Don't attempt to parse nested ASN1 strings by default.

[oweals/openssl.git] / crypto / asn1 / a_sign.c

diff --git a/crypto/asn1/a_sign.c b/crypto/asn1/a_sign.c
index de53b441448e4f9d44a07004790105b7a8a006c0..042682a0615b7f086bda5385396bc2306e6b4e30 100644 (file)
--- a/crypto/asn1/a_sign.c
+++ b/crypto/asn1/a_sign.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -126,9 +126,9 @@
 
 #ifndef NO_ASN1_OLD
 
-int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
-            ASN1_BIT_STRING *signature, char *data, EVP_PKEY *pkey,
-            const EVP_MD *type)
+int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
+             ASN1_BIT_STRING *signature, char *data, EVP_PKEY *pkey,
+             const EVP_MD *type)
        {
        EVP_MD_CTX ctx;
        unsigned char *p,*buf_in=NULL,*buf_out=NULL;
@@ -204,9 +204,9 @@ int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
 err:
        EVP_MD_CTX_cleanup(&ctx);
        if (buf_in != NULL)
-               { memset((char *)buf_in,0,(unsigned int)inl); OPENSSL_free(buf_in); }
+               { OPENSSL_cleanse((char *)buf_in,(unsigned int)inl); OPENSSL_free(buf_in); }
        if (buf_out != NULL)
-               { memset((char *)buf_out,0,outll); OPENSSL_free(buf_out); }
+               { OPENSSL_cleanse((char *)buf_out,outll); OPENSSL_free(buf_out); }
        return(outl);
        }
 
@@ -229,10 +229,11 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
                else
                        a=algor2;
                if (a == NULL) continue;
-                if (type->pkey_type == NID_dsaWithSHA1)
+                if (type->pkey_type == NID_dsaWithSHA1 ||
+                       type->pkey_type == NID_ecdsa_with_SHA1)
                        {
-                       /* special case: RFC 2459 tells us to omit 'parameters'
-                        * with id-dsa-with-sha1 */
+                       /* special case: RFC 3279 tells us to omit 'parameters'
+                        * with id-dsa-with-sha1 and ecdsa-with-SHA1 */
                        ASN1_TYPE_free(a->parameter);
                        a->parameter = NULL;
                        }
@@ -287,8 +288,8 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
 err:
        EVP_MD_CTX_cleanup(&ctx);
        if (buf_in != NULL)
-               { memset((char *)buf_in,0,(unsigned int)inl); OPENSSL_free(buf_in); }
+               { OPENSSL_cleanse((char *)buf_in,(unsigned int)inl); OPENSSL_free(buf_in); }
        if (buf_out != NULL)
-               { memset((char *)buf_out,0,outll); OPENSSL_free(buf_out); }
+               { OPENSSL_cleanse((char *)buf_out,outll); OPENSSL_free(buf_out); }
        return(outl);
        }