Port OBJ_create and a2d_ASN1_OBJECT from LibreSSL 2.5.4, keep the added
objects by encoding and NID, and look them up in OBJ_obj2txt before the
built-in table. OBJ_cleanup now drops them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SSL_select_next_proto validated both lists and threw for an empty list,
a zero-length entry or a truncated entry. The firmware 13.42 report on
PR #9785 shows the module runs LibreSSL 3.4.1's loop with no validation:
a zero-length entry is negotiated, no overlap returns the first supported
entry with its unchecked length byte, even for an empty supported list,
and an empty peer list has no overlap. Follow that loop, and throw only
for the null pointers the module would read. The test places each
reported list before a guard page and checks the six reported cases.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
The six exports this branch implements left the pending-export count
line at the number before them. Set it to the NotImplemented_nid_no_patch
count in Export.cpp after the merge of main, 293.
X509_STORE_CTX_get_ex_data reads the context's ex_data stack, and
X509_STORE_CTX_get1_chain copies the chain stack and raises each
certificate's reference count. UI_set_result checks a prompt or verify
result against its bounds, queuing UI_R_RESULT_TOO_SMALL or _LARGE and
marking the UI redoable, copies it, or picks a boolean answer.
PKCS12_PBE_add, OBJ_cleanup and SSL_load_error_strings return without
an observable effect, as LibreSSL 2.5.4 does while no object is added
and no error string is read.
The opt-in guest_libressl_oracle test downloads the LibreSSL 2.5.4
tarball at build time, checks its SHA-256, builds libcrypto and libssl
and compares the AES, digest, DES parity and error-string exports of
libSceLibreSsl and libSceLibreSsl3 with them, printing the cases and
differences per function. The option is off by default and adds no
download then. See #12537.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
i2t_ASN1_OBJECT threw and was declared without parameters. It now
prints an object's long name, or its short name, or its dotted OID, as
OBJ_obj2txt does in LibreSSL 2.5.4, the version string the module
holds: the NID is the object's own or found by the same binary search
over the same order, an unassigned NID reports OBJ_R_UNKNOWN_NID for
each name lookup, a truncated subidentifier returns 0 after the parts
already written, and arcs past 64 bits are printed exactly.
The 956 objects (short and long names, NID, OID) and their search order
are generated from 2.5.4's objects.txt and obj_mac.num with its own
objects.pl and obj_dat.pl, so d2i code can later hand out the same
static objects LibreSSL does.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
