Add SA-17:11.

4 files changed, 120 insertions, 0 deletions

diff --git a/share/security/patches/SA-17:11/openssl-10.patch b/share/security/patches/SA-17:11/openssl-10.patch
new file mode 100644
index 0000000000..3c3603e7a2
--- /dev/null
+++ b/share/security/patches/SA-17:11/openssl-10.patch
@@ -0,0 +1,19 @@
+--- crypto/openssl/crypto/x509v3/v3_addr.c.orig
++++ crypto/openssl/crypto/x509v3/v3_addr.c
+@@ -130,10 +130,12 @@
+  */
+ unsigned int v3_addr_get_afi(const IPAddressFamily *f)
+ {
+-    return ((f != NULL &&
+-             f->addressFamily != NULL && f->addressFamily->data != NULL)
+-            ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
+-            : 0);
++    if (f == NULL
++            || f->addressFamily == NULL
++            || f->addressFamily->data == NULL
++            || f->addressFamily->length < 2)
++        return 0;
++    return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
+ }
+ 
+ /*
diff --git a/share/security/patches/SA-17:11/openssl-10.patch.asc b/share/security/patches/SA-17:11/openssl-10.patch.asc
new file mode 100644
index 0000000000..486dde2619
--- /dev/null
+++ b/share/security/patches/SA-17:11/openssl-10.patch.asc
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.2.3 (FreeBSD)
+
+iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAloeToEACgkQ7Wfs1l3P
+aufSLA//X4kKoir7fhdlprg9oTE54WmueGfgE5qYj8ZOelJJ6zR1c7stXDZ6BY4D
+2aYlkL8C3j0iPPuN7pPq+g1zM3TybllcQH91coBpF/r8QnWAID9ZIARWmck11K/3
+9a3oMtMXC5Zsy5e3cXCWQvKwjZy3/83/WdOh1aOZKTRnB6zvHbu94PwFj2EvW4YZ
+kypD2/8MZUCDSvMDDwNHGgXqCuqXR8RTxt9Z7PyiQcms5qwn77UtdlUhIGt+SRWB
+XsdryyQnS/zGcRy606qBweitN3S6hBUhLDWAruBFN+3R3Rk+Tcf1EV3mqcUGqPj1
+KpD8LLgVnriwm0pZjn2bX+uXv38RvosrFRutOq3G3gFfsa4zzAzSjdRLzczDQcor
+r7yBxqQs8Xm/OiHmXD5Ch2ly7mTwwbnqIgDYkVlDKZFIVcJkqgQlIx4m+z3WDixM
+FjN+HoXWF9AfgWoS7Ka287uqWE/3Yzgi8d8t9YGyjqYaSVzN864JmpULqDBF74dU
+4X7OGZqyeD7SrjZZwxktcTvNLtrR2ftTBWvRoosPq1qs+5kQv97TtdDvhtTsrfgP
+TOHOc72aEqjERKFaXzwn+RCrDZ7ljTEhrcHa1nYfoKSX9jwIxAFK26fQ/6nyIiqx
+vqLrYYY1bx2YMHyDAskMXVrXPNC8doG3CazHF8L5fiThDRaMEC8=
+=QvsH
+-----END PGP SIGNATURE-----
diff --git a/share/security/patches/SA-17:11/openssl.patch b/share/security/patches/SA-17:11/openssl.patch
new file mode 100644
index 0000000000..00e3541915
--- /dev/null
+++ b/share/security/patches/SA-17:11/openssl.patch
@@ -0,0 +1,67 @@
+--- crypto/openssl/crypto/bn/asm/x86_64-mont5.pl.orig
++++ crypto/openssl/crypto/bn/asm/x86_64-mont5.pl
+@@ -3090,11 +3090,19 @@
+ 
+ .align	32
+ .Lsqrx8x_break:
+-	sub	16+8(%rsp),%r8		# consume last carry
++	xor	$zero,$zero
++	sub	16+8(%rsp),%rbx		# mov 16(%rsp),%cf
++	adcx	$zero,%r8
+ 	mov	24+8(%rsp),$carry	# initial $tptr, borrow $carry
++	adcx	$zero,%r9
+ 	mov	0*8($aptr),%rdx		# a[8], modulo-scheduled
+-	xor	%ebp,%ebp		# xor	$zero,$zero
++	adc	\$0,%r10
+ 	mov	%r8,0*8($tptr)
++	adc	\$0,%r11
++	adc	\$0,%r12
++	adc	\$0,%r13
++	adc	\$0,%r14
++	adc	\$0,%r15
+ 	cmp	$carry,$tptr		# cf=0, of=0
+ 	je	.Lsqrx8x_outer_loop
+ 
+--- crypto/openssl/crypto/x509v3/v3_addr.c.orig
++++ crypto/openssl/crypto/x509v3/v3_addr.c
+@@ -130,10 +130,12 @@
+  */
+ unsigned int v3_addr_get_afi(const IPAddressFamily *f)
+ {
+-    return ((f != NULL &&
+-             f->addressFamily != NULL && f->addressFamily->data != NULL)
+-            ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
+-            : 0);
++    if (f == NULL
++            || f->addressFamily == NULL
++            || f->addressFamily->data == NULL
++            || f->addressFamily->length < 2)
++        return 0;
++    return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
+ }
+ 
+ /*
+--- secure/lib/libcrypto/amd64/x86_64-mont5.S.orig
++++ secure/lib/libcrypto/amd64/x86_64-mont5.S
+@@ -3077,11 +3077,19 @@
+ 
+ .align	32
+ .Lsqrx8x_break:
+-	subq	16+8(%rsp),%r8
++	xorq	%rbp,%rbp
++	subq	16+8(%rsp),%rbx
++	adcxq	%rbp,%r8
+ 	movq	24+8(%rsp),%rcx
++	adcxq	%rbp,%r9
+ 	movq	0(%rsi),%rdx
+-	xorl	%ebp,%ebp
++	adcq	$0,%r10
+ 	movq	%r8,0(%rdi)
++	adcq	$0,%r11
++	adcq	$0,%r12
++	adcq	$0,%r13
++	adcq	$0,%r14
++	adcq	$0,%r15
+ 	cmpq	%rcx,%rdi
+ 	je	.Lsqrx8x_outer_loop
+ 
diff --git a/share/security/patches/SA-17:11/openssl.patch.asc b/share/security/patches/SA-17:11/openssl.patch.asc
new file mode 100644
index 0000000000..f9b7fda158
--- /dev/null
+++ b/share/security/patches/SA-17:11/openssl.patch.asc
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.2.3 (FreeBSD)
+
+iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAloeToIACgkQ7Wfs1l3P
+aueWcg//RlFQI3WV/Tp0/Rr97YHQz1UD4rdqGLq+Thl3alcW3Qv/78SdAGe8uH+D
+gNsz75tNH5GAR1jrxawXQfrYttasfJgL+gmJxFZWx5NeVW0XbP2i9XIcc6cwgN5x
+hRWRbaBrnmGDwP/DFhqPr/Dc4bT8UpfEKSOKt51F5XiZMSNcNFoh3rbBCf4Vr631
+0NroVSCKNJAOKl0ZXF//tm3tbMmWgrI8SMlJjfDa9sqd0e3iJoouHe+z+kYDpbQ1
+tx78U1PaUV651T+gMc9ynyG4+V9TBFS+5pEjEw+IKBSQ4EW8rsEOzin80CdgcwJo
+uFmnCXyr/xOy9pNNWipug9qo0f1beQ5txo1LQb55eR5U4N58Pp90+OoMc7noAfBd
+kHJUJQkbqoi+CNivK0W7zLOcWw0iBWEhiI3FIEDXnXI86r7evVTHozPPJhcp276c
+k1KTJPxcs7YOEpKJYIXL5Ec3SXzXgGPwhUvq64sKrSSmB0nUb/vbH/SlDrT6Q99d
+ifFgpZ2gZmGVkQM0eIDeChQCD19xu1BLbw9mvlw8RqA1NIbqWlBdxmlLGY00iPy2
+TxiHJWaOdF0OnhS/LHe6BtKmhcpllpERMvCrDtlnG37DR07VPs5hM6mSFDwYZN7/
+0/MdsoODCQIOdsXMUo/d74F36/cPL/1QgPYpO3OdVpIovzl3MRQ=
+=CiUu
+-----END PGP SIGNATURE-----