Commit: 8a99c5529bb8702acca4ebf2dd764a4cb7acaaad - ffftp (git)

Loweynet

Commit MetaInfo

• Revision: 8a99c5529bb8702acca4ebf2dd764a4cb7acaaad (tree)
• Time: 2016-09-27 20:59:04
• Author: s_kawamoto <s_kawamoto@user...>
• Commiter: s_kawamoto

Log Message

Update OpenSSL to 1.1.0b.

Change Summary

• modified: FFFTP_Eng_Release/FFFTP.exe
• modified: FFFTP_Eng_Release_64/FFFTP.exe
• modified: Release/FFFTP.exe
• modified: Release_64/FFFTP.exe
• modified: Resource/FFFTP.rc
• modified: Resource_eng/ffftp.rc
• modified: common.h
• modified: contrib/openssl/CHANGES
• modified: contrib/openssl/NEWS
• modified: contrib/openssl/README
• modified: contrib/openssl/include/openssl/opensslv.h
• modified: dist/amd64/libeay32.dll
• modified: dist/amd64/ssleay32.dll
• modified: dist/libeay32.dll
• modified: dist/ssleay32.dll
• modified: socketwrapper.c

Incremental Difference

Binary files a/FFFTP_Eng_Release/FFFTP.exe and b/FFFTP_Eng_Release/FFFTP.exe differ

Binary files a/FFFTP_Eng_Release_64/FFFTP.exe and b/FFFTP_Eng_Release_64/FFFTP.exe differ

Binary files a/Release/FFFTP.exe and b/Release/FFFTP.exe differ

Binary files a/Release_64/FFFTP.exe and b/Release_64/FFFTP.exe differ

--- a/Resource/FFFTP.rc
+++ b/Resource/FFFTP.rc
@@ -242,7 +242,7 @@ FONT 9, "MS Shell Dlg", 0, 0, 0x0
 BEGIN
     DEFPUSHBUTTON   "OK",IDOK,133,294,50,14
     ICON            ffftp,-1,7,4,20,20
-    CTEXT           "FFFTP Ver 1.99a-20160924",-1,113,11,90,8
+    CTEXT           "FFFTP Ver 1.99a-20160927",-1,113,11,90,8
     CTEXT           "FFFTP‚Ífreeware‚Å‚·",-1,7,279,305,8
     CTEXT           "Copyright(C) 1997-2010 Sota & ‚²‹¦—Í‚¢‚½‚¾‚¢‚½•ûX\nCopyright (C) 2011-2016 FFFTP Project (Hiromichi Matsushima, Suguru Kawamoto, IWAMOTO Kouichi, vitamin0x, ‚¤‚ȁ[, Asami, fortran90, tomo1192, Yuji Tanaka, Moriguchi Hirokazu, ‚Ó‚¤‚¹‚ñ)",-1,7,25,305,44,SS_NOPREFIX
     CTEXT           "",ABOUT_JRE,7,96,305,8
@@ -2213,8 +2213,8 @@ nodrop_csr              CURSOR                  "nodrop_c.cur"
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,99,1,6
- PRODUCTVERSION 1,99,1,6
+ FILEVERSION 1,99,1,7
+ PRODUCTVERSION 1,99,1,7
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -2232,12 +2232,12 @@ BEGIN
             VALUE "Comments", "‚±‚ê‚̓tƒŠ[ƒ\ƒtƒgƒEƒGƒA‚Å‚·B"
             VALUE "CompanyName", "Sota, FFFTP Project"
             VALUE "FileDescription", "FFFTP"
-            VALUE "FileVersion", "1, 99, 1, 6"
+            VALUE "FileVersion", "1, 99, 1, 7"
             VALUE "InternalName", "FFFTP"
             VALUE "LegalCopyright", "Copyright (C) 1997-2010 Sota & ‚²‹¦—Í‚¢‚½‚¾‚¢‚½•ûX\nCopyright (C) 2011-2016 FFFTP Project (Hiromichi Matsushima, Suguru Kawamoto, IWAMOTO Kouichi, vitamin0x, ‚¤‚ȁ[, Asami, fortran90, tomo1192, Yuji Tanaka, Moriguchi Hirokazu, ‚Ó‚¤‚¹‚ñ)."
             VALUE "OriginalFilename", "FFFTP.exe"
             VALUE "ProductName", "FFFTP"
-            VALUE "ProductVersion", "1, 99, 1, 6"
+            VALUE "ProductVersion", "1, 99, 1, 7"
         END
     END
     BLOCK "VarFileInfo"

--- a/Resource_eng/ffftp.rc
+++ b/Resource_eng/ffftp.rc
@@ -242,7 +242,7 @@ FONT 9, "MS Shell Dlg", 0, 0, 0x0
 BEGIN
     DEFPUSHBUTTON   "OK",IDOK,132,296,50,14
     ICON            ffftp,-1,7,4,20,20
-    CTEXT           "FFFTP Ver 1.99a-20160924",-1,110,11,90,8
+    CTEXT           "FFFTP Ver 1.99a-20160927",-1,110,11,90,8
     CTEXT           "FFFTP is freeware",-1,7,281,301,8
     CTEXT           "Copyright(C) 1997-2010 Sota && cooperators\nCopyright (C) 2011-2016 FFFTP Project (Hiromichi Matsushima, Suguru Kawamoto, IWAMOTO Kouichi, vitamin0x, unarist, Asami, fortran90, tomo1192, Yuji Tanaka, Moriguchi Hirokazu, Fu-sen)",-1,7,25,301,44
     CTEXT           "",ABOUT_JRE,7,93,301,8
@@ -2253,8 +2253,8 @@ nodrop_csr              CURSOR                  "nodrop_c.cur"
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,99,1,6
- PRODUCTVERSION 1,99,1,6
+ FILEVERSION 1,99,1,7
+ PRODUCTVERSION 1,99,1,7
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -2272,12 +2272,12 @@ BEGIN
             VALUE "Comments", "This software is Free Software"
             VALUE "CompanyName", "Sota, FFFTP Project"
             VALUE "FileDescription", "FFFTP"
-            VALUE "FileVersion", "1, 99, 1, 6"
+            VALUE "FileVersion", "1, 99, 1, 7"
             VALUE "InternalName", "FFFTP"
             VALUE "LegalCopyright", "Copyright (C) 1997-2010 Sota & cooperators\nCopyright (C) 2011-2016 FFFTP Project (Hiromichi Matsushima, Suguru Kawamoto, IWAMOTO Kouichi, vitamin0x, unarist, Asami, fortran90, tomo1192, Yuji Tanaka, Moriguchi Hirokazu, Fu-sen)."
             VALUE "OriginalFilename", "FFFTP.exe"
             VALUE "ProductName", "FFFTP"
-            VALUE "ProductVersion", "1, 99, 1, 6"
+            VALUE "ProductVersion", "1, 99, 1, 7"
         END
     END
     BLOCK "VarFileInfo"

--- a/common.h
+++ b/common.h
@@ -72,16 +72,16 @@
 //#define PROGRAM_VERSION_NUM		1972		/* バージョン */
 // 64ビット対応
 #ifdef _WIN64
-#define VER_STR					"1.99a-20160924 64bit"
+#define VER_STR					"1.99a-20160927 64bit"
 #else
-#define VER_STR					"1.99a-20160924"
+#define VER_STR					"1.99a-20160927"
 #endif
 #define VER_NUM					1990		/* 設定バージョン */
 #define PROGRAM_VERSION_NUM		1990		/* バージョン */
 // ソフトウェア自動更新
 // リリースバージョンはリリース予定年（10進数4桁）+月（2桁）+日（2桁）+通し番号（0スタート2桁）とする
 // 2014年7月31日中の30個目のリリースは2014073129
-#define RELEASE_VERSION_NUM		2016092400	/* リリースバージョン */
+#define RELEASE_VERSION_NUM		2016092700	/* リリースバージョン */
 
 
 // SourceForge.JPによるフォーク

--- a/contrib/openssl/CHANGES
+++ b/contrib/openssl/CHANGES
@@ -2,6 +2,23 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 1.1.0a and 1.1.0b [26 Sep 2016]
+
+  *) Fix Use After Free for large message sizes
+
+     The patch applied to address CVE-2016-6307 resulted in an issue where if a
+     message larger than approx 16k is received then the underlying buffer to
+     store the incoming message is reallocated and moved. Unfortunately a
+     dangling pointer to the old location is left which results in an attempt to
+     write to the previously freed location. This is likely to result in a
+     crash, however it could potentially lead to execution of arbitrary code.
+
+     This issue only affects OpenSSL 1.1.0a.
+
+     This issue was reported to OpenSSL by Robert Święcki.
+     (CVE-2016-6309)
+     [Matt Caswell]
+
  Changes between 1.1.0 and 1.1.0a [22 Sep 2016]
 
   *) OCSP Status Request extension unbounded memory growth

--- a/contrib/openssl/NEWS
+++ b/contrib/openssl/NEWS
@@ -5,6 +5,10 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
+  Major changes between OpenSSL 1.1.0a and OpenSSL 1.1.0b [26 Sep 2016]
+
+      o Fix Use After Free for large message sizes (CVE-2016-6309)
+
   Major changes between OpenSSL 1.1.0 and OpenSSL 1.1.0a [22 Sep 2016]
 
       o OCSP Status Request extension unbounded memory growth (CVE-2016-6304)

--- a/contrib/openssl/README
+++ b/contrib/openssl/README
@@ -1,5 +1,5 @@
 
- OpenSSL 1.1.0a 22 Sep 2016
+ OpenSSL 1.1.0b 26 Sep 2016
 
  Copyright (c) 1998-2016 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

--- a/contrib/openssl/include/openssl/opensslv.h
+++ b/contrib/openssl/include/openssl/opensslv.h
@@ -39,11 +39,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x1010001fL
+# define OPENSSL_VERSION_NUMBER  0x1010002fL
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.1.0a-fips  22 Sep 2016"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.1.0b-fips  26 Sep 2016"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.1.0a  22 Sep 2016"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.1.0b  26 Sep 2016"
 # endif
 
 /*-

Binary files a/dist/amd64/libeay32.dll and b/dist/amd64/libeay32.dll differ

Binary files a/dist/amd64/ssleay32.dll and b/dist/amd64/ssleay32.dll differ

Binary files a/dist/libeay32.dll and b/dist/libeay32.dll differ

Binary files a/dist/ssleay32.dll and b/dist/ssleay32.dll differ

--- a/socketwrapper.c
+++ b/socketwrapper.c
@@ -161,15 +161,15 @@ BOOL LoadOpenSSL()
 #ifdef ENABLE_PROCESS_PROTECTION
 	// 同梱するOpenSSLのバージョンに合わせてSHA1ハッシュ値を変更すること
 #if defined(_M_IX86)
-	// ssleay32.dll 1.1.0a
-	RegisterTrustedModuleSHA1Hash("\xBF\x25\x75\x85\x71\x67\x5D\x3E\x07\x11\x40\xE2\x47\xC0\xE0\x5C\xB2\xCD\xC3\x12");
-	// libeay32.dll 1.1.0a
-	RegisterTrustedModuleSHA1Hash("\x0A\x29\x8D\xAC\x2C\xA2\xB1\x43\x2B\x9F\xA4\xD8\x14\x80\x9B\x04\xD9\x23\x73\x41");
+	// ssleay32.dll 1.1.0b
+	RegisterTrustedModuleSHA1Hash("\x62\xF4\x7E\xA1\xD9\x24\xE5\xCF\xA7\xBE\x04\xD9\x55\x89\xA6\xF8\x96\x62\x43\xAD");
+	// libeay32.dll 1.1.0b
+	RegisterTrustedModuleSHA1Hash("\xB7\x63\x47\x26\x24\xE7\x99\x68\xC7\x46\xAD\x59\xBD\xAF\xD0\x44\x86\x35\xB4\x27");
 #elif defined(_M_AMD64)
-	// ssleay32.dll 1.1.0a
-	RegisterTrustedModuleSHA1Hash("\xCE\x74\x3E\x3D\x88\x2C\xC4\xAC\x33\x53\xD4\x5A\xAE\x17\x4F\x59\x01\x8A\x6E\xAB");
-	// libeay32.dll 1.1.0a
-	RegisterTrustedModuleSHA1Hash("\xA1\x40\x78\xD1\xD5\x47\xCA\x47\x8A\x03\x93\xBC\x9E\xAD\xFA\xCA\x65\x1F\x36\x78");
+	// ssleay32.dll 1.1.0b
+	RegisterTrustedModuleSHA1Hash("\x10\xCD\x83\x06\x6F\xBE\x4D\x58\xE3\x0B\x2C\xF0\xA1\x13\x1B\xA2\x55\xB0\x6D\xE1");
+	// libeay32.dll 1.1.0b
+	RegisterTrustedModuleSHA1Hash("\x4F\x8E\xFB\xF6\x10\x50\x62\xA0\xB4\xF3\x28\x08\x10\x63\x67\x9E\xFD\xBE\xAC\x17");
 #endif
 #endif
 	g_hOpenSSL = LoadLibrary("ssleay32.dll");