diff options
| author | Harin Vadodaria <harin.vadodaria@oracle.com> | 2014-05-22 14:26:09 +0530 |
|---|---|---|
| committer | Harin Vadodaria <harin.vadodaria@oracle.com> | 2014-05-22 14:26:09 +0530 |
| commit | a4d12749df38b6b836997201e89295fadfe09f0b (patch) | |
| tree | 37d7551fb493722c4e78c5ed539e01530381b122 /extra | |
| parent | 9ffebd765a647fe51231bc5b70fa7e3e0383ac27 (diff) | |
| download | mariadb-git-a4d12749df38b6b836997201e89295fadfe09f0b.tar.gz | |
Bug#17201924 and Bug#18178997 : YASSL:MISSING CLOSEDIR()
IN
SSL_CTX_LOAD_VERIFY_
LOCATIONS()
and
OFF-BY-ONE PROBLEM IN
VOID CERTDECODER::
GETDATE(DATETYPE DT)
IN ASN.CPP
Description : Fixes corner cases in yassl code.
Refer to bug page for details.
Diffstat (limited to 'extra')
| -rw-r--r-- | extra/yassl/src/ssl.cpp | 7 | ||||
| -rw-r--r-- | extra/yassl/taocrypt/include/asn.hpp | 8 |
2 files changed, 9 insertions, 6 deletions
diff --git a/extra/yassl/src/ssl.cpp b/extra/yassl/src/ssl.cpp index b0499a55e14..a47b175e635 100644 --- a/extra/yassl/src/ssl.cpp +++ b/extra/yassl/src/ssl.cpp @@ -1,5 +1,5 @@ /* - Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved. + Copyright (c) 2005, 2014, Oracle and/or its affiliates. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -790,7 +790,10 @@ int SSL_CTX_load_verify_locations(SSL_CTX* ctx, const char* file, strncpy(name, path, MAX_PATH - 1 - HALF_PATH); strncat(name, "/", 1); strncat(name, entry->d_name, HALF_PATH); - if (stat(name, &buf) < 0) return SSL_BAD_STAT; + if (stat(name, &buf) < 0) { + closedir(dir); + return SSL_BAD_STAT; + } if (S_ISREG(buf.st_mode)) ret = read_file(ctx, name, SSL_FILETYPE_PEM, CA); diff --git a/extra/yassl/taocrypt/include/asn.hpp b/extra/yassl/taocrypt/include/asn.hpp index fee2f26fb73..daf1000bde9 100644 --- a/extra/yassl/taocrypt/include/asn.hpp +++ b/extra/yassl/taocrypt/include/asn.hpp @@ -1,5 +1,5 @@ /* - Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved. + Copyright (c) 2005, 2014, Oracle and/or its affiliates. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -294,9 +294,9 @@ private: byte* signature_; char issuer_[ASN_NAME_MAX]; // Names char subject_[ASN_NAME_MAX]; // Names - char beforeDate_[MAX_DATE_SZ]; // valid before date - char afterDate_[MAX_DATE_SZ]; // valid after date - bool verify_; // Default to yes, but could be off + char beforeDate_[MAX_DATE_SZ+1]; // valid before date, +null term + char afterDate_[MAX_DATE_SZ+1]; // valid after date, +null term + bool verify_; // Default to yes, but could be off void ReadHeader(); void Decode(SignerList*, CertType); |