Update Cryptlib to 3.4.8

3rdp/build/cl-mingw32-static.patch

---- makefile.orig	2018-01-09 22:46:54.000000000 -0500
-+++ makefile	2018-01-29 14:27:27.783443000 -0500
-@@ -1894,8 +1894,8 @@
+--- ./makefile.orig	2024-10-03 22:59:48.000000000 -0400
++++ ./makefile	2024-10-31 00:50:21.454187000 -0400
+@@ -2168,8 +2168,8 @@
  
  MINGW32_NT-6.1:
  	$(MAKE) OSNAME=win32 target-init
 -	$(MAKE) $(DEFINES) EXTRAOBJS="$(WIN32ASMOBJS)" \
--		CFLAGS="$(XCFLAGS) -O2 -Wl,--subsystem,windows,--output-def,cl32.def"
+-		CFLAGS="$(XCFLAGS) -O2 -m32 -Wl,--subsystem,windows,--output-def,cl32.def"
 +	$(MAKE) OSNAME=win32 $(DEFINES) EXTRAOBJS="$(WIN32ASMOBJS)" \
-+		CFLAGS="$(XCFLAGS) -O2 -Wl,--subsystem,windows,--output-def,cl32.def -DSTATIC_LIB"
++		CFLAGS="$(XCFLAGS) -O2 -m32 -Wl,--subsystem,windows,--output-def,cl32.def -DSTATIC_LIB"
  
- # NCR MP-RAS: Use the NCR cc.  The "-DNCR_UST" is needed to enable threading
- #			  (User-Space Threads).
+ MINGW32_NT-10.0:
+ 	$(MAKE) OSNAME=win32 target-init

3rdp/build/cl-mingw64-is-really-new.patch

---- misc/os_detect.h.orig	2024-10-12 01:44:33.718810000 -0400
-+++ misc/os_detect.h	2024-10-12 01:46:02.749506000 -0400
-@@ -266,22 +266,41 @@
+--- ./misc/os_detect.h.orig	2024-10-31 00:50:21.864298000 -0400
++++ ./misc/os_detect.h	2024-10-31 00:50:23.600240000 -0400
+@@ -293,22 +293,41 @@
    #define VC_GE_2017( version )		( ( version ) >= 1910 )
    #define VC_GE_2019( version )		( ( version ) >= 1920 )
  #else

3rdp/build/cl-mingw64-thread-handles.patch

---- kernel/thread.h.orig	2024-10-12 01:31:26.417813000 -0400
-+++ kernel/thread.h	2024-10-12 01:38:37.740140000 -0400
-@@ -3529,7 +3529,7 @@
+--- ./kernel/thread.h.orig	2023-08-15 22:09:06.000000000 -0400
++++ ./kernel/thread.h	2024-10-31 00:50:23.566804000 -0400
+@@ -3582,7 +3582,7 @@
  
  /* Object handles */
  
--#define THREAD_HANDLE			DWORD
+-#define THREAD_HANDLE			HANDLE 
 +#define THREAD_HANDLE			unsigned int
  #define MUTEX_HANDLE			HANDLE
  
  /* Mutex management functions.  InitializeCriticalSection() doesn't return 
-@@ -3647,7 +3647,7 @@
+@@ -3712,7 +3712,7 @@
  #if defined( __WIN32__ )
    #define THREADFUNC_DEFINE( name, arg ) \
  				unsigned __stdcall name( void *arg )

3rdp/build/cl-mingw64-unicode-gibble.patch

---- random/win32.c.orig	2024-10-12 02:34:13.133481000 -0400
-+++ random/win32.c	2024-10-12 02:41:42.385903000 -0400
+--- ./random/win32.c.orig	2023-06-06 23:19:08.000000000 -0400
++++ ./random/win32.c	2024-10-31 00:50:23.732586000 -0400
 @@ -2105,8 +2105,8 @@
  	#pragma warning( push )
  	#pragma warning( disable:28159 )	/* Incorrect annotation in lmstats.h */

3rdp/build/cl-moar-objects.patch

---- misc/config.h.latest	2021-12-14 17:00:07.622835000 -0500
-+++ misc/config.h	2021-12-14 17:00:21.476740000 -0500
-@@ -14,6 +14,7 @@
+--- ./misc/config.h.orig	2024-10-31 00:50:22.201744000 -0400
++++ ./misc/config.h	2024-10-31 00:50:22.381882000 -0400
+@@ -66,6 +66,7 @@
  #define USE_CERTLEVEL_STANDARD
  #define PREFER_ECC
  #define USE_SSH_CTR

3rdp/build/cl-netbsd-hmac-symbol.patch

---- context/ctx_hsha2.c.orig	2024-02-03 23:52:01.086437000 -0500
-+++ context/ctx_hsha2.c	2024-02-04 00:00:35.711741000 -0500
+--- ./context/ctx_hsha2.c.orig	2023-07-20 17:49:26.000000000 -0400
++++ ./context/ctx_hsha2.c	2024-10-31 00:50:23.214091000 -0400
 @@ -285,7 +285,7 @@
  /* Hash data using HMAC-SHA2 */
  
@@ -24,7 +24,7 @@
  				};
  
  		/* Switch to the appropriate variant of SHA-2.  Note that the 
-@@ -528,7 +528,7 @@
+@@ -531,7 +531,7 @@
  static const CAPABILITY_INFO capabilityInfo = {
  	CRYPT_ALGO_HMAC_SHA2, bitsToBytes( 256 ), "HMAC-SHA2", 9,
  	MIN_KEYSIZE, bitsToBytes( 256 ), CRYPT_MAX_KEYSIZE,

3rdp/build/cl-netbsd-no-getfsstat.patch

---- random/unix.c.orig	2023-06-15 21:31:00.000000000 -0400
-+++ random/unix.c	2024-02-04 00:09:42.916028000 -0500
-@@ -560,8 +560,10 @@
+--- ./random/unix.c.orig	2024-09-17 19:34:46.000000000 -0400
++++ ./random/unix.c	2024-10-31 00:50:23.241421000 -0400
+@@ -564,8 +564,10 @@
  									/* IPv4 routing table */
  	{ 6, { CTL_NET, AF_ROUTE, 0, AF_INET6, NET_RT_DUMP, 0 }, 5 },
  									/* IPv6 routing table */
@@ -11,7 +11,7 @@
  
  	/* VM info */
  #ifdef VM_LOADAVG 
-@@ -747,7 +749,7 @@
+@@ -751,7 +753,7 @@
  
  /* BSD-specific polling using getfsstat() */
  

3rdp/build/cl-no-odbc.patch

---- tools/ccopts.sh.orig	2023-12-31 07:18:39.570162000 -0500
-+++ tools/ccopts.sh	2023-12-31 07:19:32.075029000 -0500
-@@ -369,25 +369,25 @@
+--- ./tools/ccopts.sh.orig	2024-10-31 00:50:21.784137000 -0400
++++ ./tools/ccopts.sh	2024-10-31 00:50:21.888849000 -0400
+@@ -361,25 +361,25 @@
  esac
  if [ -z "$DISABLE_AUTODETECT" ] && [ $HASDYNLOAD -gt 0 ] ; then
  	# ODBC support

3rdp/build/cl-no-pie.patch

---- tools/ccopts.sh.orig	2023-12-31 11:49:24.760461000 -0500
-+++ tools/ccopts.sh	2023-12-31 11:49:32.686744000 -0500
-@@ -1253,9 +1253,9 @@
- # Enable ASLR.  We only do this for static libs, for shared libs it's
- # already been handled via -fpic.
+--- ./tools/ccopts.sh.orig	2024-10-31 01:25:49.233934000 -0400
++++ ./tools/ccopts.sh	2024-10-31 01:26:47.463749000 -0400
+@@ -743,16 +743,16 @@
+ # assembled with ar without any linker involvement, so only the final binary
+ # that it's linked with can specify -pie.
  
--if [ "$COMPILER_VER" -ge 42 ] && [ $SHARED -le 0 ] ; then
--	CCARGS="$CCARGS -fpie -Wl,-pie" ;
+-if [ $SHARED -eq 0 ] ; then
+-	if [ $ISCLANG -gt 0 ] && [ "$COMPILER_VER" -ge 30 ] ; then
+-		CCARGS="$CCARGS -fpie" ;
+-		echo "Enabling ASLR support, consider linking the final binary with -pie." >&2 ;
+-	fi ;
+-	if [ $ISGCC -gt 0 ] && [ "$COMPILER_VER" -ge 42 ] ; then
+-		CCARGS="$CCARGS -fpie" ;
+-		echo "Enabling ASLR support, consider linking the final binary with -pie." >&2 ;
+-	fi ;
 -fi
-+#if [ "$COMPILER_VER" -ge 42 ] && [ $SHARED -le 0 ] ; then
-+#	CCARGS="$CCARGS -fpie -Wl,-pie" ;
++#if [ $SHARED -eq 0 ] ; then
++#	if [ $ISCLANG -gt 0 ] && [ "$COMPILER_VER" -ge 30 ] ; then
++#		CCARGS="$CCARGS -fpie" ;
++#		echo "Enabling ASLR support, consider linking the final binary with -pie." >&2 ;
++#	fi ;
++#	if [ $ISGCC -gt 0 ] && [ "$COMPILER_VER" -ge 42 ] ; then
++#		CCARGS="$CCARGS -fpie" ;
++#		echo "Enabling ASLR support, consider linking the final binary with -pie." >&2 ;
++#	fi ;
 +#fi
  
- # Newer versions of gcc support marking the stack as nonexecutable (e.g.
- # using the x86-64 NX bit), so if it's available we enable it.  This is
+ # If the system supports recursive and/or robust mutexes, indicate that
+ # they're available.  We don't use recursive mutexes by default because they

3rdp/build/cl-no-safe-stack.patch

---- tools/ccopts.sh.orig	2023-12-31 07:57:24.600204000 -0500
-+++ tools/ccopts.sh	2023-12-31 07:59:35.674830000 -0500
-@@ -601,25 +601,25 @@
+--- ./tools/ccopts.sh.orig	2024-10-31 00:50:22.100746000 -0400
++++ ./tools/ccopts.sh	2024-10-31 00:50:22.176028000 -0400
+@@ -616,21 +616,21 @@
  	return $RESULT ;
  	}
  
 -if [ $ISCLANG -gt 0 ] && [ $ISSPECIAL -eq 0 ] ; then
 -	if [ $COMPILER_VER -ge 47 ] ; then
--		if [ "$OSNAME" = "Darwin" ] || [ "$OSNAME" = "OpenBSD" ] ; then
--			# The versions of clang shipped with OS X or OpenBSD don't
--			# support -fsanitize=safe-stack even as late as clang 12, so
--			# there's not much that we can do.
--			CCARGS="$CCARGS" ;
--		elif ! hasSafeStackLibs ; then
--			echo "  " >&2 ;
+-		SAFESTACK_SUPPORT=checkSafeStack ;
+-		case $SAFESTACK_SUPPORT in
+-			0)	;;
+-			1)	echo "  " >&2 ;
 -				echo "  (This system supports clang stack sanitization via -fsanitize=safe-stack" >&2 ;
 -				echo "   in $0, however the necessary libclang_rt isn't installed." >&2 ;
 -				echo "   If you can install the required library then consider enabling" >&2 ;
 -				echo "   -fsanitize=safe-stack in $0)." >&2 ;
--			echo "  " >&2 ;
--		else
--			CCARGS="$CCARGS -fsanitize=safe-stack" ;
--		fi ;
+-				echo "  " >&2 ;;
+-			2)	CCARGS="$CCARGS -fsanitize=safe-stack" ;;
+-		esac ;
 -	fi ;
 -fi
 +#if [ $ISCLANG -gt 0 ] && [ $ISSPECIAL -eq 0 ] ; then
 +#	if [ $COMPILER_VER -ge 47 ] ; then
-+#		if [ "$OSNAME" = "Darwin" ] || [ "$OSNAME" = "OpenBSD" ] ; then
-+#			# The versions of clang shipped with OS X or OpenBSD don't
-+#			# support -fsanitize=safe-stack even as late as clang 12, so
-+#			# there's not much that we can do.
-+#			CCARGS="$CCARGS" ;
-+#		elif ! hasSafeStackLibs ; then
-+#			echo "  " >&2 ;
++#		SAFESTACK_SUPPORT=checkSafeStack ;
++#		case $SAFESTACK_SUPPORT in
++#			0)	;;
++#			1)	echo "  " >&2 ;
 +#				echo "  (This system supports clang stack sanitization via -fsanitize=safe-stack" >&2 ;
 +#				echo "   in $0, however the necessary libclang_rt isn't installed." >&2 ;
 +#				echo "   If you can install the required library then consider enabling" >&2 ;
 +#				echo "   -fsanitize=safe-stack in $0)." >&2 ;
-+#			echo "  " >&2 ;
-+#		else
-+#			CCARGS="$CCARGS -fsanitize=safe-stack" ;
-+#		fi ;
++#				echo "  " >&2 ;;
++#			2)	CCARGS="$CCARGS -fsanitize=safe-stack" ;;
++#		esac ;
 +#	fi ;
 +#fi
  
- # The Sun compiler has its own set of problems, the biggest of which is
- # determining where it is and what it is (see comments elsewhere), but
+ # If we're using clang or gcc and RELRO support is present, enable it.  This
+ # is a bit of an odd one, the various descriptions and docs imply it really

3rdp/build/cl-no-testobjs.patch

---- makefile.orig	2023-12-31 12:09:41.982826000 -0500
-+++ makefile	2023-12-31 12:10:05.682180000 -0500
-@@ -1784,7 +1784,7 @@
+--- ./makefile.orig	2024-10-31 00:50:22.293145000 -0400
++++ ./makefile	2024-10-31 00:50:22.799649000 -0400
+@@ -1815,7 +1815,7 @@
  # than the system tools and libraries for the build, so we special-case this
  # step based on the $(OSNAME) setting supplied to the build script.
  

3rdp/build/cl-no-tpm.patch

---- tools/ccopts.sh.orig	2023-12-31 07:50:46.349349000 -0500
-+++ tools/ccopts.sh	2023-12-31 07:51:14.307725000 -0500
+--- ./tools/ccopts.sh.orig	2024-10-31 00:50:21.888849000 -0400
++++ ./tools/ccopts.sh	2024-10-31 00:50:22.100746000 -0400
 @@ -411,30 +411,30 @@
  	# TPM support.  The use of the doubled-up dirname is required because
  	# the TPM header is in a subdirectory tss2/tss2_fapi.h so we have to

3rdp/build/cl-no-via-aes.patch

---- crypt/aesopt.h.orig	2020-04-14 09:11:58.722175000 -0400
-+++ crypt/aesopt.h	2020-04-14 09:13:30.401074000 -0400
-@@ -102,7 +102,7 @@
+--- ./crypt/aesopt.h.orig	2023-07-11 19:08:32.000000000 -0400
++++ ./crypt/aesopt.h	2024-10-31 00:50:22.127051000 -0400
+@@ -106,7 +106,7 @@
  	defined( _M_IX86 ) && \
  	!( defined( _WIN32_WCE ) || defined( NO_ASM ) )
    #ifndef USE_VIA_ACE_IF_PRESENT
@@ -9,7 +9,7 @@
    #endif
  #endif /* VC++ on x86 under Win32 - pcg */
  
-@@ -212,7 +212,7 @@
+@@ -216,7 +216,7 @@
  #if defined( __GNUC__ ) && defined( __i386__ ) \
   || defined( _WIN32 ) && defined( _M_IX86 ) && !(defined( _WIN64 ) \
   || defined( _WIN32_WCE ) || defined( _MSC_VER ) && ( _MSC_VER <= 800 ))
@@ -18,7 +18,7 @@
  #endif
  
  /* AES is supported out of the box by Windows x64 compilers, but by gcc only 
-@@ -263,7 +263,7 @@
+@@ -285,7 +285,7 @@
  	AES_REV_DKS must be set for assembler code used with a VIA ACE build
  */
  
@@ -27,7 +27,7 @@
  #  define USE_VIA_ACE_IF_PRESENT
  #endif
  
-@@ -508,7 +508,7 @@
+@@ -530,7 +530,7 @@
  #endif
  
  #if defined( ASSUME_VIA_ACE_PRESENT ) && !defined( USE_VIA_ACE_IF_PRESENT )

3rdp/build/cl-noasm-defines.patch

---- crypt.h.orig	2023-02-26 02:45:18.000000000 -0500
-+++ crypt.h	2023-12-31 07:21:16.146850000 -0500
+--- ./crypt.h.orig	2023-02-26 02:45:18.000000000 -0500
++++ ./crypt.h	2024-10-31 00:50:21.915339000 -0400
 @@ -9,6 +9,10 @@
  
  #define _CRYPT_DEFINED

3rdp/build/cl-openbsd-threads.patch

---- test/test.h.orig	2021-03-15 18:15:00.758832000 -0400
-+++ test/test.h	2021-03-15 18:15:18.354887000 -0400
-@@ -278,7 +278,7 @@
-    operations like sleep calls */
- 
- #if( ( defined( _AIX ) || defined( __APPLE__ ) || defined( __FreeBSD__ ) || \
--	   defined( __NetBSD__ ) || defined( __linux__ ) || \
-+	   defined( __NetBSD__ ) || defined( __OpenBSD__ ) || defined( __linux__ ) || \
- 	   ( defined( sun ) && ( OSVERSION > 4 ) ) ) && !defined( NO_THREADS ) )
-   #define UNIX_THREADS
- 

3rdp/build/cl-pass-after-pubkey.patch

---- session/ssh2_authcli.c.orig	2024-01-19 12:15:13.314932000 -0500
-+++ session/ssh2_authcli.c	2024-01-19 12:15:26.674148000 -0500
+--- ./session/ssh2_authcli.c.orig	2024-10-31 00:50:22.587803000 -0400
++++ ./session/ssh2_authcli.c	2024-10-31 00:50:23.003964000 -0400
 @@ -597,6 +597,7 @@
  	   and return some sort of useful information to the caller */
  	if( providedAuthType == SSH_AUTHTYPE_PUBKEY )

3rdp/build/cl-poll-not-select.patch

---- io/tcp_rw.c.orig	2023-02-26 03:33:50.000000000 -0500
-+++ io/tcp_rw.c	2023-12-31 08:12:00.663053000 -0500
+--- ./io/tcp_rw.c.orig	2023-10-04 21:26:08.000000000 -0400
++++ ./io/tcp_rw.c	2024-10-31 00:50:22.325643000 -0400
 @@ -20,6 +20,10 @@
  
  #ifdef USE_TCP
@@ -10,8 +10,8 @@
 +
  /****************************************************************************
  *																			*
- *							Network I/O Wait Management						*
-@@ -74,6 +78,7 @@
+ *						 		Utility Routines							*
+@@ -137,6 +141,7 @@
  		{ CRYPT_ERROR_OPEN, "unknown" }, { CRYPT_ERROR_OPEN, "unknown" }
  		};
  	MONOTIMER_INFO timerInfo;
@@ -19,7 +19,7 @@
  	struct timeval tv;
  	fd_set readfds, writefds, exceptfds;
  	fd_set *readFDPtr = ( type == IOWAIT_READ || \
-@@ -81,6 +86,11 @@
+@@ -144,6 +149,11 @@
  						  type == IOWAIT_ACCEPT ) ? &readfds : NULL;
  	fd_set *writeFDPtr = ( type == IOWAIT_WRITE || \
  						   type == IOWAIT_CONNECT ) ? &writefds : NULL;
@@ -31,7 +31,7 @@
  	LOOP_INDEX selectIterations;
  	int status;
  
-@@ -91,26 +101,6 @@
+@@ -154,26 +164,6 @@
  	REQUIRES( isBooleanValue( previousDataRead ) );
  	REQUIRES( isEnumRange( type, IOWAIT ) );
  
@@ -58,7 +58,7 @@
  	/* Set up the information needed to handle timeouts and wait on the
  	   socket.  If there's no timeout then we wait 5ms on the theory that it 
  	   isn't noticeable to the caller but ensures that we at least get a 
-@@ -153,6 +143,20 @@
+@@ -216,6 +206,20 @@
  	status = setMonoTimer( &timerInfo, timeout );
  	if( cryptStatusError( status ) )
  		return( status );
@@ -79,7 +79,7 @@
  	LOOP_MED( ( selectIterations = 0, status = SOCKET_ERROR ), \
  			  isSocketError( status ) && \
  				( selectIterations <= 0 || \
-@@ -162,6 +166,7 @@
+@@ -225,6 +229,7 @@
  		{
  		ENSURES( LOOP_INVARIANT_MED( selectIterations, 0, 19 ) );
  
@@ -87,7 +87,7 @@
  		if( readFDPtr != NULL )
  			{
  			FD_ZERO( readFDPtr );
-@@ -189,6 +194,10 @@
+@@ -252,6 +257,10 @@
  		clearErrorState();
  		status = select( ( int ) netStream->netSocket + 1, readFDPtr, 
  						 writeFDPtr, &exceptfds, &tv );
@@ -98,7 +98,7 @@
  
  		/* If there's a problem and it's not something transient like an
  		   interrupted system call, exit.  For a transient problem, we just
-@@ -272,7 +281,11 @@
+@@ -335,7 +344,11 @@
  	   false and an indicator to receive SIGURG's not set, the OOB data byte 
  	   just languishes in a side-buffer), however we shouldn't be receiving 
  	   OOB data so we treat that as an error too */
@@ -110,7 +110,7 @@
  		{
  		int socketErrorCode;
  
-@@ -326,6 +339,7 @@
+@@ -389,6 +402,7 @@
  
  	/* The socket is read for reading or writing */
  	ENSURES( status > 0 );
@@ -118,7 +118,7 @@
  	ENSURES( ( type == IOWAIT_READ && \
  			   FD_ISSET( netStream->netSocket, &readfds ) ) || \
  			 ( type == IOWAIT_WRITE && \
-@@ -334,6 +348,13 @@
+@@ -397,6 +411,13 @@
  			   ( FD_ISSET( netStream->netSocket, &readfds ) || \
  				 FD_ISSET( netStream->netSocket, &writefds ) ) ) || \
  			 ( type == IOWAIT_ACCEPT ) );

3rdp/build/cl-posix-me-gently.patch

---- misc/os_spec.h.orig	2023-12-31 06:48:03.815555000 -0500
-+++ misc/os_spec.h	2023-12-31 06:48:27.417919000 -0500
+--- ./misc/os_spec.h.orig	2023-08-15 17:22:04.000000000 -0400
++++ ./misc/os_spec.h	2024-10-31 00:50:21.704806000 -0400
 @@ -103,7 +103,7 @@
  #ifndef _POSIX_C_SOURCE 
    #if defined( __xlc__ ) || defined( __IBMC__ )

3rdp/build/cl-prefer-ECC-harder.patch

---- session/tls_suites.c.orig	2023-02-28 02:55:06.000000000 -0500
-+++ session/tls_suites.c	2023-12-31 07:30:02.368446000 -0500
-@@ -414,12 +414,12 @@
+--- ./session/tls_suites.c.orig	2023-11-28 02:24:52.000000000 -0500
++++ ./session/tls_suites.c	2024-10-31 00:50:21.994515000 -0400
+@@ -418,12 +418,12 @@
  
  	/* ECC suites if these are preferred */
  #ifdef PREFER_ECC

3rdp/build/cl-prefer-ECC.patch

---- misc/config.h.orig	2020-01-23 14:08:29.914160000 -0500
-+++ misc/config.h	2020-01-23 14:08:38.693115000 -0500
-@@ -12,6 +12,7 @@
+--- ./misc/config.h.orig	2024-10-31 00:50:21.624076000 -0400
++++ ./misc/config.h	2024-10-31 00:50:21.968026000 -0400
+@@ -64,6 +64,7 @@
  #define USE_PROBLEMATIC_ALGORITHMS
  #define USE_SSH_EXTENDED
  #define USE_CERTLEVEL_STANDARD