File openssl-1.0.1e-env-zlib.patch of Package mingw32-openssl

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-1.0.1e-env-zlib.patch of Package mingw32-openssl (Revision bd3b7a4f55845b19d320f85496e39b40)

Currently displaying revision bd3b7a4f55845b19d320f85496e39b40 , Show latest

Index: openssl-1.0.1j/doc/ssl/SSL_COMP_add_compression_method.pod
===================================================================
--- openssl-1.0.1j.orig/doc/ssl/SSL_COMP_add_compression_method.pod	2014-12-15 08:35:31.917833254 +0100
+++ openssl-1.0.1j/doc/ssl/SSL_COMP_add_compression_method.pod	2014-12-15 08:35:31.913833296 +0100
@@ -47,6 +47,13 @@
 been standardized, the compression API will most likely be changed. Using
 it in the current state is not recommended.
 
+It is also not recommended to use compression if data transfered contain
+untrusted parts that can be manipulated by an attacker as he could then
+get information about the encrypted data. See the CRIME attack. For
+that reason the default loading of the zlib compression method is
+disabled and enabled only if the environment variable B<OPENSSL_DEFAULT_ZLIB>
+is present during the library initialization.
+
 =head1 RETURN VALUES
 
 SSL_COMP_add_compression_method() may return the following values:
Index: openssl-1.0.1j/ssl/ssl_ciph.c
===================================================================
--- openssl-1.0.1j.orig/ssl/ssl_ciph.c	2014-12-15 08:35:31.917833254 +0100
+++ openssl-1.0.1j/ssl/ssl_ciph.c	2014-12-15 08:35:31.913833296 +0100
@@ -140,6 +140,8 @@
  * OTHERWISE.
  */
 
+/* for secure_getenv */
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <openssl/objects.h>
 #ifndef OPENSSL_NO_COMP
@@ -456,7 +458,7 @@
 
 			MemCheck_off();
 			ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp);
-			if (ssl_comp_methods != NULL)
+			if (ssl_comp_methods != NULL && secure_getenv("OPENSSL_DEFAULT_ZLIB") != NULL)
 				{
 				comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
 				if (comp != NULL)

Places

File openssl-1.0.1e-env-zlib.patch of Package mingw32-openssl (Revision bd3b7a4f55845b19d320f85496e39b40)

Places