- const unsigned char *from, int flen, int num,
- const unsigned char *param, int plen)
- {
- int i, dblen, mlen = -1;
- const unsigned char *maskeddb;
- int lzero;
- unsigned char *db = NULL, seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH];
-
- if (--num < 2 * SHA_DIGEST_LENGTH + 1)
- goto decoding_err;
-
- lzero = num - flen;
- if (lzero < 0)
- goto decoding_err;
- maskeddb = from - lzero + SHA_DIGEST_LENGTH;
-
- dblen = num - SHA_DIGEST_LENGTH;
+ const unsigned char *from, int flen, int num,
+ const unsigned char *param, int plen)
+{
+ return RSA_padding_check_PKCS1_OAEP_mgf1(to, tlen, from, flen, num,
+ param, plen, NULL, NULL);
+}
+
+int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
+ const unsigned char *from, int flen,
+ int num, const unsigned char *param,
+ int plen, const EVP_MD *md,
+ const EVP_MD *mgf1md)
+{
+ int i, dblen, mlen = -1, one_index = 0, msg_index;
+ unsigned int good, found_one_byte;
+ const unsigned char *maskedseed, *maskeddb;
+ /*
+ * |em| is the encoded message, zero-padded to exactly |num| bytes: em =
+ * Y || maskedSeed || maskedDB
+ */
+ unsigned char *db = NULL, *em = NULL, seed[EVP_MAX_MD_SIZE],
+ phash[EVP_MAX_MD_SIZE];
+ int mdlen;
+
+ if (md == NULL)
+ md = EVP_sha1();
+ if (mgf1md == NULL)
+ mgf1md = md;
+
+ mdlen = EVP_MD_size(md);
+
+ if (tlen <= 0 || flen <= 0)
+ return -1;
+ /*
+ * |num| is the length of the modulus; |flen| is the length of the
+ * encoded message. Therefore, for any |from| that was obtained by
+ * decrypting a ciphertext, we must have |flen| <= |num|. Similarly,
+ * num < 2 * mdlen + 2 must hold for the modulus irrespective of
+ * the ciphertext, see PKCS #1 v2.2, section 7.1.2.
+ * This does not leak any side-channel information.
+ */
+ if (num < flen || num < 2 * mdlen + 2)
+ goto decoding_err;
+
+ dblen = num - mdlen - 1;