verification parameters
+
+=head1 SYNOPSIS
+
+ #include <openssl/ssl.h>
+
+ X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx)
+ X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl)
+ int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm)
+ int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
+
+=head1 DESCRIPTION
+
+SSL_CTX_get0_param() and SSL_get0_param() retrieve an internal pointer to
+the verification parameters for B<ctx> or B<ssl> respectively. The returned
+pointer must not be freed by the calling application.
+
+SSL_CTX_set1_param() and SSL_set1_param() set the verification parameters
+to B<vpm> for B<ctx> or B<ssl>.
+
+=head1 NOTES
+
+Typically parameters are retrieved from an B<SSL_CTX> or B<SSL> structure
+using SSL_CTX_get0_param() or SSL_get0_param() and an application modifies
+them to suit its needs: for example to add a hostname check.
+
+=head1 EXAMPLE
+
+Check hostname matches "www.foo.com" in peer certificate:
+
+ X509_VERIFY_PARAM *vpm = SSL_get0_param(ssl);
+ X509_VERIFY_PARAM_set1_host(vpm, "www.foo.com");
+
+=head1 RETURN VALUES
+
+SSL_CTX_get0_param() and SSL_get0_param() return a pointer to an
+B<X509_VERIFY_PARAM> structure.
+
+SSL_CTX_set1_param() and SSL_set1_param() return 1 for success and 0
+for failure.
+
+=head1 SEE ALSO
+
+L<X509_VERIFY_PARAM_set_flags(3)|X509_VERIFY_PARAM_set_flags(3)>
+
+=head1 HISTORY
+
+These functions were first added to OpenSSL 1.0.2.
+
+=cut

From steve at openssl.org  Wed Jun 24 21:22:42 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Wed, 24 Jun 2015 21:22:42 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435180962.028311.13467.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  edbc9050bed04de0f2cdbfd0f038a84007263c66 (commit)
      from  c00206c3269d75013ea3e41dec76d6b179502036 (commit)


- Log -----------------------------------------------------------------
commit edbc9050bed04de0f2cdbfd0f038a84007263c66
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 17 15:51:41 2015 +0100

    Add docs for ssl verification parameter functions.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 77672802a665b26a44524a7a8091e56ee84bdf39)

-----------------------------------------------------------------------

Summary of changes:
 doc/ssl/SSL_CTX_get0_param.pod | 55 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 doc/ssl/SSL_CTX_get0_param.pod

diff --git a/doc/ssl/SSL_CTX_get0_param.pod b/doc/ssl/SSL_CTX_get0_param.pod
new file mode 100644
index 0000000..332f181
--- /dev/null
+++ b/doc/ssl/SSL_CTX_get0_param.pod
@@ -0,0 +1,55 @@
+=pod
+
+=head1 NAME
+
+SSL_CTX_get0_param, SSL_get0_param, SSL_CTX_set1_param, SSL_set1_param -
+get and set verification parameters
+
+=head1 SYNOPSIS
+
+ #include <openssl/ssl.h>
+
+ X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx)
+ X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl)
+ int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm)
+ int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
+
+=head1 DESCRIPTION
+
+SSL_CTX_get0_param() and SSL_get0_param() retrieve an internal pointer to
+the verification parameters for B<ctx> or B<ssl> respectively. The returned
+pointer must not be freed by the calling application.
+
+SSL_CTX_set1_param() and SSL_set1_param() set the verification parameters
+to B<vpm> for B<ctx> or B<ssl>.
+
+=head1 NOTES
+
+Typically parameters are retrieved from an B<SSL_CTX> or B<SSL> structure
+using SSL_CTX_get0_param() or SSL_get0_param() and an application modifies
+them to suit its needs: for example to add a hostname check.
+
+=head1 EXAMPLE
+
+Check hostname matches "www.foo.com" in peer certificate:
+
+ X509_VERIFY_PARAM *vpm = SSL_get0_param(ssl);
+ X509_VERIFY_PARAM_set1_host(vpm, "www.foo.com");
+
+=head1 RETURN VALUES
+
+SSL_CTX_get0_param() and SSL_get0_param() return a pointer to an
+B<X509_VERIFY_PARAM> structure.
+
+SSL_CTX_set1_param() and SSL_set1_param() return 1 for success and 0
+for failure.
+
+=head1 SEE ALSO
+
+L<X509_VERIFY_PARAM_set_flags(3)|X509_VERIFY_PARAM_set_flags(3)>
+
+=head1 HISTORY
+
+These functions were first added to OpenSSL 1.0.2.
+
+=cut

From steve at openssl.org  Thu Jun 25 03:55:37 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Thu, 25 Jun 2015 03:55:37 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435204537.894195.15682.nullmailer@dev.openssl.org>

The branch master has been updated
       via  ffbf304d4832bd51bb0618f8ca5b7c26647ee664 (commit)
      from  77672802a665b26a44524a7a8091e56ee84bdf39 (commit)


- Log -----------------------------------------------------------------
commit ffbf304d4832bd51bb0618f8ca5b7c26647ee664
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 24 12:28:50 2015 +0100

    Don't output bogus errors in PKCS12_parse
    
    PR#3923
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/pkcs12/p12_kiss.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c
index a70fe72..fdddffb 100644
--- a/crypto/pkcs12/p12_kiss.c
+++ b/crypto/pkcs12/p12_kiss.c
@@ -135,10 +135,12 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 
     while ((x = sk_X509_pop(ocerts))) {
         if (pkey && *pkey && cert && !*cert) {
+            ERR_set_mark();
             if (X509_check_private_key(x, *pkey)) {
                 *cert = x;
                 x = NULL;
             }
+            ERR_pop_to_mark();
         }
 
         if (ca && x) {

From steve at openssl.org  Thu Jun 25 03:57:01 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Thu, 25 Jun 2015 03:57:01 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_0-stable update
Message-ID: <1435204621.774573.17331.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_0-stable has been updated
       via  989ba38f7fa27e567612ab717975c82215c591ba (commit)
      from  c040acd76a8918768aea560750937845f1e031e7 (commit)


- Log -----------------------------------------------------------------
commit 989ba38f7fa27e567612ab717975c82215c591ba
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 24 12:28:50 2015 +0100

    Don't output bogus errors in PKCS12_parse
    
    PR#3923
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit ffbf304d4832bd51bb0618f8ca5b7c26647ee664)

-----------------------------------------------------------------------

Summary of changes:
 crypto/pkcs12/p12_kiss.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c
index ee476c3..9aa3c90 100644
--- a/crypto/pkcs12/p12_kiss.c
+++ b/crypto/pkcs12/p12_kiss.c
@@ -135,10 +135,12 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 
     while ((x = sk_X509_pop(ocerts))) {
         if (pkey && *pkey && cert && !*cert) {
+            ERR_set_mark();
             if (X509_check_private_key(x, *pkey)) {
                 *cert = x;
                 x = NULL;
             }
+            ERR_pop_to_mark();
         }
 
         if (ca && x) {

From steve at openssl.org  Thu Jun 25 03:57:01 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Thu, 25 Jun 2015 03:57:01 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1435204621.832190.17353.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  0d25eb7800cbb2e845b4f38e3c78df437d68ad7c (commit)
      from  ae2f46597a01f3e7042493d09bd0559028bb5699 (commit)


- Log -----------------------------------------------------------------
commit 0d25eb7800cbb2e845b4f38e3c78df437d68ad7c
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 24 12:28:50 2015 +0100

    Don't output bogus errors in PKCS12_parse
    
    PR#3923
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit ffbf304d4832bd51bb0618f8ca5b7c26647ee664)

-----------------------------------------------------------------------

Summary of changes:
 crypto/pkcs12/p12_kiss.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c
index ee476c3..9aa3c90 100644
--- a/crypto/pkcs12/p12_kiss.c
+++ b/crypto/pkcs12/p12_kiss.c
@@ -135,10 +135,12 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 
     while ((x = sk_X509_pop(ocerts))) {
         if (pkey && *pkey && cert && !*cert) {
+            ERR_set_mark();
             if (X509_check_private_key(x, *pkey)) {
                 *cert = x;
                 x = NULL;
             }
+            ERR_pop_to_mark();
         }
 
         if (ca && x) {

From steve at openssl.org  Thu Jun 25 03:57:01 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Thu, 25 Jun 2015 03:57:01 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435204621.882884.17374.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  7c1dae55d476d94c96db68de20670c1066d281b3 (commit)
      from  edbc9050bed04de0f2cdbfd0f038a84007263c66 (commit)


- Log -----------------------------------------------------------------
commit 7c1dae55d476d94c96db68de20670c1066d281b3
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 24 12:28:50 2015 +0100

    Don't output bogus errors in PKCS12_parse
    
    PR#3923
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (cherry picked from commit ffbf304d4832bd51bb0618f8ca5b7c26647ee664)

-----------------------------------------------------------------------

Summary of changes:
 crypto/pkcs12/p12_kiss.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c
index ee476c3..9aa3c90 100644
--- a/crypto/pkcs12/p12_kiss.c
+++ b/crypto/pkcs12/p12_kiss.c
@@ -135,10 +135,12 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 
     while ((x = sk_X509_pop(ocerts))) {
         if (pkey && *pkey && cert && !*cert) {
+            ERR_set_mark();
             if (X509_check_private_key(x, *pkey)) {
                 *cert = x;
                 x = NULL;
             }
+            ERR_pop_to_mark();
         }
 
         if (ca && x) {

From steve at openssl.org  Thu Jun 25 11:58:09 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Thu, 25 Jun 2015 11:58:09 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435233489.209911.17333.nullmailer@dev.openssl.org>

The branch master has been updated
       via  13cbe5e711528da65753ad526ad69de406250402 (commit)
      from  ffbf304d4832bd51bb0618f8ca5b7c26647ee664 (commit)


- Log -----------------------------------------------------------------
commit 13cbe5e711528da65753ad526ad69de406250402
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Thu Jun 25 04:05:07 2015 +0100

    missing break
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/s_client.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/s_client.c b/apps/s_client.c
index f82f9db..559cf70 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -888,6 +888,7 @@ int s_client_main(int argc, char **argv)
                 BIO_printf(bio_err, "Not a hex number '%s'\n", psk_key);
                 goto end;
             }
+            break;
 #else
         case OPT_PSK_IDENTITY:
         case OPT_PSK:

From kurt at openssl.org  Sun Jun 28 16:24:08 2015
From: kurt at openssl.org (Kurt Roeckx)
Date: Sun, 28 Jun 2015 16:24:08 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435508648.185365.29141.nullmailer@dev.openssl.org>

The branch master has been updated
       via  7f098cb4360a2677aab741ffc661964c501dd51e (commit)
       via  03a1c85062b44d9d9aa0ab5808c4f93b3516071c (commit)
      from  13cbe5e711528da65753ad526ad69de406250402 (commit)


- Log -----------------------------------------------------------------
commit 7f098cb4360a2677aab741ffc661964c501dd51e
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Jun 20 16:46:33 2015 +0200

    Check dgram_sctp_write() return value.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 03a1c85062b44d9d9aa0ab5808c4f93b3516071c
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Jun 20 16:28:08 2015 +0200

    Check BIO_dgram_sctp_wait_for_dry() return value for error
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bio/bss_dgram.c | 53 +++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 42 insertions(+), 11 deletions(-)

diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c
index 3f6cd50..dabfea3 100644
--- a/crypto/bio/bss_dgram.c
+++ b/crypto/bio/bss_dgram.c
@@ -1219,9 +1219,13 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
                      * it can be sent now.
                      */
                     if (data->saved_message.length > 0) {
-                        dgram_sctp_write(data->saved_message.bio,
+                        i = dgram_sctp_write(data->saved_message.bio,
                                          data->saved_message.data,
                                          data->saved_message.length);
+                        if (i < 0) {
+                            ret = i;
+                            break;
+                        }
                         OPENSSL_free(data->saved_message.data);
                         data->saved_message.data = NULL;
                         data->saved_message.length = 0;
@@ -1366,6 +1370,14 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
     return (ret);
 }
 
+/*
+ * dgram_sctp_write - send message on SCTP socket
+ * @b: BIO to write to
+ * @in: data to send
+ * @inl: amount of bytes in @in to send
+ *
+ * Returns -1 on error or the sent amount of bytes on success
+ */
 static int dgram_sctp_write(BIO *b, const char *in, int inl)
 {
     int ret;
@@ -1404,18 +1416,24 @@ static int dgram_sctp_write(BIO *b, const char *in, int inl)
      * If we have to send a shutdown alert message and the socket is not dry
      * yet, we have to save it and send it as soon as the socket gets dry.
      */
-    if (data->save_shutdown && !BIO_dgram_sctp_wait_for_dry(b)) {
-        char *tmp;
-        data->saved_message.bio = b;
-        if ((tmp = OPENSSL_malloc(inl)) == NULL) {
-            BIOerr(BIO_F_DGRAM_SCTP_WRITE, ERR_R_MALLOC_FAILURE);
+    if (data->save_shutdown) {
+        ret = BIO_dgram_sctp_wait_for_dry(b);
+        if (ret < 0) {
             return -1;
         }
-        OPENSSL_free(data->saved_message.data);
-        data->saved_message.data = tmp;
-        memcpy(data->saved_message.data, in, inl);
-        data->saved_message.length = inl;
-        return inl;
+        if (ret == 0) {
+            char *tmp;
+            data->saved_message.bio = b;
+            if ((tmp = OPENSSL_malloc(inl)) == NULL) {
+                BIOerr(BIO_F_DGRAM_SCTP_WRITE, ERR_R_MALLOC_FAILURE);
+                return -1;
+            }
+            OPENSSL_free(data->saved_message.data);
+            data->saved_message.data = tmp;
+            memcpy(data->saved_message.data, in, inl);
+            data->saved_message.length = inl;
+            return inl;
+        }
     }
 
     iov[0].iov_base = (char *)in;
@@ -1733,6 +1751,19 @@ int BIO_dgram_sctp_notification_cb(BIO *b,
     return 0;
 }
 
+/*
+ * BIO_dgram_sctp_wait_for_dry - Wait for SCTP SENDER_DRY event
+ * @b: The BIO to check for the dry event
+ *
+ * Wait until the peer confirms all packets have been received, and so that
+ * our kernel doesn't have anything to send anymore.  This is only received by
+ * the peer's kernel, not the application.
+ *
+ * Returns:
+ * -1 on error
+ *  0 when not dry yet
+ *  1 when dry
+ */
 int BIO_dgram_sctp_wait_for_dry(BIO *b)
 {
     int is_dry = 0;

From steve at openssl.org  Mon Jun 29 11:08:30 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 29 Jun 2015 11:08:30 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435576110.395246.22237.nullmailer@dev.openssl.org>

The branch master has been updated
       via  b34f691ddbf618978ed9e97a0b9209937c1da26e (commit)
       via  57b272b01a9843c7e034feba7bfde5eaecc8bdb0 (commit)
      from  7f098cb4360a2677aab741ffc661964c501dd51e (commit)


- Log -----------------------------------------------------------------
commit b34f691ddbf618978ed9e97a0b9209937c1da26e
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Thu Jun 25 15:06:14 2015 +0100

    make update
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

commit 57b272b01a9843c7e034feba7bfde5eaecc8bdb0
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Wed Jun 17 04:10:04 2015 +0100

    Use single master secret generation function.
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 include/openssl/ssl.h |  2 --
 ssl/s3_clnt.c         | 16 +++------------
 ssl/s3_lib.c          | 15 ++++++++++++++
 ssl/s3_srvr.c         | 56 ++++++++++-----------------------------------------
 ssl/ssl_locl.h        |  4 ++++
 ssl/tls_srp.c         | 13 ++++--------
 util/ssleay.num       |  8 ++++----
 7 files changed, 41 insertions(+), 73 deletions(-)

diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index cd932e5..3027617 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -636,9 +636,7 @@ __owur int SSL_CTX_SRP_CTX_init(SSL_CTX *ctx);
 int SSL_SRP_CTX_free(SSL *ctx);
 int SSL_CTX_SRP_CTX_free(SSL_CTX *ctx);
 __owur int SSL_srp_server_param_with_username(SSL *s, int *ad);
-__owur int SRP_generate_server_master_secret(SSL *s, unsigned char *master_key);
 __owur int SRP_Calc_A_param(SSL *s);
-__owur int SRP_generate_client_master_secret(SSL *s, unsigned char *master_key);
 
 # endif
 
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index f912f2c..1a925a7 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2891,13 +2891,10 @@ int ssl3_send_client_key_exchange(SSL *s)
     if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) {
         /*
          * If everything written generate master key: no need to save PMS as
-         * SRP_generate_client_master_secret generates it internally.
+         * srp_generate_client_master_secret generates it internally.
          */
         if (n > 0) {
-            if ((s->session->master_key_length =
-                 SRP_generate_client_master_secret(s,
-                                                   s->session->master_key)) <
-                0) {
+            if (!srp_generate_client_master_secret(s)) {
                 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
                        ERR_R_INTERNAL_ERROR);
                 goto err;
@@ -2920,14 +2917,7 @@ int ssl3_send_client_key_exchange(SSL *s)
             SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
             goto err;
         }
-        s->session->master_key_length =
-            s->method->ssl3_enc->generate_master_secret(s,
-                                                        s->
-                                                        session->master_key,
-                                                        pms, pmslen);
-        OPENSSL_clear_free(pms, pmslen);
-        s->s3->tmp.pms = NULL;
-        if (s->session->master_key_length < 0) {
+        if (!ssl_generate_master_secret(s, pms, pmslen, 1)) {
             ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
             SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto err;
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 0550471..54c902d 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -4291,3 +4291,18 @@ int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, int len)
     } else
         return RAND_bytes(result, len);
 }
+
+int ssl_generate_master_secret(SSL *s, unsigned char *pms, size_t pmslen,
+                               int free_pms)
+{
+    s->session->master_key_length =
+        s->method->ssl3_enc->generate_master_secret(s, s->session->master_key,
+                                                    pms, pmslen);
+    if (free_pms)
+        OPENSSL_clear_free(pms, pmslen);
+    else
+        OPENSSL_cleanse(pms, pmslen);
+    if (s->server == 0)
+        s->s3->tmp.pms = NULL;
+    return s->session->master_key_length >= 0;
+}
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 203e894..cbe80eb 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2381,15 +2381,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                                           rand_premaster_secret[j]);
         }
 
-        s->session->master_key_length =
-            s->method->ssl3_enc->generate_master_secret(s,
-                                                        s->
-                                                        session->master_key,
-                                                        p,
-                                                        sizeof
-                                                        (rand_premaster_secret));
-        OPENSSL_cleanse(p, sizeof(rand_premaster_secret));
-        if (s->session->master_key_length < 0) {
+        if (!ssl_generate_master_secret(s, p, sizeof(rand_premaster_secret), 0)) {
             al = SSL_AD_INTERNAL_ERROR;
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto f_err;
@@ -2480,13 +2472,7 @@ int ssl3_get_client_key_exchange(SSL *s)
         else
             BN_clear_free(pub);
         pub = NULL;
-        s->session->master_key_length =
-            s->method->ssl3_enc->generate_master_secret(s,
-                                                        s->
-                                                        session->master_key,
-                                                        p, i);
-        OPENSSL_cleanse(p, i);
-        if (s->session->master_key_length < 0) {
+        if (!ssl_generate_master_secret(s, p, i, 0)) {
             al = SSL_AD_INTERNAL_ERROR;
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto f_err;
@@ -2618,15 +2604,7 @@ int ssl3_get_client_key_exchange(SSL *s)
         EC_KEY_free(s->s3->tmp.ecdh);
         s->s3->tmp.ecdh = NULL;
 
-        /* Compute the master secret */
-        s->session->master_key_length =
-            s->method->ssl3_enc->generate_master_secret(s,
-                                                        s->
-                                                        session->master_key,
-                                                        p, i);
-
-        OPENSSL_cleanse(p, i);
-        if (s->session->master_key_length < 0) {
+        if (!ssl_generate_master_secret(s, p, i, 0)) {
             al = SSL_AD_INTERNAL_ERROR;
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto f_err;
@@ -2707,22 +2685,17 @@ int ssl3_get_client_key_exchange(SSL *s)
             goto psk_err;
         }
 
-        s->session->master_key_length =
-            s->method->ssl3_enc->generate_master_secret(s,
-                                                        s->
-                                                        session->master_key,
-                                                        psk_or_pre_ms,
-                                                        pre_ms_len);
-        if (s->session->master_key_length < 0) {
+        if (!ssl_generate_master_secret(s, psk_or_pre_ms, pre_ms_len, 0)) {
             al = SSL_AD_INTERNAL_ERROR;
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
-            goto psk_err;
+            goto f_err;
         }
         psk_err = 0;
  psk_err:
-        OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
-        if (psk_err != 0)
+        if (psk_err != 0) {
+            OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
             goto f_err;
+        }
     } else
 #endif
 #ifndef OPENSSL_NO_SRP
@@ -2755,9 +2728,7 @@ int ssl3_get_client_key_exchange(SSL *s)
             goto err;
         }
 
-        if ((s->session->master_key_length =
-             SRP_generate_server_master_secret(s,
-                                               s->session->master_key)) < 0) {
+        if (!srp_generate_server_master_secret(s)) {
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto err;
         }
@@ -2813,13 +2784,8 @@ int ssl3_get_client_key_exchange(SSL *s)
             goto gerr;
         }
         /* Generate master secret */
-        s->session->master_key_length =
-            s->method->ssl3_enc->generate_master_secret(s,
-                                                        s->
-                                                        session->master_key,
-                                                        premaster_secret, 32);
-        OPENSSL_cleanse(premaster_secret, sizeof(premaster_secret));
-        if (s->session->master_key_length < 0) {
+        if (!ssl_generate_master_secret(s, premaster_secret,
+                                        sizeof(premaster_secret), 0)) {
             al = SSL_AD_INTERNAL_ERROR;
             SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
             goto f_err;
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 8f8d997..3507d9a 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -1890,6 +1890,8 @@ __owur STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
 __owur int ssl_verify_alarm_type(long type);
 void ssl_load_ciphers(void);
 __owur int ssl_fill_hello_random(SSL *s, int server, unsigned char *field, int len);
+__owur int ssl_generate_master_secret(SSL *s, unsigned char *pms, size_t pmslen,
+                                      int free_pms);
 
 __owur const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
 __owur int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
@@ -2159,6 +2161,8 @@ void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
                            EVP_MD_CTX *mac_ctx, const unsigned char *data,
                            size_t data_len, size_t orig_len);
 
+__owur int srp_generate_server_master_secret(SSL *s);
+__owur int srp_generate_client_master_secret(SSL *s);
 __owur int srp_verify_server_param(SSL *s, int *al);
 
 /* t1_ext.c */
diff --git a/ssl/tls_srp.c b/ssl/tls_srp.c
index 6bd7845..91b88cd 100644
--- a/ssl/tls_srp.c
+++ b/ssl/tls_srp.c
@@ -332,7 +332,7 @@ int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
     return 1;
 }
 
-int SRP_generate_server_master_secret(SSL *s, unsigned char *master_key)
+int srp_generate_server_master_secret(SSL *s)
 {
     BIGNUM *K = NULL, *u = NULL;
     int ret = -1, tmp_len = 0;
@@ -350,17 +350,15 @@ int SRP_generate_server_master_secret(SSL *s, unsigned char *master_key)
     if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)
         goto err;
     BN_bn2bin(K, tmp);
-    ret = s->method->ssl3_enc->generate_master_secret(s, master_key, tmp,
-                                                      tmp_len);
+    ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
  err:
-    OPENSSL_clear_free(tmp, tmp_len);
     BN_clear_free(K);
     BN_clear_free(u);
     return ret;
 }
 
 /* client side */
-int SRP_generate_client_master_secret(SSL *s, unsigned char *master_key)
+int srp_generate_client_master_secret(SSL *s)
 {
     BIGNUM *x = NULL, *u = NULL, *K = NULL;
     int ret = -1, tmp_len = 0;
@@ -391,11 +389,8 @@ int SRP_generate_client_master_secret(SSL *s, unsigned char *master_key)
     if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)
         goto err;
     BN_bn2bin(K, tmp);
-    ret =
-        s->method->ssl3_enc->generate_master_secret(s, master_key, tmp,
-                                                    tmp_len);
+    ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
  err:
-    OPENSSL_clear_free(tmp, tmp_len);
     BN_clear_free(K);
     BN_clear_free(x);
     OPENSSL_clear_free(passwd, strlen(passwd));
diff --git a/util/ssleay.num b/util/ssleay.num
index 1441be7..ddaf306 100755
--- a/util/ssleay.num
+++ b/util/ssleay.num
@@ -286,11 +286,11 @@ SSL_CTX_set_srp_username                329	EXIST::FUNCTION:SRP
 SSL_CTX_SRP_CTX_init                    330	EXIST::FUNCTION:SRP
 SSL_SRP_CTX_init                        331	EXIST::FUNCTION:SRP
 SRP_Calc_A_param                        332	EXIST::FUNCTION:SRP
-SRP_generate_server_master_secret       333	EXIST:!VMS:FUNCTION:SRP
-SRP_gen_server_master_secret            333	EXIST:VMS:FUNCTION:SRP
+SRP_gen_server_master_secret            333	NOEXIST::FUNCTION:
+SRP_generate_server_master_secret       333	NOEXIST::FUNCTION:
 SSL_CTX_SRP_CTX_free                    334	EXIST::FUNCTION:SRP
-SRP_generate_client_master_secret       335	EXIST:!VMS:FUNCTION:SRP
-SRP_gen_client_master_secret            335	EXIST:VMS:FUNCTION:SRP
+SRP_gen_client_master_secret            335	NOEXIST::FUNCTION:
+SRP_generate_client_master_secret       335	NOEXIST::FUNCTION:
 SSL_srp_server_param_with_username      336	EXIST:!VMS:FUNCTION:SRP
 SSL_srp_server_param_with_un            336	EXIST:VMS:FUNCTION:SRP
 SRP_have_to_put_srp_username            337	NOEXIST::FUNCTION:

From steve at openssl.org  Mon Jun 29 18:21:07 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 29 Jun 2015 18:21:07 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435602067.800095.9698.nullmailer@dev.openssl.org>

The branch master has been updated
       via  5fced2395ddfb603a50fd1bd87411e603a59dc6f (commit)
      from  b34f691ddbf618978ed9e97a0b9209937c1da26e (commit)


- Log -----------------------------------------------------------------
commit 5fced2395ddfb603a50fd1bd87411e603a59dc6f
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Thu Jun 25 15:07:25 2015 +0100

    Check for errors with SRP
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/testssl b/test/testssl
index dd89204..81b8a93 100644
--- a/test/testssl
+++ b/test/testssl
@@ -236,16 +236,16 @@ if ../util/shlib_wrap.sh ../apps/openssl no-srp; then
   echo skipping SRP tests
 else
   echo test tls1 with SRP
-  $ssltest -tls1 -cipher SRP -srpuser test -srppass abc123
+  $ssltest -tls1 -cipher SRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP via BIO pair
-  $ssltest -bio_pair -tls1 -cipher SRP -srpuser test -srppass abc123
+  $ssltest -bio_pair -tls1 -cipher SRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP auth
-  $ssltest -tls1 -cipher aSRP -srpuser test -srppass abc123
+  $ssltest -tls1 -cipher aSRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP auth via BIO pair
-  $ssltest -bio_pair -tls1 -cipher aSRP -srpuser test -srppass abc123
+  $ssltest -bio_pair -tls1 -cipher aSRP -srpuser test -srppass abc123 || exit 1
 fi
 
 #############################################################################

From steve at openssl.org  Mon Jun 29 18:22:45 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 29 Jun 2015 18:22:45 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_1-stable update
Message-ID: <1435602165.040569.10605.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_1-stable has been updated
       via  eb0e2a5c5d904c3f74a9387d27bfbad4861469a9 (commit)
      from  0d25eb7800cbb2e845b4f38e3c78df437d68ad7c (commit)


- Log -----------------------------------------------------------------
commit eb0e2a5c5d904c3f74a9387d27bfbad4861469a9
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Thu Jun 25 15:07:25 2015 +0100

    Check for errors with SRP
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 5fced2395ddfb603a50fd1bd87411e603a59dc6f)

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/testssl b/test/testssl
index d5b1c9a..261097b 100644
--- a/test/testssl
+++ b/test/testssl
@@ -198,16 +198,16 @@ if ../util/shlib_wrap.sh ../apps/openssl no-srp; then
   echo skipping SRP tests
 else
   echo test tls1 with SRP
-  $ssltest -tls1 -cipher SRP -srpuser test -srppass abc123
+  $ssltest -tls1 -cipher SRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP via BIO pair
-  $ssltest -bio_pair -tls1 -cipher SRP -srpuser test -srppass abc123
+  $ssltest -bio_pair -tls1 -cipher SRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP auth
-  $ssltest -tls1 -cipher aSRP -srpuser test -srppass abc123
+  $ssltest -tls1 -cipher aSRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP auth via BIO pair
-  $ssltest -bio_pair -tls1 -cipher aSRP -srpuser test -srppass abc123
+  $ssltest -bio_pair -tls1 -cipher aSRP -srpuser test -srppass abc123 || exit 1
 fi
 
 exit 0

From steve at openssl.org  Mon Jun 29 18:22:45 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Mon, 29 Jun 2015 18:22:45 +0000
Subject: [openssl-commits] [openssl]  OpenSSL_1_0_2-stable update
Message-ID: <1435602165.117402.10627.nullmailer@dev.openssl.org>

The branch OpenSSL_1_0_2-stable has been updated
       via  f8f75a7e4a7746caba9cab843e14ed6a41dfad21 (commit)
      from  7c1dae55d476d94c96db68de20670c1066d281b3 (commit)


- Log -----------------------------------------------------------------
commit f8f75a7e4a7746caba9cab843e14ed6a41dfad21
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Thu Jun 25 15:07:25 2015 +0100

    Check for errors with SRP
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 5fced2395ddfb603a50fd1bd87411e603a59dc6f)

-----------------------------------------------------------------------

Summary of changes:
 test/testssl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/testssl b/test/testssl
index c3461b0..747e4ba 100644
--- a/test/testssl
+++ b/test/testssl
@@ -253,16 +253,16 @@ if ../util/shlib_wrap.sh ../apps/openssl no-srp; then
   echo skipping SRP tests
 else
   echo test tls1 with SRP
-  $ssltest -tls1 -cipher SRP -srpuser test -srppass abc123
+  $ssltest -tls1 -cipher SRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP via BIO pair
-  $ssltest -bio_pair -tls1 -cipher SRP -srpuser test -srppass abc123
+  $ssltest -bio_pair -tls1 -cipher SRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP auth
-  $ssltest -tls1 -cipher aSRP -srpuser test -srppass abc123
+  $ssltest -tls1 -cipher aSRP -srpuser test -srppass abc123 || exit 1
 
   echo test tls1 with SRP auth via BIO pair
-  $ssltest -bio_pair -tls1 -cipher aSRP -srpuser test -srppass abc123
+  $ssltest -bio_pair -tls1 -cipher aSRP -srpuser test -srppass abc123 || exit 1
 fi
 
 #############################################################################

From steve at openssl.org  Tue Jun 30 13:21:12 2015
From: steve at openssl.org (Dr. Stephen Henson)
Date: Tue, 30 Jun 2015 13:21:12 +0000
Subject: [openssl-commits] [openssl]  master update
Message-ID: <1435670472.142507.4788.nullmailer@dev.openssl.org>

The branch master has been updated
       via  36f038f1041f9f31878f75b567959ceae08eb34e (commit)
      from  5fced2395ddfb603a50fd1bd87411e603a59dc6f (commit)


- Log -----------------------------------------------------------------
commit 36f038f1041f9f31878f75b567959ceae08eb34e
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Tue Jun 30 13:58:25 2015 +0100

    Dup peer_chain properly in SSL_SESSION
    
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 03c6ac0..9063bca 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -268,6 +268,12 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     if (src->peer != NULL)
         CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
 
+    if (src->peer_chain != NULL) {
+        dest->peer_chain = X509_chain_up_ref(src->peer_chain);
+        if (dest->peer_chain == NULL)
+            goto err;
+    }
+
 #ifndef OPENSSL_NO_PSK
     if (src->psk_identity_hint) {
         dest->psk_identity_hint = BUF_strdup(src->psk_identity_hint);