Missed a couple of spots in the update change

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 6f45032f6730622e8d484d92e07c7fce7d1f88ac)

Conflicts:
apps/Makefile

Fix the update target and remove duplicate file updates

We had updates of certain header files in both Makefile.org and the
Makefile in the directory the header file lived in.  This is error
prone and also sometimes generates slightly different results (usually
just a comment that differs) depending on which way the update was
done.

This removes the file update targets from the top level Makefile, adds
an update: target in all Makefiles and has it depend on the depend: or
local_depend: targets, whichever is appropriate, so we don't get a
double run through the whole file tree.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 0f539dc1a2f45580435c39dada44dd276e79cb88)

Conflicts:
Makefile.org
apps/Makefile
test/Makefile
crypto/cmac/Makefile
crypto/srp/Makefile

Fix off-by-one in BN_rand

If BN_rand is called with |bits| set to 1 and |top| set to 1 then a 1 byte
buffer overflow can occur. There are no such instances within the OpenSSL at
the moment.

Thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke, Filip Palian for
discovering and reporting this issue.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Reject negative shifts for BN_rshift and BN_lshift

The functions BN_rshift and BN_lshift shift their arguments to the right or
left by a specified number of bits. Unpredicatable results (including
crashes) can occur if a negative number is supplied for the shift value.

Thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke and Filip Palian
for discovering and reporting this issue.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 7cc18d8158b5fc2676393d99b51c30c135502107)

Conflicts:
crypto/bn/bn.h
crypto/bn/bn_err.c

GitHub284: Fix typo in xx-32.pl scripts.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Don't add write errors into bytecounts

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 00d565cfbe90fab3b157e644caca4eb4a2ebec79)

Add NULL checks from master

The big "don't check for NULL" cleanup requires backporting some
of the lowest-level functions to actually do nothing if NULL is
given.  This will make it easier to backport fixes to release
branches, where master assumes those lower-level functions are "safe"

This commit addresses those tickets: 3798 3799 3801.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit f34b095fab1569d093b639bfcc9a77d6020148ff)

RT3820: Don't call GetDesktopWindow()

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit bed2edf1cb73f1fe2c11029acc694086bc14443e)

Limit depth of nested sequences when generating ASN.1

Reported by Hanno Böck <hanno@hboeck.de>
PR#3800

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit c4137b5e828d8fab0b244defb79257619dad8fc7)

Conflicts:
crypto/asn1/asn1_gen.c

Fix CRYPTO_strdup

The function CRYPTO_strdup (aka OPENSSL_strdup) fails to check the return
value from CRYPTO_malloc to see if it is NULL before attempting to use it.
This patch adds a NULL check.

RT3786

Signed-off-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 37b0cf936744d9edb99b5dd82cae78a7eac6ad60)

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 20d21389c8b6f5b754573ffb6a4dc4f3986f2ca4)

Fix encoding bug in i2c_ASN1_INTEGER

Fix bug where i2c_ASN1_INTEGER mishandles zero if it is marked as
negative.

Thanks to Huzaifa Sidhpurwala <huzaifas@redhat.com> and
Hanno Böck <hanno@hboeck.de> for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit a0eed48d37a4b7beea0c966caf09ad46f4a92a44)

Code style: space after 'if'

Reviewed-by: Matt Caswell <gitlab@openssl.org>

Reject empty generation strings.

Reported by Hanno Böck <hanno@hboeck.de>

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 111b60bea01d234b5873488c19ff2b9c5d4d58e9)

Conflicts:
crypto/asn1/asn1_gen.c

Fix ssl_get_prev_session overrun

If OpenSSL is configured with no-tlsext then ssl_get_prev_session can read
past the end of the ClientHello message if the session_id length in the
ClientHello is invalid. This should not cause any security issues since the
underlying buffer is 16k in size. It should never be possible to overrun by
that many bytes.

This is probably made redundant by the previous commit - but you can never be
too careful.

With thanks to Qinghao Tang for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 5e0a80c1c9b2b06c2d203ad89778ce1b98e0b5ad)

Conflicts:
ssl/ssl_sess.c

Check for ClientHello message overruns

The ClientHello processing is insufficiently rigorous in its checks to make
sure that we don't read past the end of the message. This does not have
security implications due to the size of the underlying buffer - but still
needs to be fixed.

With thanks to Qinghao Tang for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit c9642eb1ff79a30e2c7632ef8267cc34cc2b0d79)

Don't set *pval to NULL in ASN1_item_ex_new.

While *pval is usually a pointer in rare circumstances it can be a long
value. One some platforms (e.g. WIN64) where
sizeof(long) < sizeof(ASN1_VALUE *) this will write past the field.

*pval is initialised correctly in the rest of ASN1_item_ex_new so setting it
to NULL is unecessary anyway.

Thanks to Julien Kauffmann for reporting this issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit f617b4969a9261b9d7d381670aefbe2cf766a2cb)

Conflicts:
crypto/asn1/tasn_new.c

Make OCSP response verification more flexible.

If a set of certificates is supplied to OCSP_basic_verify use those in
addition to any present in the OCSP response as untrusted CAs when
verifying a certificate chain.

PR#3668

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 4ca5efc2874e094d6382b30416824eda6dde52fe)

Prepare for 1.0.0s-dev

Reviewed-by: Richard Levitte <levitte@openssl.org>

Prepare for 1.0.0r release

Reviewed-by: Richard Levitte <levitte@openssl.org>

make update

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix unsigned/signed warnings

Fix some unsigned/signed warnings introduced as part of the fix
for CVE-2015-0293

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix a failure to NULL a pointer freed on error.

Reported by the LibreSSL project as a follow on to CVE-2015-0209

Reviewed-by: Richard Levitte <levitte@openssl.org>

Update NEWS file

Update the NEWS file with the latest entries from CHANGES ready for the
release.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Update CHANGES for release

Update CHANGES fiel with all the latest fixes ready for the release.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove overlapping CHANGES/NEWS entries

Remove entries from CHANGES and NEWS from letter releases that occur *after*
the next point release. Without this we get duplicate entries for the same
issue appearing multiple times.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix reachable assert in SSLv2 servers.

This assert is reachable for servers that support SSLv2 and export ciphers.
Therefore, such servers can be DoSed by sending a specially crafted
SSLv2 CLIENT-MASTER-KEY.

Also fix s2_srvr.c to error out early if the key lengths are malformed.
These lengths are sent unencrypted, so this does not introduce an oracle.

CVE-2015-0293

This issue was discovered by Sean Burford (Google) and Emilia Käsper of
the OpenSSL development team.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

PKCS#7: avoid NULL pointer dereferences with missing content

In PKCS#7, the ASN.1 content component is optional.
This typically applies to inner content (detached signatures),
however we must also handle unexpected missing outer content
correctly.

This patch only addresses functions reachable from parsing,
decryption and verification, and functions otherwise associated
with reading potentially untrusted data.

Correcting all low-level API calls requires further work.

CVE-2015-0289

Thanks to Michal Zalewski (Google) for reporting this issue.

Reviewed-by: Steve Henson <steve@openssl.org>

Fix ASN1_TYPE_cmp

Fix segmentation violation when ASN1_TYPE_cmp is passed a boolean type. This
can be triggered during certificate verification so could be a DoS attack
against a client or a server enabling client authentication.

CVE-2015-0286

Reviewed-by: Richard Levitte <levitte@openssl.org>

Free up ADB and CHOICE if already initialised.

CVE-2015-0287

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

ASN.1 print fix.

When printing out an ASN.1 structure if the type is an item template don't
fall thru and attempt to interpret as a primitive type.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 5dc1247a7494f50c88ce7492518bbe0ce6f124fa)

Cleanse buffers

Cleanse various intermediate buffers used by the PRF (backported version
from master).

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 35fafc4dbc0b3a717ad1b208fe2867e8c64867de)

Conflicts:
ssl/s3_enc.c

Conflicts:
ssl/t1_enc.c

update ordinals

Reviewed-by: Matt Caswell <matt@openssl.org>

fix warning

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit d6ca1cee8b6efac5906ac66443d1ca67fe689ff8)

Conflicts:
ssl/ssl_locl.h

Fix warnings.

Fix compiler warnings (similar to commit 25012d5e79)

Reviewed-by: Richard Levitte <levitte@openssl.org>

Cleanse PKCS#8 private key components.

New function ASN1_STRING_clear_free which cleanses an ASN1_STRING
structure before freeing it.

Call ASN1_STRING_clear_free on PKCS#8 private key components.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit a8ae0891d4bfd18f224777aed1fbb172504421f1)

Conflicts:
crypto/dh/dh_ameth.c

Remove export ciphers from the DEFAULT cipher list

They are moved to the COMPLEMENTOFDEFAULT instead.
This also fixes SSLv2 to be part of COMPLEMENTOFDEFAULT.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit bc2e18a3c818ae7e2d8c996b6648aa4ae8e3ee28)

Update mkerr.pl for new format

Make the output from mkerr.pl consistent with the newly reformatted code.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Check public key is not NULL.

CVE-2015-0288
PR#3708

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 28a00bcd8e318da18031b2ac8778c64147cd54f9)

Fix format script.

The format script didn't correctly recognise some ASN.1 macros and
didn't reformat some files as a result. Fix script and reformat
affected files.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 437b14b533fe7f7408e3ebca6d5569f1d3347b1a)

Fix a failure to NULL a pointer freed on error.

Inspired by BoringSSL commit 517073cd4b by Eric Roman <eroman@chromium.org>

CVE-2015-0209

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Document -no_explicit

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 384dee51242e950c56b3bac32145957bfbf3cd4b)

Bring objects.pl output even closer to new format.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 849037169d98d070c27d094ac341fc6aca1ed2ca)

Harmonize objects.pl output with new format.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 7ce38623194f6df6a846cd01753b63f361c88e57)

Fix error handling in ssltest

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit ae632974f905c59176fa5f312826f8f692890b67)

Fixed bad formatting in crypto/des/spr.h

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 7e35f06ea908e47f87b723b5e951ffc55463eb8b)

Make objxref.pl output in correct format

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 6922ddee1b7b1bddbe0d59a5bbdcf8ff39343434)

Check PKCS#8 pkey field is valid before cleansing.

PR:3683
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 52e028b9de371da62c1e51b46592517b1068d770)

Fix for reformat problems with e_padlock.c

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit d3b7cac41b957704932a0cdbc74d4d48ed507cd0)

Fix formatting error in pem.h

Reviewed-by: Andy Polyakov <appro@openssl.org>
Conflicts:
crypto/pem/pem.h

Re-align some comments after running the reformat script.
This should be a one off operation (subsequent invokation of the
script should not move them)

This commit is for the 1.0.0 changes

Reviewed-by: Tim Hudson <tjh@openssl.org>

Rerun util/openssl-format-source -v -c .

Reviewed-by: Tim Hudson <tjh@openssl.org>

Run util/openssl-format-source -v -c .

Reviewed-by: Tim Hudson <tjh@openssl.org>

Yet more changes to comments

Reviewed-by: Tim Hudson <tjh@openssl.org>

More tweaks for comments due indent issues

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix modes.h so that indent doesn't complain

Conflicts:
crypto/modes/modes.h

Conflicts:
crypto/modes/modes.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Backport hw_ibmca.c from master due to failed merge

Reviewed-by: Tim Hudson <tjh@openssl.org>

Tweaks for comments due to indent's inability to handle them

Reviewed-by: Tim Hudson <tjh@openssl.org>

Move more comments that confuse indent

Conflicts:
crypto/dsa/dsa.h
demos/engines/ibmca/hw_ibmca.c
ssl/ssl_locl.h

Conflicts:
crypto/bn/rsaz_exp.c
crypto/evp/e_aes_cbc_hmac_sha1.c
crypto/evp/e_aes_cbc_hmac_sha256.c
ssl/ssl_locl.h

Conflicts:
crypto/ec/ec2_oct.c
crypto/ec/ecp_nistp256.c
crypto/ec/ecp_nistp521.c
crypto/ec/ecp_nistputil.c
crypto/ec/ecp_oct.c
crypto/modes/gcm128.c
ssl/ssl_locl.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Delete trailing whitespace from output.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add -d debug option to save preprocessed files.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Test option -nc

Add option -nc which sets COMMENTS=true but disables all indent comment
reformatting options.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add ecp_nistz256.c to list of files skipped by openssl-format-source

Reviewed-by: Tim Hudson <tjh@openssl.org>

Manually reformat aes_x86core.c and add it to the list of files skipped by
openssl-format-source

Conflicts:
crypto/aes/aes_x86core.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

crypto/ofb128.c: make it indent-friendly.

Reviewed-by: Tim Hudson <tjh@openssl.org>

modes/ctr128.c: make it indent-friendly.

Reviewed-by: Tim Hudson <tjh@openssl.org>

modes/cfb128.c: make it indent-friendly.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix indent comment corruption issue

Reviewed-by: Tim Hudson <tjh@openssl.org>

Amend openssl-format-source so that it give more repeatable output

Reviewed-by: Tim Hudson <tjh@openssl.org>

bn/bn_const.c: make it indent-friendly.

Reviewed-by: Tim Hudson <tjh@openssl.org>

bn/asm/x86_64-gcc.cL make it indent-friendly.

Conflicts:
crypto/bn/asm/x86_64-gcc.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

bn/bn_asm.c: make it indent-friendly.

Conflicts:
crypto/bn/bn_asm.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

bn/bn_exp.c: make it indent-friendly.

Conflicts:
crypto/bn/bn_exp.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

Manually reformat aes_core.c
Add aes_core.c to the list of files not processed by openssl-format-source

Conflicts:
crypto/aes/aes_core.c

Conflicts:
crypto/aes/aes_core.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add obj_dat.h to the list of files that will not be processed by
openssl-format-source

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix strange formatting by indent

Conflicts:
crypto/hmac/hmac.h

Conflicts:
crypto/evp/e_aes_cbc_hmac_sha256.c

Conflicts:
crypto/ec/ecp_nistp224.c
crypto/ec/ecp_nistp256.c
crypto/ec/ecp_nistp521.c
crypto/ec/ectest.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

indent has problems with comments that are on the right hand side of a line.
Sometimes it fails to format them very well, and sometimes it corrupts them!
This commit moves some particularly problematic ones.

Conflicts:
crypto/bn/bn.h
crypto/ec/ec_lcl.h
crypto/rsa/rsa.h
demos/engines/ibmca/hw_ibmca.c
ssl/ssl.h
ssl/ssl3.h

Conflicts:
crypto/ec/ec_lcl.h
ssl/tls1.h

Conflicts:
crypto/ec/ecp_nistp224.c
crypto/evp/evp.h
ssl/d1_both.c
ssl/ssl.h
ssl/ssl_lib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

modes/cts128.c: make it indent-friendly.

Reviewed-by: Tim Hudson <tjh@openssl.org>

crypto/mem_dbg.c: make it indent-friendly.

Reviewed-by: Tim Hudson <tjh@openssl.org>

More indent fixes for STACK_OF

Conflicts:
ssl/s3_lib.c

Conflicts:
apps/cms.c
crypto/x509/x509_lu.c
crypto/x509/x509_vfy.h
ssl/s3_lib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix indent issue with functions using STACK_OF

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix indent issue with engine.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix logic to check for indent.pro

Reviewed-by: Tim Hudson <tjh@openssl.org>

crypto/cryptlib.c: make it indent-friendly.

Conflicts:
crypto/cryptlib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

bn/bntest.c: make it indent-friendly.

Conflicts:
crypto/bn/bntest.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

bn/bn_recp.c: make it indent-friendly.

Reviewed-by: Tim Hudson <tjh@openssl.org>

engines/e_ubsec.c: make it indent-friendly.

Reviewed-by: Tim Hudson <tjh@openssl.org>

apps/speed.c: make it indent-friendly.

Conflicts:
apps/speed.c

Conflicts:
apps/speed.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix make errors

Reviewed-by: Tim Hudson <tjh@openssl.org>

Make the script a little more location agnostic

Reviewed-by: Tim Hudson <tjh@openssl.org>

Provide script for filtering data initialisers for structs/unions. indent just can't handle it.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Script fixes.

Don't use double newline for headers.
Don't interpret ASN1_PCTX as start of an ASN.1 module.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Run expand before perl, to make sure things are properly aligned

Reviewed-by: Tim Hudson <tjh@openssl.org>

Force the use of our indent profile

Reviewed-by: Tim Hudson <tjh@openssl.org>

Provide source reformating script. Requires GNU indent to be
available.

Script written by Tim Hudson, with amendments by Steve Henson, Rich Salz and
Matt Caswell

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix source where indent will not be able to cope

Conflicts:
apps/ciphers.c
ssl/s3_pkt.c

Conflicts:
crypto/ec/ec_curve.c

Conflicts:
crypto/ec/ec_curve.c
ssl/s3_clnt.c
ssl/s3_srvr.c
ssl/ssl_sess.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

Additional comment changes for reformat of 1.0.0

Reviewed-by: Tim Hudson <tjh@openssl.org>

Further comment amendments to preserve formatting prior to source reformat

(cherry picked from commit 4a7fa26ffd65bf36beb8d1cb8f29fc0ae203f5c5)

Conflicts:
crypto/x509v3/pcy_tree.c

Conflicts:
apps/apps.c
ssl/ssltest.c

Conflicts:
apps/apps.c
crypto/ec/ec2_oct.c
crypto/ec/ecp_nistp224.c
crypto/ec/ecp_nistp256.c
crypto/ec/ecp_nistp521.c
ssl/s3_cbc.c
ssl/ssl_sess.c
ssl/t1_lib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

mark all block comments that need format preserving so that
indent will not alter them when reformatting comments

(cherry picked from commit 1d97c8435171a7af575f73c526d79e1ef0ee5960)

Conflicts:
crypto/bn/bn_lcl.h
crypto/bn/bn_prime.c
crypto/engine/eng_all.c
crypto/rc4/rc4_utl.c
crypto/sha/sha.h
ssl/kssl.c
ssl/t1_lib.c

Conflicts:
crypto/rc4/rc4_enc.c
crypto/x509v3/v3_scts.c
crypto/x509v3/v3nametest.c
ssl/d1_both.c
ssl/s3_srvr.c
ssl/ssl.h
ssl/ssl_locl.h
ssl/ssltest.c
ssl/t1_lib.c

Conflicts:
crypto/asn1/a_sign.c
crypto/bn/bn_div.c
crypto/dsa/dsa_asn1.c
crypto/ec/ecp_nistp224.c
crypto/ec/ecp_nistp256.c
crypto/ec/ecp_nistp521.c
crypto/ec/ecp_nistputil.c
crypto/modes/gcm128.c
crypto/opensslv.h
ssl/d1_both.c
ssl/heartbeat_test.c
ssl/s3_clnt.c
ssl/s3_srvr.c
ssl/ssl_sess.c
ssl/t1_lib.c
test/testutil.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Prepare for 1.0.0r-dev

Reviewed-by: Stephen Henson <steve@openssl.org>

Prepare for 1.0.0q release

Reviewed-by: Stephen Henson <steve@openssl.org>