GNU Libtasn1 NEWS                                     -*- outline -*-

* Noteworthy changes in release 4.13 (released 2018-01-16) [stable]
- On indefinite string decoding, set a maximum level of allowed recursions
  (3) to protect the BER decoder from a stack exhaustion.

* Noteworthy changes in release 4.12 (released 2017-05-29) [stable]
- Corrected so-name version

* Noteworthy changes in release 4.11 (released 2017-05-27) [stable]
- Introduced the ASN1_TIME_ENCODING_ERROR error code to indicate
  an invalid encoding in the DER time fields.
- Introduced flag ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME. This flag
  allows decoding errors in time fields even when in strict DER mode.
  That is introduced in order to allow toleration of invalid times in
  X.509 certificates (which are common) even though strict DER adherence
  is enforced in other fields.
- Added safety check in asn1_find_node(). That prevents a crash
  when a very long variable name is provided by the developer.
  Note that this to be exploited requires controlling the ASN.1
  definitions used by the developer, i.e., the 'name' parameter of
  asn1_write_value() or asn1_read_value(). The library is
  not designed to protect against malicious manipulation of the
  developer assigned variable names. Reported by Jakub Jirasek.

* Noteworthy changes in release 4.10 (released 2017-01-16) [stable]
- Updated gnulib
- Removed -Werror from default compiler flags
- Fixed undefined behavior when negating integers in _asn1_ltostr().
  Issue found by oss-fuzz project (via gnutls):
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=388
- Pass the correct length to _asn1_get_indefinite_length_string in
  asn1_get_length_ber. This addresses reading 1-byte past the end
  of data. Issue found by oss-fuzz project (via gnutls):
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=330
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=331

* Noteworthy changes in release 4.9 (released 2016-07-25) [stable]
- Fixes to OID encoding of OIDs which have elements which exceed 2^32

* Noteworthy changes in release 4.8 (released 2016-04-11) [stable]
- Fixes to avoid reliance on C undefined behavior.
- Fixes to avoid an infinite recursion when decoding without
  the ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.
- Combined all the BER octet string decoding functions to a single
  one based on asn1_decode_simple_ber().

* Noteworthy changes in release 4.7 (released 2015-09-14) [stable]
- Fixed regression introduced in the decoding of multi-byte tags
  fix.

* Noteworthy changes in release 4.6 (released 2015-09-05) [stable]
- Allow decoding OCTET STRINGs with multi-byte tags.
- API and ABI changes since last version:
  asn1_get_object_id_der: New function

* Noteworthy changes in release 4.5 (released 2015-04-29) [stable]
- Corrected an invalid memory access in octet string decoding.
  Reported by Hanno Böck.

* Noteworthy changes in release 4.4 (released 2015-03-29) [stable]
- Corrected a two-byte stack overflow in asn1_der_decoding. Reported
  by Hanno Böck.

* Noteworthy changes in release 4.3 (released 2015-03-09) [stable]
- Added asn1_decode_simple_ber()

* Noteworthy changes in release 4.2 (released 2014-09-15) [stable]
- Added sanity checks in the decoding of time when
  ASN1_DECODE_FLAG_STRICT_DER is used.
- Fixes in the decoding of OCTET STRING when close to the end
  of the structure.

* Noteworthy changes in release 4.1 (released 2014-08-23) [stable]
- Corrected indefinite tag check in ANY constructions. That allows
  the decoding of BER-encoded structures that contain indefinite
  encoding within an ANY element.
- Added DER decoding flag ASN1_DECODE_FLAG_STRICT_DER. Over the
  years BER functionality was added to the decoder and this flag
  provides the way to disable it.
- API and ABI changes since last version:
  ASN1_DECODE_FLAG_STRICT_DER: New definition

* Noteworthy changes in release 4.0 (released 2014-06-26) [stable]
- Optimized asn1_der_decoding_startEnd(). It no longer requires the
  additional decoding step.
- asn1_read_value() understands the ?CURRENT keyword, which can be used
  to indicate the current element of a sequence, when the provided node
  is a sequence element.
- Several optimizations in DER decoding of structures with sequences
  containing many elements.
- asn1_der_decoding2() is introduced and allows flags to be passed on
  the decoding process. Currently only ASN1_DECODE_FLAG_ALLOW_PADDING is
  defined and that allows decoding DER structures that contain arbitrary
  data past their end. Contributed by Karel Slany.
- API and ABI changes since last version:
  ASN1_DECODE_FLAG_ALLOW_PADDING: New definition
  asn1_dup_node: New function
  asn1_der_decoding2: New function
  asn1_der_decoding_element: It is now an alias to asn1_der_decoding

* Noteworthy changes in release 3.6 (released 2014-05-25) [stable]
- Corrected an off-by-one error in ASN.1 DER tag decoding.
- Several improvements and new safety checks on DER decoding;
  issues found using Codenomicon TLS test suite.
- Marked asn1_der_decoding_element() as deprecated. Use
  asn1_der_decoding() instead.

* Noteworthy changes in release 3.5 (released 2014-05-01) [stable]
- Correctly handle decoding of recursive CHOICE options.
- Allow deleting elements of SET OF. Patch by Jean-Louis Thekekara.
- Several small bug fixes found by coverity.
- Code improvements contributed by Kurt Roeckx.

* Noteworthy changes in release 3.4 (released 2013-11-25) [stable]
- Added asn1_delete_structure2() which allows zeroizing the contents
  of all values in the structure prior to deinitialization.
- The parser accepts negative numbers in an INTEGER range (but
  still does no enforce them).

* Noteworthy changes in release 3.3 (released 2013-03-23) [stable]
- More precise overflow checks using gnulib's intprops module.
- Updates to compile in Android systems.

* Noteworthy changes in release 3.2 (released 2012-11-30) [stable]
- Corrected buffer overflow in the error reporting of the parser (reported
  by Andreas Metzler).

* Noteworthy changes in release 3.1 (released 2012-11-24) [stable]
- Completed rename of types:
  ASN1_ARRAY_TYPE -> asn1_static_node (was asn1_static_node_t)
- Added new types: VisibleString, NumericString, IA5String, TeletexString,
  PrintableString, UniversalString, BMPString, UTF8String. When re-defined
  a warning is being print instead of failing.
- Parser outputs more detailed syntax error messages.
- Added asn1_decode_simple_der() and asn1_encode_simple_der().
- Added asn1_read_value_type() to return value and type.
- Introduced ASN1_ETYPE_UTC_TIME and ASN1_ETYPE_GENERALIZED_TIME

* Noteworthy changes in release 3.0 (2012-10-28) [stable]
- Added tool in tests/ to benchmark X.509 structure decoding.
- Added asn1_read_node_value() to obtain a node's value.
- Optimizations in internal tree allocation.
- Optimizations in tree search.
- libtasn1.h no longer exports internal structures.
- Types were renamed for consistency:
  ASN1_DATA_NODE -> asn1_data_node_st
  ASN1_ARRAY_TYPE -> asn1_static_node
  ASN1_TYPE -> asn1_node
  ASN1_TYPE_EMPTY -> NULL
  static_struct_asn -> asn1_static_node_st
  node_asn_struct -> asn1_node_st
  node_asn -> asn1_node_st
  (the old types are still available as definitions)

* Noteworthy changes in release 2.13 (2012-05-31) [stable]
- Updated fix for DER decoding issue to not depend on specific compilers.
- Updated DER decoding check to apply to short form integers as well.

* Noteworthy changes in release 2.12 (2012-03-19) [stable]
- Cleanup license headers.
- build: Update gnulib files.
- Corrected DER decoding issue (reported by Matthew Hall).
  Added self check to detect the problem, see tests/Test_overflow.c.
  This problem can lead to at least remotely triggered crashes, see
  further analysis on the libtasn1 mailing list.

* Noteworthy changes in release 2.11 (2011-11-25) [stable]
- qa: Now builds without compiler warnings with Solaris CC.
- qa: Added clang analysis.  Fixed cyclomatic complexity output.
- tests: Added self-test of bit string functions.
- build: Added windows/libtasn14win.mk rules to produce Windows binaries.
- build: Don't hard code path to perl in doc/gdoc.
- Various minor fixes.

* Noteworthy changes in release 2.10 (2011-10-25) [stable]
- lib: Small optimization, possibly working around gcc/valgrind issue.
- build: Update gnulib files.
- asn1Coding: actually implement the -c parameter.
- asn1Decoding: the -c parameter serves no purpose, remove it.
- doc: Add examples to asn1Coding and asn1Decoding description.

* Noteworthy changes in release 2.9 (2010-12-06) [stable]
- tests: Link to gnulib to avoid build error related to 'rpl_ftello' on Solaris.
  Reported by Dagobert Michelsen.
- doc: Fix bug reporting address to point at help-libtasn1@gnu.org.
- doc: Fix Returns: documentation in Texinfo.  Reported by Jeffrey Walton.
- build: Update gnulib files.

* Noteworthy changes in release 2.8 (2010-09-25) [stable]
- Update gnulib files.
- Use Libtool 2.2.10 to ease MinGW64 builds.

* Noteworthy changes in release 2.7 (2010-05-20) [stable]
- Doc: Build a PDF manual using GTK-DOC.
- Doc: Fix of asn1_check_version, documentation was missing from last release.
- Build: Avoid warnings about ignored visibility attributes on Windows.

* Noteworthy changes in release 2.6 (2010-04-20) [stable]
- Fix build failure on platforms without support for GNU LD version scripts.
- libtasn1: Simplified implementation of asn1_check_version.
- tests: Improved self-checks.
- Update gnulib files, fix many syntax-check nits, indent code,
  fix license templates.

* Noteworthy changes in release 2.5 (2010-03-15) [stable]
- doc: Improve GTK-DOC comments.
- misc: Updated gnulib files.

* Noteworthy changes in release 2.4 (2010-01-18) [stable]
- Doc fixes.
- Updated gnulib files.
- Clean up copyright notices.

* Noteworthy changes in release 2.3 (2009-07-29) [stable]
- Libtasn1 is now an official GNU project.
- Solve build problem on Tru64 related to TRUE/FALSE.
- More careful decoding of OIDs.
- Fixed warning in ASN1.y.
- Use "Software libraries" info dircategory.
- Drop GPL/LGPL copies from the manual (not needed there).
- New configure parameters to set packaging specific information.
  The parameters are --with-packager, --with-packager-version, and
  --with-packager-bug-reports.  See
  <http://article.gmane.org/gmane.comp.lib.gnulib.bugs/17791> for more
  details.

* Noteworthy changes in release 2.2 (2009-05-20) [stable]
- Change how the ASN1_API decorator is used in libtasn1.h, for GTK-DOC.
- Changed license of libtasn1.pc from GPLv3+ to LGPLv2.1+.
  Reported by Jeff Cai <Jeff.Cai@Sun.COM>.
- Building with many warning flags now requires --enable-gcc-warnings.
- Some warnings fixed.

* Noteworthy changes in release 2.1 (2009-04-17) [stable]
- Fix compilation failure on platforms that can't generate empty archives,
  e.g., Mac OS X.  Reported by David Reiser <dbreiser@gmail.com>.

* Noteworthy changes in release 2.0 (2009-04-13) [stable]
- Optimized tree generation.
- ASN1 parser code re-generated using Bison 2.4.1.
- Build with more warning flags.  Many compiler warnings fixed.
- Compiled with -fvisibility=hidden by default if supported.
  See http://gcc.gnu.org/wiki/Visibility
- The libtasn1-config tool has been removed.
  For application developers, please stop using libtasn1-config for
  finding libtasn1, use proper autoconf checks or pkg-config instead.
  For users that need a libtasn1 that provides a libtasn1-config
  script (for use with older applications), use libtasn1 v1.x instead.
  Version 1.x is still supported.

* Noteworthy changes in release 1.8 (2009-01-16) [stable]
- Fix crlf self-test under Mingw+Wine.
- Fix build problems on platforms that lack stdint.h.
  Reported by Dagobert Michelsen <dam@opencsw.org> in
  <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3377>.

* Noteworthy changes in release 1.7 (2008-11-17) [stable]
- Add libtasn1-config for compatibility.
  Please stop use it as it will disappear in v2.0!
  Use standard AC_CHECK_FUNCS autoconf tests or pkg-config instead.
- Read PKCS#12 blob as binary file, fixes self-tests under Mingw.
- Fix use of __attribute__ ((deprecated)) to work on non-GCC (#106548).

* Noteworthy changes in release 1.6 (2008-11-10) [stable]
- Fixed namespace violation for MAX_NAME_SIZE and MAX_ERROR_DESCRIPTION_SIZE.
  The new names are ASN1_MAX_NAME_SIZE and ASN1_MAX_ERROR_DESCRIPTION_SIZE.
- Fixed namespace violation for libtasn1_perror and libtasn1_strerror.
  The new names are asn1_perror and asn1_strerror.
- Fix namespace violation for LIBASN1_VERSION.
  The new name is ASN1_VERSION.
- Decoder can now decode BER encoded octet strings.
- doc: Change license on the manual to GFDLv1.3+.
- doc: Sync gdoc script with GnuTLS, changes license on man-pages to GAP.
- doc: Improve gtk-doc manual.
- Assumes system has strdup and string.h.
- Remove libtasn1-config and libtasn1.m4,
  use standard AC_CHECK_FUNCS autoconf tests or pkg-config instead.
- Change detection of when to use a linker version script,
  use --enable-ld-version-script or --disable-ld-version-script to
  override auto-detection logic.
- API and ABI changes since last version:
  asn1_get_length_ber: New function.
  ASN1_VERSION: New symbol, replaces LIBTASN1_VERSION.
  asn1_strerror: New function, replaces libtasn1_strerror.
  asn1_perror: New function, replaces libtasn1_perror.
  libtasn1_strerror: Marked as deprecated.
  libtasn1_perror: Marked as deprecated.
  LIBTASN1_VERSION: Deprecated.

* Noteworthy changes in release 1.5 (2008-07-29) [stable]
- Update gnulib files.
- Fix memory leaks, from Christian Grothoff <christian@grothoff.org>.

* Noteworthy changes in release 1.4 (2008-04-21) [stable]
- Update gnulib files.
- Replace uses of alloca with malloc.

* Noteworthy changes in release 1.3 (2008-02-01) [stable]
- Handle 'INTEGER { ... } (a..b)' regression.
  Revert parts of earlier fix.  asn1Parser can now again parse src/pkix.asn1.
  The ASN1.c file was generated using Bison 2.3.
- Move examples from src/ to new directory examples/.
- Duplicate copy of divergated pkix.asn removed.
- Merge unnecessary lib/defines.h into lib/int.h.
- Configure no longer tries to use gcc -pipe.
- Update gnulib files.
- Fix mem leak in self-test.

* Noteworthy changes in release 1.2 (2007-12-10) [stable]
- Update gnulib files.

* Noteworthy changes in release 1.1 (2007-08-31) [stable]
- Fix bug that made asn1_check_version believe that 1.0 is older than 0.3.10.

* Noteworthy changes in release 1.0 (2007-08-31) [stable]
- The self-tests, command line tools and build infrastructure have
  been re-licensed from GPLv2 to GPLv3.
- Doc fixes.
- Update gnulib files.

* Noteworthy changes in release 0.3.10 (2007-05-25)
- Update gnulib files.

* Noteworthy changes in release 0.3.9 (2007-03-02)
- In generated code, config.h is pulled in if HAVE_CONFIG_H.
- Development changes: changed from CVS to GIT as an experiment.
  I push my changes to <http://repo.or.cz/w/libtasn1.git>.
- Autoconf 2.61 and automake 1.10 is required.

* Noteworthy changes in release 0.3.8 (2006-11-16)
- Fix reading of binary files in asn1Decoding, for Windows.

* Noteworthy changes in release 0.3.7 (2006-10-19)
- When asn1_der_coding encoded a TYPE_NULL and the output buffer is
  NULL, it would not increment the counter properly, so the size of
  the required buffer would be off by one.  Fixed.  Reported by
  Stephen Wrobleski <steve@localtoast.org>.
- Fix configure to respect user-definable flags.  Reported by "Diego
  'Flameeyes' Pettenò" <flameeyes@gentoo.org>.
- The --help and --version outputs from the tools have been improved.

* Noteworthy changes in release 0.3.6 (2006-08-13)
- Fix man pages to use \- instead of - for negative signs (as in "-1").
- Add -I's when building in src/, so that unistd.h etc is found on
  systems that doesn't have them.
- Valgrind isn't used for cross-compilation by default, and there is
  also --disable-valgrind-tests to unconditionally disable it.
- Valgrind is invoked without parameters, put things you like into
  ~/.valgrindrc instead.

* Noteworthy changes in release 0.3.5 (2006-06-27)
- Fix asn1_octet_der to handle writes of zero-length buffers, before
  it did not write the ASN.1 length for a zero-length buffer.  This caused
  ASN.1 encodings to be incorrect on 64-bit platforms.
- Add self test that attempt to trigger the above bug.
- Fix test of -Wno-pointer-sign.
- Improve cross-compilation to MinGW by using AC_LIBTOOL_WIN32_DLL.

* Noteworthy changes in release 0.3.4 (2006-05-10)
- Really fix encodings.
- Add new self test, tests/Test_encoding.c.
- Self tests are ran under valgrind, if it is available.
- We test for the -Wno-pointer-sign parameter before using it.

* Noteworthy changes in release 0.3.3 (2006-05-07)
- Add some 'const' to prototypes.
- Remove some 'unsigned' keywords.
- Corrected asn1_der_coding() bug introduced when it became reentrant.
  Now it produces correct encodings.

* Noteworthy changes in release 0.3.2
- Corrected bug in asn1_der_coding() which overwrited some
  data in the original structure.
- The asn1Parser, asn1Coding and asn1Decoding programs are now installed.

* Noteworthy changes in release 0.3.1
- Support constant size bit strings, as in 'BIT STRING (SIZE(42))'.
  Reported by Cyril Holweck <cyril.holweck@q-free.com>.
- Add two more APIs required by GnuTLS.
- New public APIs:
  asn1_find_node function
  asn1_copy_node

* Noteworthy changes in release 0.3.0
- Export DER utility functions, mostly so that GnuTLS can avoid using
  libtasn1 internals.
- The _asn1* symbols are not exported in the shared library file (when
  using GNU ld).
- The library can now be built using Visual Studio, and the project
  files are included in windows/.
- New public APIs:
  asn1_get_tag_der
  asn1_octet_der
  asn1_get_octet_der
  asn1_bit_der
  asn1_get_bit_der
  asn1_get_length_der
  asn1_length_der

* Noteworthy changes in release 0.2.18
- Fix out-of-bounds access in DER decoding, reported by Evgeny Legerov.
- Add 'const' keyword to some prototypes, thanks to Frediano ZIGLIO.
- Fixed typo in src/Makefile.am to make it build with objdir != srcdir,
  thanks to Bernard Leak.
- Update of gnulib files.
- Typo fixes in comments, e.g. finish libasn1 to libtasn1 renaming,
  use LGPL boiler plate on some files in lib/.

* Noteworthy changes in release 0.2.17
- Fixed typo to make it build.

* Noteworthy changes in release 0.2.16
- * Noteworthy changes in release script added again.

* Noteworthy changes in release 0.2.15
- Gnulib is used to implement memmove if your system does not have it.
- Simplified assert/error handling slightly.

* Noteworthy changes in release 0.2.14
- Some build fixes.
- Pkg-config script 'libtasn1.pc' added.
- Postal address to FSF in license updated.

* Noteworthy changes in release 0.2.13
- * Noteworthy changes in release number in libtasn1.h updated properly.

* Noteworthy changes in release 0.2.12
- Manual converted to Texinfo format.
- Manual in GTK-DOC and DevHelp formats added.
- Man pages for all functions added.
- Various internal cleanups.

* Noteworthy changes in release 0.2.11
- Added the self test with "make check" target
- Added management of ANY type with null length
- Corrected some writes to invalid data.

* Noteworthy changes in release 0.2.10
- Added scripts to assist in libtasn1 version detection
  from configure scripts.
- Corrected a DER decoding bug which was reported
  by Max Vozeler <max@hinterhof.net>.

* Noteworthy changes in release 0.2.9
- Accept negative numbers as range in INTEGER declarations

* Noteworthy changes in release 0.2.8
- Add asn1_delete_element function

* Noteworthy changes in release 0.2.7
- Added versioned symbols.

* Noteworthy changes in release 0.2.6
- ASN.1 parser accepts these kinds of integer definitions:
  "INTEGER (5 | 10)" and
  "INTEGER (5)"
- Comments start at "--" and finish at the "end of line" or
  with another "--".

* Noteworthy changes in release 0.2.5
- Bug fix in ordering procedure for SET OF and SEQUENCE OF
  types coding.
- Manage structured format (BER encoding) in
  asn1_der_decoding, asn1_decoding_element and
  asn1_der_decoding_startEnd for OCTET STRING type.
- Manage SEQUENCE and SET empty structure.
- Manage "indefinite length method" in asn1_der_decoding,
  asn1_decoding_element and asn1_der_decoding_startEnd
  for the following types:
  SEQUENCE, SEQUENCE OF, SET, and SET OF.
- Bug fix in asn1_read_value with NULL parameter in case
  of BIT STRING

* Noteworthy changes in release 0.2.4
- Bug fix in asn1_der_coding with NULL parameter
- Manage DEFAULT option with OBJECT IDENTIFIER

* Noteworthy changes in release 0.2.3
- Chenge asn1_find_structure_from_oid prototype
- Chenge asn1_find_structure_from_oid prototype
- Add ASN1_MEM_ALLOC_ERROR return value

* Noteworthy changes in release 0.2.2
- Add vector length check in asn1_der_coding function
- Add vector length check in asn1_der_coding function
- Add vector length check in asn1_read_value function
- Add asn1_check_version function

* Noteworthy changes in release 0.2.1
- Add asn1_find_structure_from_oid function
- Add asn1_read_tag function

* Noteworthy changes in release 0.2.0
- Support for other platforms
- Change asn1_create_element function interface (dest_name not needed any more)
- Change OBJECT IDENTIFIER syntax: numbers must be separated by dot in
  asn1_write_element and asn1_read_element functions (e.g. "1.2.3.4")

* Noteworthy changes in release 0.1.2
- Added GeneralString type
- Fixed a DER encoding bug when nested tags are used

* Noteworthy changes in release 0.1.1
- Renamed to libtasn1
- Functions which return a string for error description
  now accept a NULL argument.
- License is now GNU Lesser GPL

* Noteworthy changes in release 0.1.0
- Initial release

----------------------------------------------------------------------
Copyright (C) 2002-2014 Free Software Foundation, Inc.
Copying and distribution of this file, with or without modification,
are permitted in any medium without royalty provided the copyright
notice and this notice are preserved.