01e8e625ad
This fixes uninitialized memory read reported by Nick Mathewson in https://github.com/openssl/openssl/issues/6347. It imports the memset from upstream's 2c739f72e5236a8e0c351c00047c77083dcdb77f, but I believe that fix is incorrect and instead RC4 shouldn't be allowed in this context. See https://github.com/openssl/openssl/pull/6603#issuecomment-413066462 for details. Update-Note: Decoding a password-protected PEM block with RC4 will, rather than derive garbage from uninitialized memory, simply fail. Trying to encode a password-protect PEM block with an unsupported cipher will also fail, rather than output garbage (e.g. tag-less AES-GCM). Change-Id: Ib7e23dbf5514f0a523730926daad3c0bdb989417 Reviewed-on: https://boringssl-review.googlesource.com/31084 Reviewed-by: Adam Langley <agl@google.com> |
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| pem_all.c | ||
| pem_info.c | ||
| pem_lib.c | ||
| pem_oth.c | ||
| pem_pk8.c | ||
| pem_pkey.c | ||
| pem_test.cc | ||
| pem_x509.c | ||
| pem_xaux.c | ||