summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2014-10-11obvious reallocarray() useTheo de Raadt
ok doug
2014-10-11Userland reallocarray() audit.Doug Hogan
Avoid potential integer overflow in the size argument of malloc() and realloc() by using reallocarray() to avoid unchecked multiplication. ok deraadt@
2014-10-11use reallocarray, and avoid this << 1 ugliness.Theo de Raadt
ok doug
2014-10-11Userland reallocarray() audit.Doug Hogan
Avoid potential integer overflow in the size argument of malloc() and realloc() by using reallocarray() to avoid unchecked multiplication. ok deraadt@
2014-10-11Userland reallocarray() audit.Doug Hogan
Avoid potential integer overflow in the size argument of malloc() and realloc() by using reallocarray() to avoid unchecked multiplication. ok deraadt@
2014-10-11Add UTC support to %Z conversion in strptime().Doug Hogan
Patch from jmates at ee dot washington dot edu. ok otto@, millert@
2014-10-10replace select with equiv poll usage.David Gwynne
looks good deraadt@ tweaks and ok millert@
2014-10-10Remove unnecessary includes now that we are no longer using select()Todd C. Miller
(or struct timeval). Instead, we should include time.h for the nanosleep() prototype and struct timespec. OK dlg@
2014-10-09add an API version number. ok jsingTed Unangst
2014-10-09replace the use of select() for a short sleep with nanosleep().David Gwynne
ok deraadt@ guenther@
2014-10-09use reallocarray(NULL, a, b) instead of malloc(a, b), which gives usTheo de Raadt
proper mult int overflow detection. The existing code already handles malloc failure properly, of course.
2014-10-09USE_SHLIBDIR is archaicTheo de Raadt
2014-10-08iRemove the #ifdef WIN32 implementation from libevent.Alexander Bluhm
OK nicm@
2014-10-08historyTed Unangst
2014-10-08use preferred license form. can't trust that doug guy with anything...Ted Unangst
2014-10-08mlinks, and prune some functions from man page i'm not ready for yet.Ted Unangst
2014-10-08more betterTed Unangst
2014-10-08reluctantly rename man page after a functionTed Unangst
2014-10-08whack a few stray .Pp macrosIngo Schwarze
2014-10-08add a few more functions.Ted Unangst
(I also forgot to credit doug for much of the initial markup in the previous commit.)
2014-10-08rough sketch of ressl documentationTed Unangst
2014-10-08obvious reallocarray()Theo de Raadt
2014-10-08use reallocarray() to detect multiplicative integer overflow; obviousTheo de Raadt
pattern. This commit does not fix the non-obvious bloody horror of select.c.
2014-10-08obvious realloc -> reallocarray conversionTheo de Raadt
2014-10-08obvious reallocarray()Theo de Raadt
2014-10-08using reallocarray() gives us multiplicative integer overflow checkingTheo de Raadt
in case something wants to create massive amounts of environment, like a bit more than 1/4 of a 32-bit address space. unrealistic -- but why audit one code path, and not treat others the same? then you have to re-engage everytime you see the code. read the news, that isn't what developers do. At least if the code paths look the same, there is hope, because they are easier to verify for correctness. developers need to give other developers a chance to want to care.
2014-10-08obvious conversion of realloc() to reallocarray(). Luckily this isTheo de Raadt
using pollfd, because if this was fd_set... it would not be obvious (or easy)
2014-10-08obvious reallocarray(); ok dougTheo de Raadt
2014-10-08obvious malloc -> reallocarray, for mult int oflowTheo de Raadt
2014-10-08use reallocarray(); ok dougTheo de Raadt
2014-10-08reallocarray() to detect potential int overflow; ok dougTheo de Raadt
2014-10-08reallocarray() for mult int overflow detect; ok dougTheo de Raadt
2014-10-07Use strdup() instead of malloc() + memcpy().Miod Vallat
ok doug@ jsing@
2014-10-07EC_KEY_set_group() does an EC_GROUP_dup() of its argument, so we don'tMiod Vallat
need to do it in ec_copy_parameters() prior to invoking EC_KEY_set_group(). ok doug@ jsing@
2014-10-06Remove the #ifdef HAVE_SIGACTION from libevent. The structAlexander Bluhm
evsignal_info does not change, so no library crank. OK nicm@ deraadt@
2014-10-06When verifying whether an IP address is in the commonName of aJeremie Courreges-Anglas
certificate, do not perform wildcard matching. Suggested by Richard Moore (rich@kde) ok tedu@
2014-10-06If we have to match against a wildcard in a cert, verify that it containsJeremie Courreges-Anglas
at least a domain label before the tld, as in *.example.org. Suggested by Richard Moore (rich@kde) ok tedu@
2014-10-05The fixes to X509_PURPOSE_add() in r1.18 actually could cause a globalMiod Vallat
X509_PURPOSE object (obtained with X509_PURPOSE_get0() instead of being allocated in the function) to be freed if modifying that object would fail due to a low memory condition, while this object would still be referenced elsewhere. Fix this by only cleaning the object if we did not allocate it here. While there, fail early if either `name' or `sname' are NULL, rather than allocating an object and realizing we have nothing to strdup() into it. ok guenther@
2014-10-05Be sure to check the stack push operation for success in v2i_POLICY_MAPPINGS();Miod Vallat
if it fails, free the object we were about to push. Factor error handling to avoid having four copies of about the same code. ok guenther@
2014-10-05In v2i_AUTHORITY_INFO_ACCESS(), separate object allocation from object pushMiod Vallat
on a stack; if the latter fails, we need to free the object before returning failure. ok guenther@
2014-10-05Memory leak upon error in set_dist_point_name().Miod Vallat
ok guenther@
2014-10-05Be sure to check object allocation for success before using them.Miod Vallat
Tweaks and ok guenther@
2014-10-05Missing deallocation upon error.Miod Vallat
ok deraadt@ guenther@
2014-10-05Fix memory leak in the error path of v2i_AUTHORITY_KEYID().Miod Vallat
ok deraadt@ guenther@
2014-10-05compile with c89 (code / decl ordering); from Joakim.Tjernlund@transmode.seTheo de Raadt
ok miod
2014-10-05Use more specific curves/formats naming for local variables inJoel Sing
ssl_add_clienthello_tlsext() and ssl_add_serverhello_tlsext(), rather than the current generic naming. ok miod@
2014-10-05Use tls1_get_curvelist() in ssl_add_clienthello_tlsext(), rather thanJoel Sing
hand rolling the same code. ok miod@
2014-10-05Make tls1_get_formatlist() behave the same as tls1_get_curvelist() andJoel Sing
return the client format list if the client_formats flag is specified. Use tls1_get_formatlist()/tls1_get_curvelist() in tls1_check_ec_key(), simplifying the code. ok miod@
2014-10-03verify changes are major changeTed Unangst
2014-10-03Strip trailing new-lines from syslog messages. This avoids emptyAlexander Bluhm
lines when printing to console or stderr. OK deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-12 16:21:15 +0000