| Home Page | Download | Manual | GitHub | Mediawiki | Mailing lists | Contributions | Related links |
Crypto++ 5.6.5 was released on October 11, 2016. The 5.6.5 release was mostly a maintenance release. The release included two CVE fixes.
The first, CVE-2016-7420, was a procedural finding due to external build systems failing to define NDEBUG for release builds. The gap was the project's failure to tell users to define NDEBUG. The second, CVE-2016-7544, was a potential memory corruption on Windows platforms when using Microsoft compilers due to use of _malloca and _freea.
Due to CVE-2016-7420 and the possibility for an unwanted assert to egress data, users and distros are encouraged to recompile the library and all dependent programs.
The download is available from the Crypto++ website. The checksums for the download are below.
Mirrors for the download are below. Note that GitHub and Sourceforge checksums on the ZIP or TAR are different because each creates the archive from sources.
The release notes for Crypto++ 5.6.5 follows.
The bug fix and minor issue list for Crypto++ 5.6.5 follows. Most non-trivial issues are tracked for auditing and C&A purposes, but the list may not be complete. A number in parenthesis is the GitHub Issue number, if it was tracked. Sometimes a Git commit is referenced, but many trivial GitHub commits are omitted. Missing Issue numbers or lack of consecutiveness usually indicates feature requests and "won't fix/can't fix" type reports.
The list below has about 20 issues. The project's test scripts, cryptest.sh and cryptest.nmake, uncovered about 16 (80.0%) of them.
Below is a list of all files that were added or deleted at Crypto++ 5.6.5.
The header file ossig.h is new and needs to be distributed. Additions to TestScripts can probably be ignored.
$ git diff-tree -r --summary CRYPTOPP_5_6_4 CRYPTOPP_5_6_5 | grep -v "change" | awk '{$2=$3=""; print $0}' | grep -E '(\.h|\.cpp|\.txt|\.dat)'
create TestScripts/coverity-linux.txt
create TestScripts/coverity-macosx.txt
create TestScripts/coverity-windows.txt
create TestScripts/cryptest-coverity.cpp
create TestVectors/tls_chacha.txt
create ossig.h
If you start getting bug reports on missing symbols that implicate unsigned long long, then this applies to you. Depending on what you are using in Crypto++, it may surface as:
// Linux:
cryptest.exe: symbol lookup error: .../cryptest.exe: undefined symbol: CryptoPP::RandomNumberStore::TransferTo2(CryptoPP::BufferedTransformation&,
unsigned long long&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool)
cryptest.exe: symbol lookup error: .../cryptest.exe: undefined symbol: CryptoPP::Whirlpool::InitState(unsigned long long*)
// OS X:
dyld: Symbol not found: CryptoPP::RandomPool::GenerateIntoBufferedTransformation(CryptoPP::BufferedTransformation&, std::string const&, unsigned long long)
Referenced from: .../cryptest.exe
Expected in: .../libcryptopp.dylib
in .../cryptest.exe
In Crypto++ 5.6.4 and below word64 was unconditionally defined to unsigned long long on 32-bit and 64-bit platforms. Crypto++ 5.6.5 defined word64 to unsigned long on 64-bit machines due to compile problems with GCC and Clang when using SSE and NEON data types through intrinsics. Crypto++ 5.6.5 increased use of SSE and NEON intrinsics, and calls to SSE and NEON APIs had some hacks that were cleaned up.
Below if from config.h, and it is reposnsible for the "missing unsigned long long" issue.
#if defined(_MSC_VER) || defined(__BORLANDC__)
typedef unsigned __int64 word64;
#define W64LIT(x) x##ui64
#elif (_LP64 || __LP64__)
typedef unsigned long word64;
#define W64LIT(x) x##UL
#else
typedef unsigned long long word64;
#define W64LIT(x) x##ULL
#endif
To go back to Crypto++ 5.6.4, you have two choices. First, you can use config.compat in place of config.h to restore the compatibility. Second, you can remove the __LP64__ block. Be advised we did not test this configuration, so it may not completely clear the "missing unsigned long long" issue.
#if defined(_MSC_VER) || defined(__BORLANDC__)
typedef unsigned __int64 word64;
#define W64LIT(x) x##ui64
#else
typedef unsigned long long word64;
#define W64LIT(x) x##ULL
#endif
Since this break was unknown to the project, it was identified as a gap in our testing process. Commit 385a3914d6cfdc88 added a script to test for missing symbols by linking cryptest.exe against different versions of the dynamic library. For example, Crypto++ 5.6.4 cryptest.exe will runtime link against Crypto++ 5.6.5 libcryptopp.so or libcryptopp.dylib to nsure no symbols go missing.