FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade openssl sources to OpenSSL_1_1_1l+quic · nodejs/node@4b5bbec · GitHub

deps: upgrade openssl sources to OpenSSL_1_1_1l+quic · nodejs/node@4b5bbec · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit 4b5bbec

Browse files
richardlau
authored and
targos
committed
deps: upgrade openssl sources to OpenSSL_1_1_1l+quic
This updates all sources in deps/openssl/openssl by: $ git clone https://github.com/quictls/openssl $ cd openssl $ git checkout OpenSSL_1_1_1l+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl PR-URL: #39867 Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
1 parent 4e7212c commit 4b5bbec

110 files changed

Lines changed: 2235 additions & 535 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,71 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
11+
12+
*) Fixed an SM2 Decryption Buffer Overflow.
13+
14+
In order to decrypt SM2 encrypted data an application is expected to call the
15+
API function EVP_PKEY_decrypt(). Typically an application will call this
16+
function twice. The first time, on entry, the "out" parameter can be NULL and,
17+
on exit, the "outlen" parameter is populated with the buffer size required to
18+
hold the decrypted plaintext. The application can then allocate a sufficiently
19+
sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL
20+
value for the "out" parameter.
21+
22+
A bug in the implementation of the SM2 decryption code means that the
23+
calculation of the buffer size required to hold the plaintext returned by the
24+
first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
25+
the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
26+
called by the application a second time with a buffer that is too small.
27+
28+
A malicious attacker who is able present SM2 content for decryption to an
29+
application could cause attacker chosen data to overflow the buffer by up to a
30+
maximum of 62 bytes altering the contents of other data held after the
31+
buffer, possibly changing application behaviour or causing the application to
32+
crash. The location of the buffer is application dependent but is typically
33+
heap allocated.
34+
(CVE-2021-3711)
35+
[Matt Caswell]
36+
37+
*) Fixed various read buffer overruns processing ASN.1 strings
38+
39+
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING
40+
structure which contains a buffer holding the string data and a field holding
41+
the buffer length. This contrasts with normal C strings which are repesented as
42+
a buffer for the string data which is terminated with a NUL (0) byte.
43+
44+
Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's
45+
own "d2i" functions (and other similar parsing functions) as well as any string
46+
whose value has been set with the ASN1_STRING_set() function will additionally
47+
NUL terminate the byte array in the ASN1_STRING structure.
48+
49+
However, it is possible for applications to directly construct valid ASN1_STRING
50+
structures which do not NUL terminate the byte array by directly setting the
51+
"data" and "length" fields in the ASN1_STRING array. This can also happen by
52+
using the ASN1_STRING_set0() function.
53+
54+
Numerous OpenSSL functions that print ASN.1 data have been found to assume that
55+
the ASN1_STRING byte array will be NUL terminated, even though this is not
56+
guaranteed for strings that have been directly constructed. Where an application
57+
requests an ASN.1 structure to be printed, and where that ASN.1 structure
58+
contains ASN1_STRINGs that have been directly constructed by the application
59+
without NUL terminating the "data" field, then a read buffer overrun can occur.
60+
61+
The same thing can also occur during name constraints processing of certificates
62+
(for example if a certificate has been directly constructed by the application
63+
instead of loading it via the OpenSSL parsing functions, and the certificate
64+
contains non NUL terminated ASN1_STRING structures). It can also occur in the
65+
X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions.
66+
67+
If a malicious actor can cause an application to directly construct an
68+
ASN1_STRING and then process it through one of the affected OpenSSL functions
69+
then this issue could be hit. This might result in a crash (causing a Denial of
70+
Service attack). It could also result in the disclosure of private memory
71+
contents (such as private keys, or sensitive plaintext).
72+
(CVE-2021-3712)
73+
[Matt Caswell]
74+
1075
Changes between 1.1.1j and 1.1.1k [25 Mar 2021]
1176

1277
*) Fixed a problem with verifying a certificate chain when using the

‎deps/openssl/openssl/Configurations/10-main.conf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -754,6 +754,13 @@ my %targets = (
754754
multilib => "64",
755755
},
756756

757+
# riscv64 below refers to contemporary RISCV Architecture
758+
# specifications,
759+
"linux64-riscv64" => {
760+
inherit_from => [ "linux-generic64"],
761+
perlasm_scheme => "linux64",
762+
},
763+
757764
#### IA-32 targets...
758765
#### These two targets are a bit aged and are to be used on older Linux
759766
#### machines where gcc doesn't understand -m32 and -m64

‎deps/openssl/openssl/Configurations/15-android.conf‎

Lines changed: 52 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -29,18 +29,18 @@
2929
$ndk = $ENV{$ndk_var};
3030
last if defined $ndk;
3131
}
32-
die "\$ANDROID_NDK_HOME is not defined" if (!$ndk);
33-
if (!-d "$ndk/platforms" && !-f "$ndk/AndroidVersion.txt") {
34-
# $ndk/platforms is traditional "all-inclusive" NDK, while
35-
# $ndk/AndroidVersion.txt is so-called standalone toolchain
36-
# tailored for specific target down to API level.
32+
die "\$ANDROID_NDK_HOME is not defined" if (!$ndk);
33+
my $is_standalone_toolchain = -f "$ndk/AndroidVersion.txt";
34+
my $ndk_src_props = "$ndk/source.properties";
35+
my $is_ndk = -f $ndk_src_props;
36+
if ($is_ndk == $is_standalone_toolchain) {
3737
die "\$ANDROID_NDK_HOME=$ndk is invalid";
3838
}
3939
$ndk = canonpath($ndk);
4040

4141
my $ndkver = undef;
4242

43-
if (open my $fh, "<$ndk/source.properties") {
43+
if (open my $fh, "<$ndk_src_props") {
4444
local $_;
4545
while(<$fh>) {
4646
if (m|Pkg\.Revision\s*=\s*([0-9]+)|) {
@@ -59,7 +59,7 @@
5959
if ($sysroot = $ENV{CROSS_SYSROOT}) {
6060
$sysroot =~ m|/android-([0-9]+)/arch-(\w+)/?$|;
6161
($api, $arch) = ($1, $2);
62-
} elsif (-f "$ndk/AndroidVersion.txt") {
62+
} elsif ($is_standalone_toolchain) {
6363
$sysroot = "$ndk/sysroot";
6464
} else {
6565
$api = "*";
@@ -72,17 +72,31 @@
7272
}
7373
}
7474

75-
# list available platforms (numerically)
76-
my @platforms = sort { $a =~ m/-([0-9]+)$/; my $aa = $1;
77-
$b =~ m/-([0-9]+)$/; $aa <=> $1;
78-
} glob("$ndk/platforms/android-$api");
79-
die "no $ndk/platforms/android-$api" if ($#platforms < 0);
75+
if (-d "$ndk/platforms") {
76+
# list available platforms (numerically)
77+
my @platforms = sort { $a =~ m/-([0-9]+)$/; my $aa = $1;
78+
$b =~ m/-([0-9]+)$/; $aa <=> $1;
79+
} glob("$ndk/platforms/android-$api");
80+
die "no $ndk/platforms/android-$api" if ($#platforms < 0);
8081

81-
$sysroot = "@platforms[$#platforms]/arch-$arch";
82-
$sysroot =~ m|/android-([0-9]+)/arch-$arch|;
83-
$api = $1;
82+
$sysroot = "@platforms[$#platforms]/arch-$arch";
83+
$sysroot =~ m|/android-([0-9]+)/arch-$arch|;
84+
$api = $1;
85+
} elsif ($api eq "*") {
86+
# r22 Removed platforms dir, use this JSON file
87+
my $path = "$ndk/meta/platforms.json";
88+
open my $fh, $path or die "Could not open '$path' $!";
89+
while (<$fh>) {
90+
if (/"max": (\d+),/) {
91+
$api = $1;
92+
last;
93+
}
94+
}
95+
close $fh;
96+
}
97+
die "Could not get default API Level" if ($api eq "*");
8498
}
85-
die "no sysroot=$sysroot" if (!-d $sysroot);
99+
die "no sysroot=$sysroot" if (length $sysroot && !-d $sysroot);
86100

87101
my $triarch = $triplet{$arch};
88102
my $cflags;
@@ -95,17 +109,21 @@
95109
my $arm = $ndkver > 16 ? "armv7a" : "armv5te";
96110
(my $tridefault = $triarch) =~ s/^arm-/$arm-/;
97111
(my $tritools = $triarch) =~ s/(?:x|i6)86(_64)?-.*/x86$1/;
98-
$cflags .= " -target $tridefault "
99-
. "-gcc-toolchain \$($ndk_var)/toolchains"
100-
. "/$tritools-4.9/prebuilt/$host";
101-
$user{CC} = "clang" if ($user{CC} !~ m|clang|);
112+
if (length $sysroot) {
113+
$cflags .= " -target $tridefault "
114+
. "-gcc-toolchain \$($ndk_var)/toolchains"
115+
. "/$tritools-4.9/prebuilt/$host";
116+
$user{CC} = "clang" if ($user{CC} !~ m|clang|);
117+
} else {
118+
$user{CC} = "$tridefault$api-clang";
119+
}
102120
$user{CROSS_COMPILE} = undef;
103121
if (which("llvm-ar") =~ m|^$ndk/.*/prebuilt/([^/]+)/|) {
104122
$user{AR} = "llvm-ar";
105123
$user{ARFLAGS} = [ "rs" ];
106124
$user{RANLIB} = ":";
107125
}
108-
} elsif (-f "$ndk/AndroidVersion.txt") { #"standalone toolchain"
126+
} elsif ($is_standalone_toolchain) {
109127
my $cc = $user{CC} // "clang";
110128
# One can probably argue that both clang and gcc should be
111129
# probed, but support for "standalone toolchain" was added
@@ -127,19 +145,21 @@
127145
$user{CROSS_COMPILE} = "$triarch-";
128146
}
129147

130-
if (!-d "$sysroot/usr/include") {
131-
my $incroot = "$ndk/sysroot/usr/include";
132-
die "no $incroot" if (!-d $incroot);
133-
die "no $incroot/$triarch" if (!-d "$incroot/$triarch");
134-
$incroot =~ s|^$ndk/||;
135-
$cppflags = "-D__ANDROID_API__=$api";
136-
$cppflags .= " -isystem \$($ndk_var)/$incroot/$triarch";
137-
$cppflags .= " -isystem \$($ndk_var)/$incroot";
148+
if (length $sysroot) {
149+
if (!-d "$sysroot/usr/include") {
150+
my $incroot = "$ndk/sysroot/usr/include";
151+
die "no $incroot" if (!-d $incroot);
152+
die "no $incroot/$triarch" if (!-d "$incroot/$triarch");
153+
$incroot =~ s|^$ndk/||;
154+
$cppflags = "-D__ANDROID_API__=$api";
155+
$cppflags .= " -isystem \$($ndk_var)/$incroot/$triarch";
156+
$cppflags .= " -isystem \$($ndk_var)/$incroot";
157+
}
158+
$sysroot =~ s|^$ndk/||;
159+
$sysroot = " --sysroot=\$($ndk_var)/$sysroot";
138160
}
139-
140-
$sysroot =~ s|^$ndk/||;
141161
$android_ndk = {
142-
cflags => "$cflags --sysroot=\$($ndk_var)/$sysroot",
162+
cflags => $cflags . $sysroot,
143163
cppflags => $cppflags,
144164
bn_ops => $arch =~ m/64$/ ? "SIXTY_FOUR_BIT_LONG"
145165
: "BN_LLONG",

‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -523,7 +523,6 @@ clean: libclean
523523
$(RM) -r test/test-runs
524524
$(RM) openssl.pc libcrypto.pc libssl.pc
525525
-$(RM) `find . -type l \! -name '.*' -print`
526-
$(RM) $(TARFILE)
527526
528527
distclean: clean
529528
$(RM) configdata.pm

‎deps/openssl/openssl/Configurations/windows-makefile.tmpl‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -324,15 +324,15 @@ build_apps build_tests: build_programs
324324
# Convenience target to prebuild all generated files, not just the mandatory
325325
# ones
326326
build_all_generated: $(GENERATED_MANDATORY) $(GENERATED)
327-
@{- output_off() if $disabled{makedepend}; "" -}
327+
@{- output_off() if $disabled{makedepend}; "\@rem" -}
328328
@$(ECHO) "Warning: consider configuring with no-makedepend, because if"
329329
@$(ECHO) " target system doesn't have $(PERL),"
330330
@$(ECHO) " then make will fail..."
331-
@{- output_on() if $disabled{makedepend}; "" -}
331+
@{- output_on() if $disabled{makedepend}; "\@rem" -}
332332

333333
test: tests
334334
{- dependmagic('tests'); -}: build_programs_nodep build_engines_nodep
335-
@{- output_off() if $disabled{tests}; "" -}
335+
@{- output_off() if $disabled{tests}; "\@rem" -}
336336
-mkdir $(BLDDIR)\test\test-runs
337337
set SRCTOP=$(SRCDIR)
338338
set BLDTOP=$(BLDDIR)
@@ -341,17 +341,17 @@ test: tests
341341
set OPENSSL_ENGINES=$(MAKEDIR)\engines
342342
set OPENSSL_DEBUG_MEMORY=on
343343
"$(PERL)" "$(SRCDIR)\test\run_tests.pl" $(TESTS)
344-
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
344+
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "\@rem" -}
345345
@$(ECHO) "Tests are not supported with your chosen Configure options"
346-
@{- output_on() if !$disabled{tests}; "" -}
346+
@{- output_on() if !$disabled{tests}; "\@rem" -}
347347

348348
list-tests:
349-
@{- output_off() if $disabled{tests}; "" -}
349+
@{- output_off() if $disabled{tests}; "\@rem" -}
350350
@set SRCTOP=$(SRCDIR)
351351
@"$(PERL)" "$(SRCDIR)\test\run_tests.pl" list
352-
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
352+
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "\@rem" -}
353353
@$(ECHO) "Tests are not supported with your chosen Configure options"
354-
@{- output_on() if !$disabled{tests}; "" -}
354+
@{- output_on() if !$disabled{tests}; "\@rem" -}
355355

356356
install: install_sw install_ssldirs install_docs
357357

@@ -362,7 +362,7 @@ libclean:
362362
-del /Q /F $(LIBS) libcrypto.* libssl.* ossl_static.pdb
363363

364364
clean: libclean
365-
{- join("\n\t", map { "-del /Q /F $_" } @PROGRAMS) -}
365+
{- join("\n\t", map { "-del /Q /F $_" } @PROGRAMS) || "\@rem" -}
366366
-del /Q /F $(ENGINES)
367367
-del /Q /F $(SCRIPTS)
368368
-del /Q /F $(GENERATED_MANDATORY)
@@ -378,9 +378,9 @@ distclean: clean
378378
-del /Q /F makefile
379379

380380
depend:
381-
@ {- output_off() if $disabled{makedepend}; "" -}
381+
@ {- output_off() if $disabled{makedepend}; "\@rem" -}
382382
@ "$(PERL)" "$(SRCDIR)\util\add-depends.pl" "VC"
383-
@ {- output_on() if $disabled{makedepend}; "" -}
383+
@ {- output_on() if $disabled{makedepend}; "\@rem" -}
384384

385385
# Install helper targets #############################################
386386

@@ -413,10 +413,10 @@ install_dev: install_runtime_libs
413413
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
414414
@$(ECHO) "*** Installing development files"
415415
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\include\openssl"
416-
@{- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
416+
@{- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "\@rem" -}
417417
@"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\ms\applink.c" \
418418
"$(INSTALLTOP)\include\openssl"
419-
@{- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
419+
@{- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "\@rem" -}
420420
@"$(PERL)" "$(SRCDIR)\util\copy.pl" "-exclude_re=/__DECC_" \
421421
"$(SRCDIR)\include\openssl\*.h" \
422422
"$(INSTALLTOP)\include\openssl"

‎deps/openssl/openssl/NEWS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1k and OpenSSL 1.1.1l [24 Aug 2021]
9+
10+
o Fixed an SM2 Decryption Buffer Overflow (CVE-2021-3711)
11+
o Fixed various read buffer overruns processing ASN.1 strings (CVE-2021-3712)
12+
813
Major changes between OpenSSL 1.1.1j and OpenSSL 1.1.1k [25 Mar 2021]
914

1015
o Fixed a problem with verifying a certificate chain when using the

‎deps/openssl/openssl/README-OpenSSL.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.1.1k 25 Mar 2021
2+
OpenSSL 1.1.1l 24 Aug 2021
33

44
Copyright (c) 1998-2021 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/apps/crl2p7.c‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -120,19 +120,20 @@ int crl2pkcs7_main(int argc, char **argv)
120120

121121
if (!ASN1_INTEGER_set(p7s->version, 1))
122122
goto end;
123-
if ((crl_stack = sk_X509_CRL_new_null()) == NULL)
124-
goto end;
125-
p7s->crl = crl_stack;
123+
126124
if (crl != NULL) {
125+
if ((crl_stack = sk_X509_CRL_new_null()) == NULL)
126+
goto end;
127+
p7s->crl = crl_stack;
127128
sk_X509_CRL_push(crl_stack, crl);
128129
crl = NULL; /* now part of p7 for OPENSSL_freeing */
129130
}
130131

131-
if ((cert_stack = sk_X509_new_null()) == NULL)
132-
goto end;
133-
p7s->cert = cert_stack;
132+
if (certflst != NULL) {
133+
if ((cert_stack = sk_X509_new_null()) == NULL)
134+
goto end;
135+
p7s->cert = cert_stack;
134136

135-
if (certflst != NULL)
136137
for (i = 0; i < sk_OPENSSL_STRING_num(certflst); i++) {
137138
certfile = sk_OPENSSL_STRING_value(certflst, i);
138139
if (add_certs_from_file(cert_stack, certfile) < 0) {
@@ -141,6 +142,7 @@ int crl2pkcs7_main(int argc, char **argv)
141142
goto end;
142143
}
143144
}
145+
}
144146

145147
out = bio_open_default(outfile, 'w', outformat);
146148
if (out == NULL)

‎deps/openssl/openssl/apps/enc.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -81,7 +81,7 @@ const OPTIONS enc_options[] = {
8181
{"", OPT_CIPHER, '-', "Any supported cipher"},
8282
OPT_R_OPTIONS,
8383
#ifdef ZLIB
84-
{"z", OPT_Z, '-', "Use zlib as the 'encryption'"},
84+
{"z", OPT_Z, '-', "Compress or decompress encrypted data using zlib"},
8585
#endif
8686
#ifndef OPENSSL_NO_ENGINE
8787
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL