Skip to content

Commit 77da06e

Browse files
janbarjanbar
committed
1.1.1m
1 parent 6f5223c commit 77da06e

File tree

173 files changed

+3172
-824
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

173 files changed

+3172
-824
lines changed

‎CHANGES

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,91 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1l and 1.1.1m [14 Dec 2021]
11+
12+
*) Avoid loading of a dynamic engine twice.
13+
14+
[Bernd Edlinger]
15+
16+
*) Fixed building on Debian with kfreebsd kernels
17+
18+
[Mattias Ellert]
19+
20+
*) Prioritise DANE TLSA issuer certs over peer certs
21+
22+
[Viktor Dukhovni]
23+
24+
*) Fixed random API for MacOS prior to 10.12
25+
26+
These MacOS versions don't support the CommonCrypto APIs
27+
28+
[Lenny Primak]
29+
30+
Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
31+
32+
*) Fixed an SM2 Decryption Buffer Overflow.
33+
34+
In order to decrypt SM2 encrypted data an application is expected to call the
35+
API function EVP_PKEY_decrypt(). Typically an application will call this
36+
function twice. The first time, on entry, the "out" parameter can be NULL and,
37+
on exit, the "outlen" parameter is populated with the buffer size required to
38+
hold the decrypted plaintext. The application can then allocate a sufficiently
39+
sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL
40+
value for the "out" parameter.
41+
42+
A bug in the implementation of the SM2 decryption code means that the
43+
calculation of the buffer size required to hold the plaintext returned by the
44+
first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
45+
the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
46+
called by the application a second time with a buffer that is too small.
47+
48+
A malicious attacker who is able present SM2 content for decryption to an
49+
application could cause attacker chosen data to overflow the buffer by up to a
50+
maximum of 62 bytes altering the contents of other data held after the
51+
buffer, possibly changing application behaviour or causing the application to
52+
crash. The location of the buffer is application dependent but is typically
53+
heap allocated.
54+
(CVE-2021-3711)
55+
[Matt Caswell]
56+
57+
*) Fixed various read buffer overruns processing ASN.1 strings
58+
59+
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING
60+
structure which contains a buffer holding the string data and a field holding
61+
the buffer length. This contrasts with normal C strings which are repesented as
62+
a buffer for the string data which is terminated with a NUL (0) byte.
63+
64+
Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's
65+
own "d2i" functions (and other similar parsing functions) as well as any string
66+
whose value has been set with the ASN1_STRING_set() function will additionally
67+
NUL terminate the byte array in the ASN1_STRING structure.
68+
69+
However, it is possible for applications to directly construct valid ASN1_STRING
70+
structures which do not NUL terminate the byte array by directly setting the
71+
"data" and "length" fields in the ASN1_STRING array. This can also happen by
72+
using the ASN1_STRING_set0() function.
73+
74+
Numerous OpenSSL functions that print ASN.1 data have been found to assume that
75+
the ASN1_STRING byte array will be NUL terminated, even though this is not
76+
guaranteed for strings that have been directly constructed. Where an application
77+
requests an ASN.1 structure to be printed, and where that ASN.1 structure
78+
contains ASN1_STRINGs that have been directly constructed by the application
79+
without NUL terminating the "data" field, then a read buffer overrun can occur.
80+
81+
The same thing can also occur during name constraints processing of certificates
82+
(for example if a certificate has been directly constructed by the application
83+
instead of loading it via the OpenSSL parsing functions, and the certificate
84+
contains non NUL terminated ASN1_STRING structures). It can also occur in the
85+
X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions.
86+
87+
If a malicious actor can cause an application to directly construct an
88+
ASN1_STRING and then process it through one of the affected OpenSSL functions
89+
then this issue could be hit. This might result in a crash (causing a Denial of
90+
Service attack). It could also result in the disclosure of private memory
91+
contents (such as private keys, or sensitive plaintext).
92+
(CVE-2021-3712)
93+
[Matt Caswell]
94+
1095
Changes between 1.1.1j and 1.1.1k [25 Mar 2021]
1196

1297
*) Fixed a problem with verifying a certificate chain when using the

‎Configurations/10-main.conf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -754,6 +754,13 @@ my %targets = (
754754
multilib => "64",
755755
},
756756

757+
# riscv64 below refers to contemporary RISCV Architecture
758+
# specifications,
759+
"linux64-riscv64" => {
760+
inherit_from => [ "linux-generic64"],
761+
perlasm_scheme => "linux64",
762+
},
763+
757764
#### IA-32 targets...
758765
#### These two targets are a bit aged and are to be used on older Linux
759766
#### machines where gcc doesn't understand -m32 and -m64

‎Configurations/15-android.conf

Lines changed: 52 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -29,18 +29,18 @@
2929
$ndk = $ENV{$ndk_var};
3030
last if defined $ndk;
3131
}
32-
die "\$ANDROID_NDK_HOME is not defined" if (!$ndk);
33-
if (!-d "$ndk/platforms" && !-f "$ndk/AndroidVersion.txt") {
34-
# $ndk/platforms is traditional "all-inclusive" NDK, while
35-
# $ndk/AndroidVersion.txt is so-called standalone toolchain
36-
# tailored for specific target down to API level.
32+
die "\$ANDROID_NDK_HOME is not defined" if (!$ndk);
33+
my $is_standalone_toolchain = -f "$ndk/AndroidVersion.txt";
34+
my $ndk_src_props = "$ndk/source.properties";
35+
my $is_ndk = -f $ndk_src_props;
36+
if ($is_ndk == $is_standalone_toolchain) {
3737
die "\$ANDROID_NDK_HOME=$ndk is invalid";
3838
}
3939
$ndk = canonpath($ndk);
4040

4141
my $ndkver = undef;
4242

43-
if (open my $fh, "<$ndk/source.properties") {
43+
if (open my $fh, "<$ndk_src_props") {
4444
local $_;
4545
while(<$fh>) {
4646
if (m|Pkg\.Revision\s*=\s*([0-9]+)|) {
@@ -59,7 +59,7 @@
5959
if ($sysroot = $ENV{CROSS_SYSROOT}) {
6060
$sysroot =~ m|/android-([0-9]+)/arch-(\w+)/?$|;
6161
($api, $arch) = ($1, $2);
62-
} elsif (-f "$ndk/AndroidVersion.txt") {
62+
} elsif ($is_standalone_toolchain) {
6363
$sysroot = "$ndk/sysroot";
6464
} else {
6565
$api = "*";
@@ -72,17 +72,31 @@
7272
}
7373
}
7474

75-
# list available platforms (numerically)
76-
my @platforms = sort { $a =~ m/-([0-9]+)$/; my $aa = $1;
77-
$b =~ m/-([0-9]+)$/; $aa <=> $1;
78-
} glob("$ndk/platforms/android-$api");
79-
die "no $ndk/platforms/android-$api" if ($#platforms < 0);
75+
if (-d "$ndk/platforms") {
76+
# list available platforms (numerically)
77+
my @platforms = sort { $a =~ m/-([0-9]+)$/; my $aa = $1;
78+
$b =~ m/-([0-9]+)$/; $aa <=> $1;
79+
} glob("$ndk/platforms/android-$api");
80+
die "no $ndk/platforms/android-$api" if ($#platforms < 0);
8081

81-
$sysroot = "@platforms[$#platforms]/arch-$arch";
82-
$sysroot =~ m|/android-([0-9]+)/arch-$arch|;
83-
$api = $1;
82+
$sysroot = "@platforms[$#platforms]/arch-$arch";
83+
$sysroot =~ m|/android-([0-9]+)/arch-$arch|;
84+
$api = $1;
85+
} elsif ($api eq "*") {
86+
# r22 Removed platforms dir, use this JSON file
87+
my $path = "$ndk/meta/platforms.json";
88+
open my $fh, $path or die "Could not open '$path' $!";
89+
while (<$fh>) {
90+
if (/"max": (\d+),/) {
91+
$api = $1;
92+
last;
93+
}
94+
}
95+
close $fh;
96+
}
97+
die "Could not get default API Level" if ($api eq "*");
8498
}
85-
die "no sysroot=$sysroot" if (!-d $sysroot);
99+
die "no sysroot=$sysroot" if (length $sysroot && !-d $sysroot);
86100

87101
my $triarch = $triplet{$arch};
88102
my $cflags;
@@ -95,17 +109,21 @@
95109
my $arm = $ndkver > 16 ? "armv7a" : "armv5te";
96110
(my $tridefault = $triarch) =~ s/^arm-/$arm-/;
97111
(my $tritools = $triarch) =~ s/(?:x|i6)86(_64)?-.*/x86$1/;
98-
$cflags .= " -target $tridefault "
99-
. "-gcc-toolchain \$($ndk_var)/toolchains"
100-
. "/$tritools-4.9/prebuilt/$host";
101-
$user{CC} = "clang" if ($user{CC} !~ m|clang|);
112+
if (length $sysroot) {
113+
$cflags .= " -target $tridefault "
114+
. "-gcc-toolchain \$($ndk_var)/toolchains"
115+
. "/$tritools-4.9/prebuilt/$host";
116+
$user{CC} = "clang" if ($user{CC} !~ m|clang|);
117+
} else {
118+
$user{CC} = "$tridefault$api-clang";
119+
}
102120
$user{CROSS_COMPILE} = undef;
103121
if (which("llvm-ar") =~ m|^$ndk/.*/prebuilt/([^/]+)/|) {
104122
$user{AR} = "llvm-ar";
105123
$user{ARFLAGS} = [ "rs" ];
106124
$user{RANLIB} = ":";
107125
}
108-
} elsif (-f "$ndk/AndroidVersion.txt") { #"standalone toolchain"
126+
} elsif ($is_standalone_toolchain) {
109127
my $cc = $user{CC} // "clang";
110128
# One can probably argue that both clang and gcc should be
111129
# probed, but support for "standalone toolchain" was added
@@ -127,19 +145,21 @@
127145
$user{CROSS_COMPILE} = "$triarch-";
128146
}
129147

130-
if (!-d "$sysroot/usr/include") {
131-
my $incroot = "$ndk/sysroot/usr/include";
132-
die "no $incroot" if (!-d $incroot);
133-
die "no $incroot/$triarch" if (!-d "$incroot/$triarch");
134-
$incroot =~ s|^$ndk/||;
135-
$cppflags = "-D__ANDROID_API__=$api";
136-
$cppflags .= " -isystem \$($ndk_var)/$incroot/$triarch";
137-
$cppflags .= " -isystem \$($ndk_var)/$incroot";
148+
if (length $sysroot) {
149+
if (!-d "$sysroot/usr/include") {
150+
my $incroot = "$ndk/sysroot/usr/include";
151+
die "no $incroot" if (!-d $incroot);
152+
die "no $incroot/$triarch" if (!-d "$incroot/$triarch");
153+
$incroot =~ s|^$ndk/||;
154+
$cppflags = "-D__ANDROID_API__=$api";
155+
$cppflags .= " -isystem \$($ndk_var)/$incroot/$triarch";
156+
$cppflags .= " -isystem \$($ndk_var)/$incroot";
157+
}
158+
$sysroot =~ s|^$ndk/||;
159+
$sysroot = " --sysroot=\$($ndk_var)/$sysroot";
138160
}
139-
140-
$sysroot =~ s|^$ndk/||;
141161
$android_ndk = {
142-
cflags => "$cflags --sysroot=\$($ndk_var)/$sysroot",
162+
cflags => $cflags . $sysroot,
143163
cppflags => $cppflags,
144164
bn_ops => $arch =~ m/64$/ ? "SIXTY_FOUR_BIT_LONG"
145165
: "BN_LLONG",

‎Configurations/unix-Makefile.tmpl

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -523,7 +523,6 @@ clean: libclean
523523
$(RM) -r test/test-runs
524524
$(RM) openssl.pc libcrypto.pc libssl.pc
525525
-$(RM) `find . -type l \! -name '.*' -print`
526-
$(RM) $(TARFILE)
527526

528527
distclean: clean
529528
$(RM) configdata.pm

‎Configurations/windows-makefile.tmpl

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -324,15 +324,15 @@ build_apps build_tests: build_programs
324324
# Convenience target to prebuild all generated files, not just the mandatory
325325
# ones
326326
build_all_generated: $(GENERATED_MANDATORY) $(GENERATED)
327-
@{- output_off() if $disabled{makedepend}; "" -}
327+
@{- output_off() if $disabled{makedepend}; "\@rem" -}
328328
@$(ECHO) "Warning: consider configuring with no-makedepend, because if"
329329
@$(ECHO) " target system doesn't have $(PERL),"
330330
@$(ECHO) " then make will fail..."
331-
@{- output_on() if $disabled{makedepend}; "" -}
331+
@{- output_on() if $disabled{makedepend}; "\@rem" -}
332332

333333
test: tests
334334
{- dependmagic('tests'); -}: build_programs_nodep build_engines_nodep
335-
@{- output_off() if $disabled{tests}; "" -}
335+
@{- output_off() if $disabled{tests}; "\@rem" -}
336336
-mkdir $(BLDDIR)\test\test-runs
337337
set SRCTOP=$(SRCDIR)
338338
set BLDTOP=$(BLDDIR)
@@ -341,17 +341,17 @@ test: tests
341341
set OPENSSL_ENGINES=$(MAKEDIR)\engines
342342
set OPENSSL_DEBUG_MEMORY=on
343343
"$(PERL)" "$(SRCDIR)\test\run_tests.pl" $(TESTS)
344-
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
344+
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "\@rem" -}
345345
@$(ECHO) "Tests are not supported with your chosen Configure options"
346-
@{- output_on() if !$disabled{tests}; "" -}
346+
@{- output_on() if !$disabled{tests}; "\@rem" -}
347347

348348
list-tests:
349-
@{- output_off() if $disabled{tests}; "" -}
349+
@{- output_off() if $disabled{tests}; "\@rem" -}
350350
@set SRCTOP=$(SRCDIR)
351351
@"$(PERL)" "$(SRCDIR)\test\run_tests.pl" list
352-
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
352+
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "\@rem" -}
353353
@$(ECHO) "Tests are not supported with your chosen Configure options"
354-
@{- output_on() if !$disabled{tests}; "" -}
354+
@{- output_on() if !$disabled{tests}; "\@rem" -}
355355

356356
install: install_sw install_ssldirs install_docs
357357

@@ -362,7 +362,7 @@ libclean:
362362
-del /Q /F $(LIBS) libcrypto.* libssl.* ossl_static.pdb
363363

364364
clean: libclean
365-
{- join("\n\t", map { "-del /Q /F $_" } @PROGRAMS) -}
365+
{- join("\n\t", map { "-del /Q /F $_" } @PROGRAMS) || "\@rem" -}
366366
-del /Q /F $(ENGINES)
367367
-del /Q /F $(SCRIPTS)
368368
-del /Q /F $(GENERATED_MANDATORY)
@@ -378,9 +378,9 @@ distclean: clean
378378
-del /Q /F makefile
379379

380380
depend:
381-
@ {- output_off() if $disabled{makedepend}; "" -}
381+
@ {- output_off() if $disabled{makedepend}; "\@rem" -}
382382
@ "$(PERL)" "$(SRCDIR)\util\add-depends.pl" "VC"
383-
@ {- output_on() if $disabled{makedepend}; "" -}
383+
@ {- output_on() if $disabled{makedepend}; "\@rem" -}
384384

385385
# Install helper targets #############################################
386386

@@ -413,10 +413,10 @@ install_dev: install_runtime_libs
413413
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
414414
@$(ECHO) "*** Installing development files"
415415
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\include\openssl"
416-
@{- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
416+
@{- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "\@rem" -}
417417
@"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\ms\applink.c" \
418418
"$(INSTALLTOP)\include\openssl"
419-
@{- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
419+
@{- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "\@rem" -}
420420
@"$(PERL)" "$(SRCDIR)\util\copy.pl" "-exclude_re=/__DECC_" \
421421
"$(SRCDIR)\include\openssl\*.h" \
422422
"$(INSTALLTOP)\include\openssl"

‎Configure

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1304,16 +1304,19 @@ if ($disabled{"dynamic-engine"}) {
13041304

13051305
unless ($disabled{asan}) {
13061306
push @{$config{cflags}}, "-fsanitize=address";
1307+
push @{$config{cxxflags}}, "-fsanitize=address" if $config{CXX};
13071308
}
13081309

13091310
unless ($disabled{ubsan}) {
13101311
# -DPEDANTIC or -fnosanitize=alignment may also be required on some
13111312
# platforms.
13121313
push @{$config{cflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all";
1314+
push @{$config{cxxflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all" if $config{CXX};
13131315
}
13141316

13151317
unless ($disabled{msan}) {
13161318
push @{$config{cflags}}, "-fsanitize=memory";
1319+
push @{$config{cxxflags}}, "-fsanitize=memory" if $config{CXX};
13171320
}
13181321

13191322
unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"}

‎NEWS

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,15 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1l and OpenSSL 1.1.1m [14 Dec 2021]
9+
10+
o None
11+
12+
Major changes between OpenSSL 1.1.1k and OpenSSL 1.1.1l [24 Aug 2021]
13+
14+
o Fixed an SM2 Decryption Buffer Overflow (CVE-2021-3711)
15+
o Fixed various read buffer overruns processing ASN.1 strings (CVE-2021-3712)
16+
817
Major changes between OpenSSL 1.1.1j and OpenSSL 1.1.1k [25 Mar 2021]
918

1019
o Fixed a problem with verifying a certificate chain when using the

‎README

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.1.1k 25 Mar 2021
2+
OpenSSL 1.1.1m 14 Dec 2021
33

44
Copyright (c) 1998-2021 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎apps/ciphers.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -172,6 +172,7 @@ int ciphers_main(int argc, char **argv)
172172
if (convert != NULL) {
173173
BIO_printf(bio_out, "OpenSSL cipher name: %s\n",
174174
OPENSSL_cipher_name(convert));
175+
ret = 0;
175176
goto end;
176177
}
177178

0 commit comments

Comments
 (0)