From 34306a227b5d58b15606ffaaf2c22bd48c779ce0 Mon Sep 17 00:00:00 2001
From: delphij <delphij@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Sat, 5 Dec 2015 09:53:58 +0000
Subject: [PATCH] Fix OpenSSL multiple vulnerabilities.

Security:	FreeBSD-SA-15:26.openssl
Approved by:	so


git-svn-id: svn://svn.freebsd.org/base/releng/9.3@291854 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 UPDATING                              | 4 ++++
 crypto/openssl/crypto/asn1/tasn_dec.c | 7 +++++--
 sys/conf/newvers.sh                   | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/UPDATING b/UPDATING
index 2a395bd78..2d16a49dc 100644
--- a/UPDATING
+++ b/UPDATING
@@ -11,6 +11,10 @@ handbook:
 Items affecting the ports and packages system can be found in
 /usr/ports/UPDATING.  Please read that file before running portupgrade.
 
+20151205	p31	FreeBSD-SA-15:26.openssl
+
+	Fix OpenSSL X509_ATTRIBUTE memory leak. [SA-15:26]
+
 20151104	p30	FreeBSD-SA-15:25.ntp [revised]
 			FreeBSD-EN-15:19.kqueue
 			FreeBSD-EN-15:20.vm
diff --git a/crypto/openssl/crypto/asn1/tasn_dec.c b/crypto/openssl/crypto/asn1/tasn_dec.c
index 01b284d79..8552ddb18 100644
--- a/crypto/openssl/crypto/asn1/tasn_dec.c
+++ b/crypto/openssl/crypto/asn1/tasn_dec.c
@@ -167,6 +167,8 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
 	int otag;
 	int ret = 0;
 	ASN1_VALUE **pchptr, *ptmpval;
+	int combine = aclass & ASN1_TFLG_COMBINE;
+	aclass &= ~ASN1_TFLG_COMBINE;
 	if (!pval)
 		return 0;
 	if (aux && aux->asn1_cb)
@@ -532,7 +534,8 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
 	auxerr:
 	ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_AUX_ERROR);
 	err:
-	ASN1_item_ex_free(pval, it);
+	if (combine == 0)
+		ASN1_item_ex_free(pval, it);
 	if (errtt)
 		ERR_add_error_data(4, "Field=", errtt->field_name,
 					", Type=", it->sname);
@@ -758,7 +761,7 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
 		{
 		/* Nothing special */
 		ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
-							-1, 0, opt, ctx);
+							-1, tt->flags & ASN1_TFLG_COMBINE, opt, ctx);
 		if (!ret)
 			{
 			ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 595f00209..7152c11ca 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="9.3"
-BRANCH="RELEASE-p30"
+BRANCH="RELEASE-p31"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi
-- 
2.42.0