View | Details | Raw Unified
Collapse All | Expand All

(-) CHANGES (+3 lines)
 Lines 4-9    Link Here  

        
 Changes between 0.9.8g and 0.9.8h  [xx XXX xxxx]
 Changes between 0.9.8g and 0.9.8h  [xx XXX xxxx]

        

            

              
              
  *) Fix double free in TLS server name extensions which could lead to a remote

            

            

              
              
     crash found by Codenomicon TLS test suite (CVE-2008-0891) [Joe Orton]

            

            

              
              

            

        
  *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
  *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()

        
     to get the expected BN_FLG_CONSTTIME behavior.
     to get the expected BN_FLG_CONSTTIME behavior.

        
     [Bodo Moeller (Google)]
     [Bodo Moeller (Google)]



(-) ssl/t1_lib.c
      (+1 lines)




  

    

    

       Lines 381-386
       
    
  Link Here 
    

  

        
						s->session->tlsext_hostname[len]='\0';
						s->session->tlsext_hostname[len]='\0';

        
						if (strlen(s->session->tlsext_hostname) != len) {
						if (strlen(s->session->tlsext_hostname) != len) {

        
							OPENSSL_free(s->session->tlsext_hostname);
							OPENSSL_free(s->session->tlsext_hostname);

            

              
              
							s->session->tlsext_hostname = NULL;

            

        
							*al = TLS1_AD_UNRECOGNIZED_NAME;
							*al = TLS1_AD_UNRECOGNIZED_NAME;

        
							return 0;
							return 0;

        
						}
						}