Remove redundant checks in ssl_cert_dup

Patch by: Matt Caswell
Add checks to the return value of EVP_Cipher to prevent silent encryption failure.

Patch by: Matt Caswell <matt@openssl.org>
Advance to the next state variant when reusing messages.

Previously, state variant was not advanced, which resulted in state
being stuck in the st1 variant (usually "_A").

This broke certificate callback retry logic when accepting connections
that were using SSLv2 ClientHello (hence reusing the message), because
their state never advanced to SSL3_ST_SR_CLNT_HELLO_C variant required
for the retry code path.

Reported by Yichun Zhang (agentzh).
Patch by: Richard Levitte <levitte@openssl.org>
Verify that we have a sensible message len and fail if not
RT#3592 provides an instance where the OPENSSL_assert that this commit
replaces can be hit. I was able to recreate this issue by forcing the
underlying BIO to misbehave and come back with very small mtu values. This
happens the second time around the while loop after we have detected that the
MTU has been exceeded following the call to dtls1_write_bytes.

Patch by: Matt Caswell <matt@openssl.org>
Reject elliptic curve lists of odd lengths.

The Supported Elliptic Curves extension contains a vector of NamedCurves
of 2 bytes each, so the total length must be even. Accepting odd-length
lists was observed to lead to a non-exploitable one-byte out-of-bounds
read in the latest development branches (1.0.2 and master). Released
versions of OpenSSL are not affected.

Thanks to Felix Groebert of the Google Security Team for reporting this issue.

Patch by: Emilia Kasper <emilia@openssl.org>
Fix memory leak in SSL_new if errors occur.

Patch by: Matt Caswell <matt@openssl.org>
Check return value of ssl3_output_cert_chain

Patch by: Matt Caswell <matt@openssl.org>
Checkout return value of dtls1_output_cert_chain

Patch by: Matt Caswell <matt@openssl.org>
DTLS fixes for signed/unsigned issues

Patch by: Matt Caswell <matt@openssl.org>
Check for invalid divisors in BN_div.

Invalid zero-padding in the divisor could cause a division by 0.

Patch by: Emilia Kasper <emilia@openssl.org>
Add regression test for a bug in the x86_64-mont5 code

Patch by: Bodo Möller <bodo@openssl.org>
Premaster secret handling fixes

From BoringSSL
- Send an alert when the client key exchange isn't correctly formatted.
- Reject overly short RSA ciphertexts to avoid a (benign) out-of-bounds memory access.

Patch by: Adam Langley <agl@chromium.org>
Reject invalid constructed encodings.

According to X6.90 null, object identifier, boolean, integer and enumerated
types can only have primitive encodings: return an error if any of
these are received with a constructed encoding.

Patch by: Dr. Stephen Henson <steve@openssl.org>
Re-enable Camellia support