GitLab

Clean up the previous b64 patch and apply it to all places where
otrl_base64_decode() is called.

This prevents a one-byte heap buffer overflow.  Thanks to Justin
Ferguson <jnferguson@gmail.com> for the report.

(It wouldn't appear in practice, as we don't send around >2GB objects,
but still, better to close a possible attack vector.)

Preparing for 4.0.0-beta2.

	UPGRADING: Draft upgrading doc
	src/instag.c: Adding warning to instag file

	* src/message.c: Returning proper gcry types to avoid
	compile warnings (detected on 64-bit environments).

Most imporantly, otrl_instag_get_new() wasn't returning the value it
computed!

	* packaging/fedora/libotr.spec: Including Paul Wouters's updated libotr.spec file from 2009-06-12

	* AUTHORS:
	* README:
	* test_suite/
	* toolkit/otr_parse.c:
	* toolkit/otr_remac.c:
	* toolkit/parse.c:
	* toolkit/parse.h:
	* src/auth.c:
	* src/auth.h:
	* src/context.c:
	* src/context.h:
	* src/message.c:
	* src/message.h:
	* src/privkey.c:
	* src/privkey.h:
	* src/proto.c:
	* src/proto.h:
	* src/serial.h:
	* src/tests.c:
	* src/userstate.c:
	* src/userstate.h: More changes for instance tags (Rob Smits).

2009-06-11:

	* src/auth.c:
	* src/auth.h:
	* src/context.c:
	* src/context.h:
	* src/context_priv.h:
	* src/message.c:
	* src/message.h:
	* src/privkey.c:
	* src/privkey.h:
	* src/proto.c:
	* src/proto.h:
	* src/serial.h:
	* src/tests.c:
	* src/userstate.c:
	* src/userstate.h: Core instance tag functionality (Lisa Du).

	* Protocol-v2.html: Edits from Göran Weinholt
	<goran@weinholt.se>

2009-04-28:

	* src/auth.c: pubkey_type should be shifted by 8, not 16.  It
	doesn't matter right now, because it's always 0, but still.
	(Thanks to Can Tang.)

2008-08-15:

	* src/Makefile.am:
	* src/context.c:
	* src/context.h:
	* src/context_priv.c:
	* src/context_priv.h:
	* src/message.c:
	* src/message.h:
	* src/proto.c:
	* src/proto.h: Willy Lew's updates of the libotr API

2008-08-06:

	* src/proto.c: gcc 4.2 with -O2 assumes that integer overflow

	* src/proto.c: gcc 4.2 with -O2 assumes that integer overflow
	never occurs when optimizing away tests, including those for
	integer overflow.  The code was made more specific.

	* src/privkey.h:
	* src/privkey.c: Add otrl_privkey_generate_cancel to handle the
	case that the background key generation thread is cancelled or
	fails.

	* configure.ac: Update libtool version to match 4.0.0.

	* src/privkey-t.h:
	* src/privkey.c:
	* src/privkey.h:
	* src/userstate.c:
	* src/userstate.h: Support for generating privkeys in a
	background thread.

	Support for applications requesting an extra session key
	that can be used for things like file transfers.

	* message.c:
	* dh.h:
	* dh.c: Support for applications requesting an extra session key
	that can be used for things like file transfers. (Almost done.)

	* version.h: Change version number to 4.0.0 (but still far from
	release).

	* tlv.h:
	* proto.h:
	* proto.c:
	* message.h:
	* message.c:
	* dh.h:
	* dh.c: Support for applications requesting an extra session key
	that can be used for things like file transfers.

	* message.h:
	* message.c: Applications now use the handle_smp_event callback
	to handle SMP events, rather than having to hardcode part of the
	SMP state machine themselves.

	* README: Release version 3.2.0.

	* UPGRADING: Clarify what was new in 3.1.0, what was changed
	in 3.2.0.

	* UPGRADING: Update documentation.

	* README:
	* toolkit/*.[ch]:
	* src/*.[ch]: Update copyright dates to 2004-2008.

	* src/tlv.h: Add new OTRL_TLV_SMP1Q TLV type to indicate an
	instance of the first SMP message, with an explicit question.

	* src/sm.h:
	* src/sm.c: More carefully track the progress of the SMP using a
	new smp_prog_state field.  Also keep track of whether Bob
	received an explicit question from Alice using a new
	received_question field.

	* src/message.c: Handle explicit questions for the SMP.

	* src/message.c: Behave better if an SMP message fails
	verification.

	* README:
	* configure.ac:
	* src/version.h: Update version number to 3.2.0.