denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check RSA_public_decrypt() length before constructing and comparing a chunk

Browse Source 
If decryption fails, it returns -1. chunk_equals() should catch that error,
but be more explicit in error checking.
This commit is contained in:
Martin Willi
2013-04-10 18:10:30 +02:00
committed by Andreas Steffen
parent 97d975b7bb
commit b52771fbb2
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c
+10 -7
View File
@@ -48,8 +48,6 @@ struct private_openssl_rsa_public_key_t {
refcount_t ref; refcount_t ref;
}; };
/** /**
* Verification of an EMPSA PKCS1 signature described in PKCS#1 * Verification of an EMPSA PKCS1 signature described in PKCS#1
*/ */
@@ -67,12 +65,17 @@ static bool verify_emsa_pkcs1_signature(private_openssl_rsa_public_key_t *this,
if (type == NID_undef) if (type == NID_undef)
{ {
chunk_t hash = chunk_alloc(rsa_size); char *buf;
int len;
hash.len = RSA_public_decrypt(signature.len, signature.ptr, hash.ptr, buf = malloc(rsa_size);
this->rsa, RSA_PKCS1_PADDING); len = RSA_public_decrypt(signature.len, signature.ptr, buf, this->rsa,
valid = chunk_equals(data, hash); RSA_PKCS1_PADDING);
free(hash.ptr); if (len != -1)
{
valid = chunk_equals(data, chunk_create(buf, len));
}
free(buf);
} }
else else
{ {