commit dbc38b8
Michael Forney
·
2026-05-05 17:24:31 +0000 UTC
parent ec29c11
libressl: Update to 4.3.1
6 files changed,
+75,
-75
+1,
-1
1@@ -12,7 +12,7 @@
2 /kbd-2.4.0.tar.gz
3 /less-643.tar.gz
4 /libbluray-1.3.4.tar.bz2
5-/libressl-4.2.1.tar.gz
6+/libressl-4.3.1.tar.gz
7 /libtermkey-0.22.tar.gz
8 /linux-7.0.tar.xz
9 /lpeg-1.1.0.tar.gz
+0,
-1
1@@ -574,7 +574,6 @@ lib('libssl.a', [[ssl/(
2 ssl_kex.c
3 ssl_lib.c
4 ssl_methods.c
5- ssl_packet.c
6 ssl_pkt.c
7 ssl_rsa.c
8 ssl_seclevel.c
1@@ -1,4 +1,4 @@
2-From 89e3854e0e38996edb165111a24b1bf498b392dc Mon Sep 17 00:00:00 2001
3+From 44bc6dfcdd2581f64fc869c8863dd590ea947033 Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Thu, 2 Apr 2026 23:52:53 -0700
6 Subject: [PATCH] Avoid implicit pointer sign conversions
7@@ -35,7 +35,7 @@ All other changes simply make explicit the conversions among pointers
8 to character types already being done. These implicit conversions
9 are constraint violations in ISO C.
10 ---
11- apps/openssl/ca.c | 6 +++---
12+ apps/openssl/ca.c | 7 ++++---
13 apps/openssl/cms.c | 2 +-
14 apps/openssl/s_client.c | 4 ++--
15 crypto/asn1/a_object.c | 12 ++++++------
16@@ -67,44 +67,45 @@ are constraint violations in ISO C.
17 ssl/tls13_lib.c | 3 ++-
18 ssl/tls13_record_layer.c | 2 +-
19 ssl/tls13_server.c | 10 +++++-----
20- 32 files changed, 95 insertions(+), 85 deletions(-)
21+ 32 files changed, 96 insertions(+), 85 deletions(-)
22
23 diff --git a/apps/openssl/ca.c b/apps/openssl/ca.c
24-index b644b74..0d78f63 100644
25+index a2e8a6836..5505983ff 100644
26 --- a/apps/openssl/ca.c
27 +++ b/apps/openssl/ca.c
28-@@ -2153,7 +2153,7 @@ do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
29+@@ -2197,7 +2197,7 @@ do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
30
31 if ((tm = X509_get_notAfter(ret)) == NULL)
32 goto err;
33-- row[DB_exp_date] = strndup(tm->data, tm->length);
34-+ row[DB_exp_date] = strndup((char *)tm->data, tm->length);
35+- row[DB_exp_date] = strndup(ASN1_STRING_get0_data(tm),
36++ row[DB_exp_date] = strndup((char *)ASN1_STRING_get0_data(tm),
37+ ASN1_STRING_length(tm));
38 if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
39 BIO_printf(bio_err, "Memory allocation failure\n");
40- goto err;
41-@@ -2280,7 +2280,7 @@ do_revoke(X509 *x509, CA_DB *db, int type, char *value)
42+@@ -2325,7 +2325,7 @@ do_revoke(X509 *x509, CA_DB *db, int type, char *value)
43
44 if ((tm = X509_get_notAfter(x509)) == NULL)
45 goto err;
46-- row[DB_exp_date] = strndup(tm->data, tm->length);
47-+ row[DB_exp_date] = strndup((char *)tm->data, tm->length);
48+- row[DB_exp_date] = strndup(ASN1_STRING_get0_data(tm),
49++ row[DB_exp_date] = strndup((char *)ASN1_STRING_get0_data(tm),
50+ ASN1_STRING_length(tm));
51 if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
52 BIO_printf(bio_err, "Memory allocation failure\n");
53- goto err;
54-@@ -2443,7 +2443,7 @@ do_updatedb(CA_DB *db)
55+@@ -2489,7 +2489,8 @@ do_updatedb(CA_DB *db)
56 cnt = -1;
57 goto err;
58 }
59-- a_tm_s = strndup(a_tm->data, a_tm->length);
60-+ a_tm_s = strndup((char *)a_tm->data, a_tm->length);
61+- a_tm_s = strndup(ASN1_STRING_get0_data(a_tm), ASN1_STRING_length(a_tm));
62++ a_tm_s = strndup((char *)ASN1_STRING_get0_data(a_tm),
63++ ASN1_STRING_length(a_tm));
64 if (a_tm_s == NULL) {
65 cnt = -1;
66 goto err;
67 diff --git a/apps/openssl/cms.c b/apps/openssl/cms.c
68-index 458ddb0..26197ea 100644
69+index 7430f4c93..a63d6e453 100644
70 --- a/apps/openssl/cms.c
71 +++ b/apps/openssl/cms.c
72-@@ -1530,7 +1530,7 @@ cms_main(int argc, char **argv)
73+@@ -1512,7 +1512,7 @@ cms_main(int argc, char **argv)
74 cfg.secret_keyid = NULL;
75 }
76 if (cfg.pwri_pass != NULL) {
77@@ -114,10 +115,10 @@ index 458ddb0..26197ea 100644
78 goto end;
79 if (CMS_add0_recipient_password(cms, -1, NID_undef,
80 diff --git a/apps/openssl/s_client.c b/apps/openssl/s_client.c
81-index 84718c1..90c203e 100644
82+index 2b05facc1..d12423d0f 100644
83 --- a/apps/openssl/s_client.c
84 +++ b/apps/openssl/s_client.c
85-@@ -193,7 +193,7 @@ static struct {
86+@@ -194,7 +194,7 @@ static struct {
87 char *cert_file;
88 int cert_format;
89 char *cipher;
90@@ -126,7 +127,7 @@ index 84718c1..90c203e 100644
91 char *connect;
92 int crlf;
93 int debug;
94-@@ -214,7 +214,7 @@ static struct {
95+@@ -215,7 +215,7 @@ static struct {
96 int nbio_test;
97 int no_servername;
98 char *npn_in;
99@@ -136,7 +137,7 @@ index 84718c1..90c203e 100644
100 int peekaboo;
101 char *port;
102 diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c
103-index 333ac60..25e7a2a 100644
104+index 333ac6034..25e7a2ae6 100644
105 --- a/crypto/asn1/a_object.c
106 +++ b/crypto/asn1/a_object.c
107 @@ -182,7 +182,7 @@ oid_add_arc_txt(CBB *cbb, uint64_t arc, int first)
108@@ -194,7 +195,7 @@ index 333ac60..25e7a2a 100644
109 err:
110 CBB_cleanup(&cbb);
111 diff --git a/crypto/asn1/a_time.c b/crypto/asn1/a_time.c
112-index 3deff56..10634c0 100644
113+index 3deff56ed..10634c067 100644
114 --- a/crypto/asn1/a_time.c
115 +++ b/crypto/asn1/a_time.c
116 @@ -99,7 +99,7 @@ ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm)
117@@ -207,7 +208,7 @@ index 3deff56..10634c0 100644
118 time(&now);
119 memset(tm, 0, sizeof(*tm));
120 diff --git a/crypto/asn1/a_time_tm.c b/crypto/asn1/a_time_tm.c
121-index dd28931..c0e0d62 100644
122+index dd2893167..c0e0d6245 100644
123 --- a/crypto/asn1/a_time_tm.c
124 +++ b/crypto/asn1/a_time_tm.c
125 @@ -96,7 +96,7 @@ tm_to_gentime(struct tm *tm, ASN1_TIME *atime)
126@@ -298,7 +299,7 @@ index dd28931..c0e0d62 100644
127 LCRYPTO_ALIAS(ASN1_GENERALIZEDTIME_check);
128
129 diff --git a/crypto/bio/b_dump.c b/crypto/bio/b_dump.c
130-index 3f67320..40b09dc 100644
131+index 3f673205c..40b09dc23 100644
132 --- a/crypto/bio/b_dump.c
133 +++ b/crypto/bio/b_dump.c
134 @@ -86,7 +86,7 @@ BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
135@@ -311,7 +312,7 @@ index 3f67320..40b09dc 100644
136 if (indent < 0)
137 indent = 0;
138 diff --git a/crypto/bio/bss_mem.c b/crypto/bio/bss_mem.c
139-index 0fa6317..afcd6b2 100644
140+index 0fa6317a2..afcd6b216 100644
141 --- a/crypto/bio/bss_mem.c
142 +++ b/crypto/bio/bss_mem.c
143 @@ -84,7 +84,7 @@ bio_mem_pending(struct bio_mem *bm)
144@@ -333,10 +334,10 @@ index 0fa6317..afcd6b2 100644
145 if (p[i] == '\n') {
146 i++;
147 diff --git a/crypto/bn/bn_convert.c b/crypto/bn/bn_convert.c
148-index ca5c7d7..60d0c86 100644
149+index ab5bc519c..cb006a209 100644
150 --- a/crypto/bn/bn_convert.c
151 +++ b/crypto/bn/bn_convert.c
152-@@ -253,7 +253,7 @@ BN_asc2bn(BIGNUM **bnp, const char *s)
153+@@ -261,7 +261,7 @@ BN_asc2bn(BIGNUM **bnp, const char *s)
154 if ((s_len = strlen(s)) == 0)
155 return 0;
156
157@@ -345,7 +346,7 @@ index ca5c7d7..60d0c86 100644
158
159 /* Handle negative sign. */
160 if (!CBS_peek_u8(&cbs, &v))
161-@@ -365,7 +365,7 @@ BN_bn2dec(const BIGNUM *bn)
162+@@ -373,7 +373,7 @@ BN_bn2dec(const BIGNUM *bn)
163 CBB_cleanup(&cbb);
164 freezero(data, data_len);
165
166@@ -354,7 +355,7 @@ index ca5c7d7..60d0c86 100644
167 }
168 LCRYPTO_ALIAS(BN_bn2dec);
169
170-@@ -468,7 +468,7 @@ BN_dec2bn(BIGNUM **bnp, const char *s)
171+@@ -476,7 +476,7 @@ BN_dec2bn(BIGNUM **bnp, const char *s)
172 if ((s_len = strlen(s)) == 0)
173 return 0;
174
175@@ -363,7 +364,7 @@ index ca5c7d7..60d0c86 100644
176
177 return bn_dec2bn_cbs(bnp, &cbs);
178 }
179-@@ -669,7 +669,7 @@ BN_hex2bn(BIGNUM **bnp, const char *s)
180+@@ -677,7 +677,7 @@ BN_hex2bn(BIGNUM **bnp, const char *s)
181 if ((s_len = strlen(s)) == 0)
182 return 0;
183
184@@ -373,7 +374,7 @@ index ca5c7d7..60d0c86 100644
185 return bn_hex2bn_cbs(bnp, &cbs);
186 }
187 diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
188-index cd8b663..6557324 100644
189+index cd8b66360..655732413 100644
190 --- a/crypto/bn/bn_print.c
191 +++ b/crypto/bn/bn_print.c
192 @@ -82,7 +82,7 @@ bn_print_bignum(BIO *bio, const BIGNUM *bn, int indent)
193@@ -386,7 +387,7 @@ index cd8b663..6557324 100644
194 if (BN_is_negative(bn)) {
195 if (BIO_printf(bio, " (Negative)") <= 0)
196 diff --git a/crypto/evp/e_sm4.c b/crypto/evp/e_sm4.c
197-index cde2f6c..9f8b13e 100644
198+index cde2f6c64..9f8b13ed1 100644
199 --- a/crypto/evp/e_sm4.c
200 +++ b/crypto/evp/e_sm4.c
201 @@ -237,9 +237,11 @@ sm4_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
202@@ -403,7 +404,7 @@ index cde2f6c..9f8b13e 100644
203 }
204
205 diff --git a/crypto/ocsp/ocsp_cl.c b/crypto/ocsp/ocsp_cl.c
206-index 460c1bc..15a70b1 100644
207+index 460c1bce5..15a70b1c5 100644
208 --- a/crypto/ocsp/ocsp_cl.c
209 +++ b/crypto/ocsp/ocsp_cl.c
210 @@ -410,7 +410,7 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
211@@ -425,7 +426,7 @@ index 460c1bc..15a70b1 100644
212 OCSPerror(OCSP_R_ERROR_IN_NEXTUPDATE_FIELD);
213 return 0;
214 diff --git a/crypto/pkcs7/pk7_attr.c b/crypto/pkcs7/pk7_attr.c
215-index f2e1780..cb6b2e8 100644
216+index f2e17806d..cb6b2e84f 100644
217 --- a/crypto/pkcs7/pk7_attr.c
218 +++ b/crypto/pkcs7/pk7_attr.c
219 @@ -192,7 +192,7 @@ PKCS7_add0_attrib_signing_time(PKCS7_SIGNER_INFO *si, ASN1_TIME *t)
220@@ -438,7 +439,7 @@ index f2e1780..cb6b2e8 100644
221 if (!PKCS7_add_signed_attribute(si, NID_pkcs9_signingTime, tm->type, tm))
222 goto err;
223 diff --git a/crypto/x509/x509_addr.c b/crypto/x509/x509_addr.c
224-index b4ee92a..615375d 100644
225+index b4ee92a14..615375dd6 100644
226 --- a/crypto/x509/x509_addr.c
227 +++ b/crypto/x509/x509_addr.c
228 @@ -1875,7 +1875,7 @@ addr_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509) *chain,
229@@ -451,7 +452,7 @@ index b4ee92a..615375d 100644
230
231 /* We need a non-empty chain to test against. */
232 diff --git a/crypto/x509/x509_constraints.c b/crypto/x509/x509_constraints.c
233-index 0773d2b..673a159 100644
234+index c4f32c9cf..597fdde06 100644
235 --- a/crypto/x509/x509_constraints.c
236 +++ b/crypto/x509/x509_constraints.c
237 @@ -347,7 +347,7 @@ x509_constraints_parse_mailbox(CBS *candidate,
238@@ -492,7 +493,7 @@ index 0773d2b..673a159 100644
239 if (!x509_constraints_valid_host(&host_cbs, 1))
240 return 0;
241 if (hostpart != NULL && !CBS_strdup(&host_cbs, hostpart))
242-@@ -648,8 +648,8 @@ x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint,
243+@@ -667,8 +667,8 @@ x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint,
244 *error = X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX;
245 goto err;
246 }
247@@ -503,7 +504,7 @@ index 0773d2b..673a159 100644
248 err:
249 free(hostpart);
250 return ret;
251-@@ -999,7 +999,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
252+@@ -1018,7 +1018,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
253 case GEN_DNS:
254 if (!x509_constraints_valid_domain_constraint(&cbs))
255 goto err;
256@@ -512,7 +513,7 @@ index 0773d2b..673a159 100644
257 error = X509_V_ERR_OUT_OF_MEM;
258 goto err;
259 }
260-@@ -1045,7 +1045,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
261+@@ -1064,7 +1064,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
262 case GEN_URI:
263 if (!x509_constraints_valid_domain_constraint(&cbs))
264 goto err;
265@@ -522,7 +523,7 @@ index 0773d2b..673a159 100644
266 goto err;
267 }
268 diff --git a/crypto/x509/x509_obj.c b/crypto/x509/x509_obj.c
269-index db1741c..43afeb8 100644
270+index db1741cc9..43afeb8cf 100644
271 --- a/crypto/x509/x509_obj.c
272 +++ b/crypto/x509/x509_obj.c
273 @@ -78,13 +78,13 @@ X509_NAME_ENTRY_add_object_cbb(CBB *cbb, const ASN1_OBJECT *aobj)
274@@ -555,10 +556,10 @@ index db1741c..43afeb8 100644
275
276 return buf;
277 diff --git a/crypto/x509/x509_utl.c b/crypto/x509/x509_utl.c
278-index 4be8630..0960fc9 100644
279+index 2e60834ed..0746ac0c5 100644
280 --- a/crypto/x509/x509_utl.c
281 +++ b/crypto/x509/x509_utl.c
282-@@ -508,7 +508,7 @@ hex_to_string(const unsigned char *buffer, long len)
283+@@ -504,7 +504,7 @@ hex_to_string(const unsigned char *buffer, long len)
284 err:
285 CBB_cleanup(&cbb);
286
287@@ -567,7 +568,7 @@ index 4be8630..0960fc9 100644
288 }
289 LCRYPTO_ALIAS(hex_to_string);
290
291-@@ -573,7 +573,7 @@ string_to_hex(const char *str, long *len)
292+@@ -569,7 +569,7 @@ string_to_hex(const char *str, long *len)
293 goto err;
294 }
295
296@@ -576,7 +577,7 @@ index 4be8630..0960fc9 100644
297 while (CBS_len(&cbs) > 0) {
298 /*
299 * Skipping only a single colon between two pairs of digits
300-@@ -817,7 +817,7 @@ equal_nocase(const unsigned char *pattern, size_t pattern_len,
301+@@ -813,7 +813,7 @@ equal_nocase(const unsigned char *pattern, size_t pattern_len,
302 skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
303 if (pattern_len != subject_len)
304 return 0;
305@@ -585,7 +586,7 @@ index 4be8630..0960fc9 100644
306 }
307
308 /* Compare using strncmp. */
309-@@ -832,7 +832,7 @@ equal_case(const unsigned char *pattern, size_t pattern_len,
310+@@ -828,7 +828,7 @@ equal_case(const unsigned char *pattern, size_t pattern_len,
311 skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
312 if (pattern_len != subject_len)
313 return 0;
314@@ -595,7 +596,7 @@ index 4be8630..0960fc9 100644
315
316 /*
317 diff --git a/crypto/x509/x509_verify.c b/crypto/x509/x509_verify.c
318-index f25e2b3..c52be9e 100644
319+index fc3fbc14d..95c6cf359 100644
320 --- a/crypto/x509/x509_verify.c
321 +++ b/crypto/x509/x509_verify.c
322 @@ -55,7 +55,8 @@ x509_verify_asn1_time_to_time_t(const ASN1_TIME *atime, int notAfter,
323@@ -609,7 +610,7 @@ index f25e2b3..c52be9e 100644
324 return 0;
325
326 diff --git a/crypto/x509/x509name.c b/crypto/x509/x509name.c
327-index 9a582d3..20498dd 100644
328+index e60d8b7a3..5fc4d2ee0 100644
329 --- a/crypto/x509/x509name.c
330 +++ b/crypto/x509/x509name.c
331 @@ -107,7 +107,8 @@ X509_NAME_get_text_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, char *buf,
332@@ -623,10 +624,10 @@ index 9a582d3..20498dd 100644
333 /* It must be a C string */
334 buf[text_len] = '\0';
335 diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
336-index 86b32ae..e760c0b 100644
337+index bcf26bec4..431af32f2 100644
338 --- a/ssl/s3_lib.c
339 +++ b/ssl/s3_lib.c
340-@@ -1548,7 +1548,7 @@ _SSL_set_tlsext_host_name(SSL *s, const char *name)
341+@@ -1551,7 +1551,7 @@ _SSL_set_tlsext_host_name(SSL *s, const char *name)
342 if (name == NULL)
343 return 1;
344
345@@ -636,10 +637,10 @@ index 86b32ae..e760c0b 100644
346 if (!tlsext_sni_is_valid_hostname(&cbs, &is_ip)) {
347 SSLerror(s, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
348 diff --git a/ssl/ssl_clnt.c b/ssl/ssl_clnt.c
349-index 0d3dcf7..9a59d98 100644
350+index 6ef81a170..ffc55e5f9 100644
351 --- a/ssl/ssl_clnt.c
352 +++ b/ssl/ssl_clnt.c
353-@@ -2330,7 +2330,7 @@ ssl3_send_client_change_cipher_spec(SSL *s)
354+@@ -2337,7 +2337,7 @@ ssl3_send_client_change_cipher_spec(SSL *s)
355 memset(&cbb, 0, sizeof(cbb));
356
357 if (s->s3->hs.state == SSL3_ST_CW_CHANGE_A) {
358@@ -649,7 +650,7 @@ index 0d3dcf7..9a59d98 100644
359 goto err;
360 if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
361 diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
362-index 630724e..32ab533 100644
363+index 630724e67..32ab5332a 100644
364 --- a/ssl/ssl_lib.c
365 +++ b/ssl/ssl_lib.c
366 @@ -2004,12 +2004,12 @@ SSL_export_keying_material(SSL *s, unsigned char *out, size_t out_len,
367@@ -670,10 +671,10 @@ index 630724e..32ab533 100644
368 LSSL_ALIAS(SSL_export_keying_material);
369
370 diff --git a/ssl/ssl_srvr.c b/ssl/ssl_srvr.c
371-index db4ba38..4dfaaf5 100644
372+index af4b20f6c..e877bb3f9 100644
373 --- a/ssl/ssl_srvr.c
374 +++ b/ssl/ssl_srvr.c
375-@@ -2371,7 +2371,7 @@ ssl3_send_server_change_cipher_spec(SSL *s)
376+@@ -2378,7 +2378,7 @@ ssl3_send_server_change_cipher_spec(SSL *s)
377 memset(&cbb, 0, sizeof(cbb));
378
379 if (s->s3->hs.state == SSL3_ST_SW_CHANGE_A) {
380@@ -683,7 +684,7 @@ index db4ba38..4dfaaf5 100644
381 goto err;
382 if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
383 diff --git a/ssl/ssl_tlsext.c b/ssl/ssl_tlsext.c
384-index 311c29b..e1c9b3c 100644
385+index d879b3304..2b75b0fbb 100644
386 --- a/ssl/ssl_tlsext.c
387 +++ b/ssl/ssl_tlsext.c
388 @@ -808,7 +808,8 @@ tlsext_sni_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
389@@ -697,7 +698,7 @@ index 311c29b..e1c9b3c 100644
390 *alert = SSL_AD_UNRECOGNIZED_NAME;
391 goto err;
392 diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
393-index 4ed76c9..1ad3b92 100644
394+index 4ed76c95a..1ad3b9255 100644
395 --- a/ssl/ssl_txt.c
396 +++ b/ssl/ssl_txt.c
397 @@ -170,8 +170,8 @@ SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
398@@ -712,10 +713,10 @@ index 4ed76c9..1ad3b92 100644
399 }
400
401 diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
402-index 57cd180..9797aab 100644
403+index 912bea592..c93107383 100644
404 --- a/ssl/t1_lib.c
405 +++ b/ssl/t1_lib.c
406-@@ -1018,6 +1018,7 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
407+@@ -1014,6 +1014,7 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
408 EVP_CIPHER_CTX *cctx = NULL;
409 SSL_CTX *tctx = s->initial_ctx;
410 int slen, hlen, iv_len;
411@@ -723,7 +724,7 @@ index 57cd180..9797aab 100644
412 int alert_desc = SSL_AD_INTERNAL_ERROR;
413 int ret = TLS1_TICKET_FATAL_ERROR;
414
415-@@ -1112,8 +1113,9 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
416+@@ -1108,8 +1109,9 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
417 if (HMAC_Update(hctx, CBS_data(&ticket_encdata),
418 CBS_len(&ticket_encdata)) <= 0)
419 goto err;
420@@ -735,10 +736,10 @@ index 57cd180..9797aab 100644
421 if (!CBS_mem_equal(&ticket_hmac, hmac, hlen))
422 goto derr;
423 diff --git a/ssl/tls13_client.c b/ssl/tls13_client.c
424-index 901b38f..414c9cb 100644
425+index 21d396079..a837b85fe 100644
426 --- a/ssl/tls13_client.c
427 +++ b/ssl/tls13_client.c
428-@@ -656,7 +656,7 @@ tls13_server_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
429+@@ -668,7 +668,7 @@ tls13_server_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
430 sizeof(tls13_cert_verify_pad)))
431 goto err;
432 if (!CBB_add_bytes(&cbb, tls13_cert_server_verify_context,
433@@ -747,7 +748,7 @@ index 901b38f..414c9cb 100644
434 goto err;
435 if (!CBB_add_u8(&cbb, 0))
436 goto err;
437-@@ -710,7 +710,7 @@ int
438+@@ -722,7 +722,7 @@ int
439 tls13_server_finished_recv(struct tls13_ctx *ctx, CBS *cbs)
440 {
441 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
442@@ -756,7 +757,7 @@ index 901b38f..414c9cb 100644
443 struct tls13_secret finished_key;
444 uint8_t transcript_hash[EVP_MAX_MD_SIZE];
445 size_t transcript_hash_len;
446-@@ -932,7 +932,7 @@ tls13_client_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
447+@@ -944,7 +944,7 @@ tls13_client_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
448 sizeof(tls13_cert_verify_pad)))
449 goto err;
450 if (!CBB_add_bytes(&sig_cbb, tls13_cert_client_verify_context,
451@@ -765,7 +766,7 @@ index 901b38f..414c9cb 100644
452 goto err;
453 if (!CBB_add_u8(&sig_cbb, 0))
454 goto err;
455-@@ -993,7 +993,7 @@ int
456+@@ -1005,7 +1005,7 @@ int
457 tls13_client_finished_send(struct tls13_ctx *ctx, CBB *cbb)
458 {
459 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
460@@ -775,7 +776,7 @@ index 901b38f..414c9cb 100644
461 uint8_t transcript_hash[EVP_MAX_MD_SIZE];
462 size_t transcript_hash_len;
463 diff --git a/ssl/tls13_key_schedule.c b/ssl/tls13_key_schedule.c
464-index 05bcf0f..19afc79 100644
465+index 05bcf0f00..19afc7999 100644
466 --- a/ssl/tls13_key_schedule.c
467 +++ b/ssl/tls13_key_schedule.c
468 @@ -160,8 +160,8 @@ tls13_hkdf_expand_label(struct tls13_secret *out, const EVP_MD *digest,
469@@ -826,10 +827,10 @@ index 05bcf0f..19afc79 100644
470 }
471
472 diff --git a/ssl/tls13_legacy.c b/ssl/tls13_legacy.c
473-index 6c33ecc..481ca9e 100644
474+index 6a06330b2..220999745 100644
475 --- a/ssl/tls13_legacy.c
476 +++ b/ssl/tls13_legacy.c
477-@@ -360,7 +360,7 @@ tls13_use_legacy_stack(struct tls13_ctx *ctx)
478+@@ -359,7 +359,7 @@ tls13_use_legacy_stack(struct tls13_ctx *ctx)
479 tls13_handshake_msg_data(ctx->hs_msg, &cbs);
480 if (!BUF_MEM_grow_clean(s->init_buf, CBS_len(&cbs)))
481 goto err;
482@@ -839,7 +840,7 @@ index 6c33ecc..481ca9e 100644
483 goto err;
484
485 diff --git a/ssl/tls13_lib.c b/ssl/tls13_lib.c
486-index c3470b2..5d9f159 100644
487+index c3470b293..5d9f15950 100644
488 --- a/ssl/tls13_lib.c
489 +++ b/ssl/tls13_lib.c
490 @@ -378,7 +378,8 @@ tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs)
491@@ -853,7 +854,7 @@ index c3470b2..5d9f159 100644
492
493 memset(&nonce, 0, sizeof(nonce));
494 diff --git a/ssl/tls13_record_layer.c b/ssl/tls13_record_layer.c
495-index f5604ad..9bdd61c 100644
496+index f5604adbe..9bdd61c91 100644
497 --- a/ssl/tls13_record_layer.c
498 +++ b/ssl/tls13_record_layer.c
499 @@ -467,7 +467,7 @@ static int
500@@ -866,7 +867,7 @@ index f5604ad..9bdd61c 100644
501 int ret = 0;
502
503 diff --git a/ssl/tls13_server.c b/ssl/tls13_server.c
504-index 650fd13..184b3d3 100644
505+index 604dab4cb..2beb72636 100644
506 --- a/ssl/tls13_server.c
507 +++ b/ssl/tls13_server.c
508 @@ -728,7 +728,7 @@ tls13_server_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
+1,
-1
1@@ -1 +1 @@
2-6d5c2f58583588ea791f4c8645004071d00dfa554a5bf788a006ca1eb5abd70b libressl-4.2.1.tar.gz
3+c2db42ace14e7d5419826fab35a742ec6e4d12725a051a51d0cea3c10ba0fa50 libressl-4.3.1.tar.gz
+1,
-1
1@@ -1 +1 @@
2-url = "https://cdn.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.2.1.tar.gz"
3+url = "https://cdn.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.3.1.tar.gz"
+1,
-1
1@@ -1 +1 @@
2-4.2.1 r0
3+4.3.1 r0