projects
/
oweals
/
openssl.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Fix error handling at openssl_strerror_r
[oweals/openssl.git]
/
crypto
/
rsa
/
rsa_pss.c
diff --git
a/crypto/rsa/rsa_pss.c
b/crypto/rsa/rsa_pss.c
index 0a6178b0c40bbf745174f4d106e87cd81b91ef92..f7c575d00ab1232cefac095b449ccc12cf2595b4 100644
(file)
--- a/
crypto/rsa/rsa_pss.c
+++ b/
crypto/rsa/rsa_pss.c
@@
-1,5
+1,5
@@
/*
/*
- * Copyright 2005-201
6
The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2005-201
8
The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@
-54,11
+54,12
@@
int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,
* Negative sLen has special meanings:
* -1 sLen == hLen
* -2 salt length is autorecovered from signature
* Negative sLen has special meanings:
* -1 sLen == hLen
* -2 salt length is autorecovered from signature
+ * -3 salt length is maximized
* -N reserved
*/
* -N reserved
*/
- if (sLen == RSA_PSS_SALTLEN_DIGEST)
+ if (sLen == RSA_PSS_SALTLEN_DIGEST)
{
sLen = hLen;
sLen = hLen;
- else if (sLen < RSA_PSS_SALTLEN_MAX) {
+
}
else if (sLen < RSA_PSS_SALTLEN_MAX) {
RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
goto err;
}
RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
goto err;
}
@@
-73,9
+74,13
@@
int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,
EM++;
emLen--;
}
EM++;
emLen--;
}
+ if (emLen < hLen + 2) {
+ RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
+ goto err;
+ }
if (sLen == RSA_PSS_SALTLEN_MAX) {
sLen = emLen - hLen - 2;
if (sLen == RSA_PSS_SALTLEN_MAX) {
sLen = emLen - hLen - 2;
- } else if (
emLen < (hLen + sLen + 2)
) { /* sLen can be small negative */
+ } else if (
sLen > emLen - hLen - 2
) { /* sLen can be small negative */
RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
goto err;
}
RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
goto err;
}
@@
-106,7
+111,7
@@
int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,
goto err;
}
if (!EVP_DigestInit_ex(ctx, Hash, NULL)
goto err;
}
if (!EVP_DigestInit_ex(ctx, Hash, NULL)
- || !EVP_DigestUpdate(ctx, zeroes, sizeof
zeroes
)
+ || !EVP_DigestUpdate(ctx, zeroes, sizeof
(zeroes)
)
|| !EVP_DigestUpdate(ctx, mHash, hLen))
goto err;
if (maskedDBLen - i) {
|| !EVP_DigestUpdate(ctx, mHash, hLen))
goto err;
if (maskedDBLen - i) {
@@
-118,8
+123,9
@@
int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,
if (memcmp(H_, H, hLen)) {
RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_BAD_SIGNATURE);
ret = 0;
if (memcmp(H_, H, hLen)) {
RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_BAD_SIGNATURE);
ret = 0;
- } else
+ } else
{
ret = 1;
ret = 1;
+ }
err:
OPENSSL_free(DB);
err:
OPENSSL_free(DB);
@@
-157,13
+163,14
@@
int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
* Negative sLen has special meanings:
* -1 sLen == hLen
* -2 salt length is maximized
* Negative sLen has special meanings:
* -1 sLen == hLen
* -2 salt length is maximized
+ * -3 same as above (on signing)
* -N reserved
*/
* -N reserved
*/
- if (sLen == RSA_PSS_SALTLEN_DIGEST)
+ if (sLen == RSA_PSS_SALTLEN_DIGEST)
{
sLen = hLen;
sLen = hLen;
- else if (sLen == RSA_PSS_SALTLEN_MAX_SIGN)
+ } else if (sLen == RSA_PSS_SALTLEN_MAX_SIGN) {
sLen = RSA_PSS_SALTLEN_MAX;
sLen = RSA_PSS_SALTLEN_MAX;
- else if (sLen < RSA_PSS_SALTLEN_MAX) {
+
}
else if (sLen < RSA_PSS_SALTLEN_MAX) {
RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
goto err;
}
RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
goto err;
}
@@
-174,9
+181,14
@@
int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
*EM++ = 0;
emLen--;
}
*EM++ = 0;
emLen--;
}
+ if (emLen < hLen + 2) {
+ RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
+ RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
+ goto err;
+ }
if (sLen == RSA_PSS_SALTLEN_MAX) {
sLen = emLen - hLen - 2;
if (sLen == RSA_PSS_SALTLEN_MAX) {
sLen = emLen - hLen - 2;
- } else if (
emLen < (hLen + sLen + 2)
) {
+ } else if (
sLen > emLen - hLen - 2
) {
RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
goto err;
RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,
RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
goto err;
@@
-197,7
+209,7
@@
int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
if (ctx == NULL)
goto err;
if (!EVP_DigestInit_ex(ctx, Hash, NULL)
if (ctx == NULL)
goto err;
if (!EVP_DigestInit_ex(ctx, Hash, NULL)
- || !EVP_DigestUpdate(ctx, zeroes, sizeof
zeroes
)
+ || !EVP_DigestUpdate(ctx, zeroes, sizeof
(zeroes)
)
|| !EVP_DigestUpdate(ctx, mHash, hLen))
goto err;
if (sLen && !EVP_DigestUpdate(ctx, salt, sLen))
|| !EVP_DigestUpdate(ctx, mHash, hLen))
goto err;
if (sLen && !EVP_DigestUpdate(ctx, salt, sLen))
@@
-232,7
+244,7
@@
int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
err:
EVP_MD_CTX_free(ctx);
err:
EVP_MD_CTX_free(ctx);
- OPENSSL_
free(salt);
+ OPENSSL_
clear_free(salt, (size_t)sLen); /* salt != NULL implies sLen > 0 */
return ret;
return ret;