Stop PKCS7_verify() core dumping with unknown public

key algorithms and leaking if the signature verify
fails.

diff --git a/CHANGES b/CHANGES
index c5cd00a9bc0c241fe7bec7697b1c18c9a0004ae6..a83e26c9f7b2f502b4a47f4f6756b8dbdc306332 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,11 @@
 
  Changes between 0.9.6 and 0.9.7  [xx XXX 2000]
 
+  *) Avoid coredump with unsupported or invalid public keys by checking if
+     X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
+     PKCS7_verify() fails with non detached data.
+     [Steve Henson]
+
   *) Change OCSP_cert_to_id() to tolerate a NULL subject certificate and
      OCSP_cert_id_new() a NULL serialNumber. This allows a partial certificate
      ID to be generated from the issuer certificate alone which can then be

diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 98f3b49fa91ef23e9c7a988c9c0e72f72f9cdd86..de96148b6eba1a748919ccd66f8adb71a1e42fc6 100644 (file)
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -764,6 +764,11 @@ for (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\n");
 
        os=si->enc_digest;
        pkey = X509_get_pubkey(x509);
+       if (!pkey)
+               {
+               ret = -1;
+               goto err;
+               }
        if(pkey->type == EVP_PKEY_DSA) mdc_tmp.digest=EVP_dss1();
 
        i=EVP_VerifyFinal(&mdc_tmp,os->data,os->length, pkey);

diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c
index 7fa0832ea32db1ab10194b140e97336377698429..5de5b591a9e38307278436f31637a44db92028be 100644 (file)
--- a/crypto/pkcs7/pk7_smime.c
+++ b/crypto/pkcs7/pk7_smime.c
@@ -153,7 +153,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
        PKCS7_SIGNER_INFO *si;
        X509_STORE_CTX cert_ctx;
        char buf[4096];
-       int i, j=0, k;
+       int i, j=0, k, ret = 0;
        BIO *p7bio;
        BIO *tmpout;
 
@@ -258,18 +258,15 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                }
        }
 
-       sk_X509_free(signers);
-       if(indata) BIO_pop(p7bio);
-       BIO_free_all(p7bio);
-
-       return 1;
+       ret = 1;
 
        err:
 
+       if(indata) BIO_pop(p7bio);
+       BIO_free_all(p7bio);
        sk_X509_free(signers);
-       BIO_free(p7bio);
 
-       return 0;
+       return ret;
 }
 
 STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)