diff options
author | jaenicke <jaenicke> | 2003-01-15 14:54:57 +0000 |
---|---|---|
committer | jaenicke <jaenicke> | 2003-01-15 14:54:57 +0000 |
commit | 1754595cf60ac2e27b9c3baa0aaf06b3a8fa4a08 (patch) | |
tree | 41a5ab48a7e7d3e6d76d8ce619fc699673e4af43 /CHANGES | |
parent | 57dc427c82c15816a11647f14e25cc02839bc2e6 (diff) | |
download | openssl-1754595cf60ac2e27b9c3baa0aaf06b3a8fa4a08.tar.gz |
Fix initialization sequence to prevent freeing of unitialized objects.
Submitted by: Nils Larsch <nla@trustcenter.de>
PR: 459
Diffstat (limited to 'CHANGES')
-rw-r--r-- | CHANGES | 12 |
1 files changed, 12 insertions, 0 deletions
@@ -4,6 +4,12 @@ Changes between 0.9.7 and 0.9.8 [xx XXX xxxx] + *) ECDSA routines: under certain error conditions uninitialized BN objects + could be freed. Solution: make sure initialization is performed early + enough. (Reported and fix supplied by Nils Larsch <nla@trustcenter.de> + via PR#459) + [Lutz Jaenicke] + *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD and DH_METHOD (eg. by ENGINE implementations) to override the normal software implementations. For DSA and DH, parameter generation can @@ -375,6 +381,12 @@ TODO: bug: pad x with leading zeros if necessary Changes between 0.9.7 and 0.9.7a [XX xxx 2003] + *) DSA routines: under certain error conditions uninitialized BN objects + could be freed. Solution: make sure initialization is performed early + enough. (Reported and fix supplied by Ivan D Nestlerode <nestler@MIT.EDU>, + Nils Larsch <nla@trustcenter.de> via PR#459) + [Lutz Jaenicke] + *) Another fix for SSLv2 session ID handling: the session ID was incorrectly checked on reconnect on the client side, therefore session resumption could still fail with a "ssl session id is different" error. This |