diff options
| author | mark%moxienet.com <devnull@localhost> | 2006-09-08 18:43:39 +0000 |
|---|---|---|
| committer | mark%moxienet.com <devnull@localhost> | 2006-09-08 18:43:39 +0000 |
| commit | 08792d8fccd236ac5df22a45249f396b4d1ba93e (patch) | |
| tree | fb477d31e2370b13c78390acc20f34243a705916 | |
| parent | 9bad0ec23fbc6b61b2d58d5d801dd0d6c214a56e (diff) | |
| download | nss-hg-08792d8fccd236ac5df22a45249f396b4d1ba93e.tar.gz | |
Taking 351079 on CAMINO_1_0_3_MINIBRANCH, it was taken on MOZILLA_1_8_0_BRANCH for 1.8.0.7 after the minibranch split.
| -rw-r--r-- | security/nss/lib/cryptohi/secvfy.c | 9 | ||||
| -rw-r--r-- | security/nss/lib/softoken/pkcs11c.c | 5 |
2 files changed, 13 insertions, 1 deletions
diff --git a/security/nss/lib/cryptohi/secvfy.c b/security/nss/lib/cryptohi/secvfy.c index 4a5de4e0f..60f48d13b 100644 --- a/security/nss/lib/cryptohi/secvfy.c +++ b/security/nss/lib/cryptohi/secvfy.c @@ -82,7 +82,14 @@ DecryptSigBlock(SECOidTag *tagp, unsigned char *digest, SECKEYPublicKey *key, ** ID and the signature block */ tag = SECOID_GetAlgorithmTag(&di->digestAlgorithm); - /* XXX Check that tag is an appropriate algorithm? */ + /* Check that tag is an appropriate algorithm */ + if (tag == SEC_OID_UNKNOWN) { + goto sigloser; + } + /* make sure the "parameters" are not too bogus. */ + if (di->digestAlgorithm.parameters.len > 2) { + goto sigloser; + } if (di->digest.len > HASH_LENGTH_MAX) { PORT_SetError(SEC_ERROR_OUTPUT_LEN); goto loser; diff --git a/security/nss/lib/softoken/pkcs11c.c b/security/nss/lib/softoken/pkcs11c.c index 97315fcbb..79966073c 100644 --- a/security/nss/lib/softoken/pkcs11c.c +++ b/security/nss/lib/softoken/pkcs11c.c @@ -2095,12 +2095,17 @@ sftk_hashCheckSign(SFTKHashVerifyInfo *info, unsigned char *sig, if (SECOID_GetAlgorithmTag(&di->digestAlgorithm) != info->hashOid) { goto loser; } + /* make sure the "parameters" are not too bogus. */ + if (di->digestAlgorithm.parameters.len > 2) { + goto loser; + } /* Now check the signature */ if (PORT_Memcmp(digest, di->digest.data, di->digest.len) == 0) { goto done; } loser: + PORT_SetError(SEC_ERROR_BAD_SIGNATURE); rv = SECFailure; done: |