import of OpenSSL 0.9.8k
This commit was generated by cvs2git to track changes on a CVS vendor
branch.
import of OpenSSL 0.9.8k
resolve conflicts
crankus majoris
resync libssl/libcrypto pod documentation - quite a few more pages and
MLINKS; feedback and ok jmc@
add ipsCA as a valid authority.

ok beck@
pull string for memcpy;  ok hshoexer@
remove expired certificates and add startcom ltd.
beck@ ok
another cert that makes godaddy.com and launchpad.net (among others) happy.
found by Guillaume Protet (guillaume dot protet at mortheres dot info)
while testing bzr update.  deraadt@ ok
s/Mhz/MHz/, MHz is a multiple of the SI unit hertz (whose symbol is Hz).
pull Ben Lauries blind prefix injection fix for CVE-2009-3555 from
openssl 0.9.8l; crank minor version; ok djm@ deraadt@; initially from jsg@
plug a memory leak; found by parfait, ok djm
ipsca has expired
new ipsca root.
add a fix from OpenSSL CVS for SA38200.

"Modify compression code so it avoids using ex_data free functions.
This stops applications that call CRYPTO_free_all_ex_data()
prematurely leaking memory."

looks ok to markus@
Use MACHINE_CPU instead of MACHINE_ARCH to pick the correct machine dependent
files or directories when applicable.
The inspiration and name of MACHINE_CPU come from NetBSD, although the way to
provide it to Makefiles is completely different.
ok kettenis@
cherrypick patch from OpenSSL 0.9.8m:

  *) Always check bn_wexpend() return values for failure.  (CVE-2009-3245)
     [Martin Olsson, Neel Mehta]
Build all manual pages in base with mandoc(1) instead of groff,
excepting the tbl(1) pages, which are less than twenty.

"commit the diff that enables it, now"  deraadt@
Security fix for CVE-2010-0740

"In TLS connections, certain incorrectly formatted records can cause an OpenSSL
client or server to crash due to a read attempt at NULL."

http://openssl.org/news/secadv_20100324.txt

ok deraadt@ djm@ sthen@