check for surplus bytes in EM structure after the digestInfo

src/libstrongswan/crypto/rsa/rsa_public_key.c

@@ -49,11 +49,12 @@ static const asn1Object_t pubkeyObjects[] = {
 
 /* ASN.1 definition of digestInfo */
 static const asn1Object_t digestInfoObjects[] = {
-	{ 0, "digestInfo",			ASN1_SEQUENCE,		ASN1_NONE }, /*  0 */
+	{ 0, "digestInfo",			ASN1_SEQUENCE,		ASN1_OBJ },  /*  0 */
 	{ 1,   "digestAlgorithm",	ASN1_EOC,			ASN1_RAW  }, /*  1 */
 	{ 1,   "digest",			ASN1_OCTET_STRING,	ASN1_BODY }, /*  2 */
 };
 
+#define DIGEST_INFO					0
 #define DIGEST_INFO_ALGORITHM		1
 #define DIGEST_INFO_DIGEST			2
 #define DIGEST_INFO_ROOF			3
@@ -214,7 +215,16 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
 			{
 				goto end;
 			}
-			if (objectID == DIGEST_INFO_ALGORITHM)
+			switch (objectID)
+			{
+				case DIGEST_INFO:
+					if (object.len != em.len)
+					{
+						/* surplus bytes after the digestInfo object */
+						goto end;
+					}
+					break;
+				case DIGEST_INFO_ALGORITHM:
 					{
 						int hash_oid = parse_algorithmIdentifier(object, level+1, NULL);
 
@@ -225,7 +235,8 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
 							goto end;
 						}
 					}
-			else if (objectID == DIGEST_INFO_DIGEST)
+					break;
+				case DIGEST_INFO_DIGEST:
 					{
 						chunk_t hash;
 						hasher_t *hasher = hasher_create(hash_algorithm);
@@ -245,6 +256,10 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
 						res = memeq(object.ptr, hash.ptr, hash.len) ? SUCCESS : FAILED;
 						free(hash.ptr);
 					}
+					break;
+				default:
+					break;
+			}
 			objectID++;
 		}
 	}