diff options
| author | jp161948 <none@none> | 2006-09-11 09:53:10 -0700 |
|---|---|---|
| committer | jp161948 <none@none> | 2006-09-11 09:53:10 -0700 |
| commit | b52e6db712bfb5196fe24c8bf5e6b82e3fd7f993 (patch) | |
| tree | 53864f8e3def610a7f1b188dcdb8b671640d2fdf /usr/src/common/openssl/crypto/rsa/rsa_sign.c | |
| parent | d19d822796ad55c5dba63d1edee11792d6465eb7 (diff) | |
| download | illumos-joyent-b52e6db712bfb5196fe24c8bf5e6b82e3fd7f993.tar.gz | |
6467218 fix RSA signature forgery (CVE-2006-4339)
Diffstat (limited to 'usr/src/common/openssl/crypto/rsa/rsa_sign.c')
| -rw-r--r-- | usr/src/common/openssl/crypto/rsa/rsa_sign.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/usr/src/common/openssl/crypto/rsa/rsa_sign.c b/usr/src/common/openssl/crypto/rsa/rsa_sign.c index 230ec6d7ea..71aabeea1b 100644 --- a/usr/src/common/openssl/crypto/rsa/rsa_sign.c +++ b/usr/src/common/openssl/crypto/rsa/rsa_sign.c @@ -185,6 +185,23 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len, sig=d2i_X509_SIG(NULL,&p,(long)i); if (sig == NULL) goto err; + + /* Excess data can be used to create forgeries */ + if(p != s+i) + { + RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); + goto err; + } + + /* Parameters to the signature algorithm can also be used to + create forgeries */ + if(sig->algor->parameter + && ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL) + { + RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); + goto err; + } + sigtype=OBJ_obj2nid(sig->algor->algorithm); |