Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-22 Thread Kurt Cancemi via RT
Hello, Sorry about this whole mess, the issue was discovered and fixed by the OpenBSD team. I reply'd to the original person who discovered my mistake of not attributing the OpenBSD team instead of to this list (I thought I reply'd here). Again i'm sorry for this mess, and all credit for finding

[openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-22 Thread Matt Caswell via RT
On Sun Jun 22 20:00:14 2014, k...@x64architecture.com wrote: Hello, Sorry about this whole mess, the issue was discovered and fixed by the OpenBSD team. I reply'd to the original person who discovered my mistake of not attributing the OpenBSD team instead of to this list (I thought I reply'd

Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-21 Thread Ben Laurie
On 12 June 2014 23:15, Matt Caswell m...@openssl.org wrote: On 12/06/14 22:43, Otto Moerbeek wrote: On Thu, Jun 12, 2014 at 10:26:56PM +0200, Matt Caswell via RT wrote: Patch applied: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=abfb989fe0b749ad61f1aa4cdb0ea4f952fc13e0 Many

Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-21 Thread Otto Moerbeek
On Sat, Jun 21, 2014 at 06:15:28PM +0100, Ben Laurie wrote: On 12 June 2014 23:15, Matt Caswell m...@openssl.org wrote: On 12/06/14 22:43, Otto Moerbeek wrote: On Thu, Jun 12, 2014 at 10:26:56PM +0200, Matt Caswell via RT wrote: Patch applied:

Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-21 Thread mancha
On Sat, Jun 21, 2014 at 08:51:35PM +0200, Otto Moerbeek wrote: You care confusing the matter. Kurt already expained he got the fix from OpenBSD. After that explanation, the OpenSSL repo was fixed to contain the attribution. Hi. I can't seem to find the attribution fix you allude to. Can you

Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-21 Thread Matt Caswell
On 21 June 2014 19:51, Otto Moerbeek o...@drijf.net wrote: You care confusing the matter. Kurt already expained he got the fix from OpenBSD. After that explanation, the OpenSSL repo was fixed to contain the attribution. I think we are all getting confused in this thread! :-) Otto - I think

Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-21 Thread Otto Moerbeek
On Sat, Jun 21, 2014 at 09:58:33PM +0100, Matt Caswell wrote: On 21 June 2014 19:51, Otto Moerbeek o...@drijf.net wrote: You care confusing the matter. Kurt already expained he got the fix from OpenBSD. After that explanation, the OpenSSL repo was fixed to contain the attribution. I

Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-13 Thread Otto Moerbeek
On Thu, Jun 12, 2014 at 11:15:18PM +0100, Matt Caswell wrote: On 12/06/14 22:43, Otto Moerbeek wrote: On Thu, Jun 12, 2014 at 10:26:56PM +0200, Matt Caswell via RT wrote: Patch applied: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=abfb989fe0b749ad61f1aa4cdb0ea4f952fc13e0

[openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-12 Thread Matt Caswell via RT
Patch applied: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=abfb989fe0b749ad61f1aa4cdb0ea4f952fc13e0 Many thanks for your contribution. Matt __ OpenSSL Project http://www.openssl.org

Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-12 Thread Otto Moerbeek
On Thu, Jun 12, 2014 at 10:26:56PM +0200, Matt Caswell via RT wrote: Patch applied: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=abfb989fe0b749ad61f1aa4cdb0ea4f952fc13e0 Many thanks for your contribution. Matt

Re: [openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-12 Thread Matt Caswell
On 12/06/14 22:43, Otto Moerbeek wrote: On Thu, Jun 12, 2014 at 10:26:56PM +0200, Matt Caswell via RT wrote: Patch applied: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=abfb989fe0b749ad61f1aa4cdb0ea4f952fc13e0 Many thanks for your contribution. Matt

[openssl.org #3375] Patch: Off-by-one errors in ssl_cipher_get_evp()

2014-06-04 Thread Kurt Cancemi via RT
Hi, In the ssl_cipher_get_evp() function, there are two off-by-one errors in index validation before accessing arrays. The attached patch fixes the problem. Regards, Kurt Cancemi From 72e339f36be4a40436b95a0d07d68167605c31e2 Mon Sep 17 00:00:00 2001 From: Kurt Cancemi k...@x64architecture.com