Fix various certificate fingerprint issues.

[openssl.git] / crypto / dsa / dsa_asn1.c

diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c
index 55c75b59cfbc9cc27715795c18709350aac9903f..58559e54b1ece20eab0a04fdf475ac139e1fa65a 100644 (file)
--- a/crypto/dsa/dsa_asn1.c
+++ b/crypto/dsa/dsa_asn1.c
@@ -177,13 +177,25 @@ int DSA_verify(int type, const unsigned char *dgst, int dgst_len,
             const unsigned char *sigbuf, int siglen, DSA *dsa)
        {
        DSA_SIG *s;
+       const unsigned char *p = sigbuf;
+       unsigned char *der = NULL;
+       int derlen = -1;
        int ret=-1;
 
        s = DSA_SIG_new();
        if (s == NULL) return(ret);
-       if (d2i_DSA_SIG(&s,&sigbuf,siglen) == NULL) goto err;
+       if (d2i_DSA_SIG(&s,&p,siglen) == NULL) goto err;
+       /* Ensure signature uses DER and doesn't have trailing garbage */
+       derlen = i2d_DSA_SIG(s, &der);
+       if (derlen != siglen || memcmp(sigbuf, der, derlen))
+               goto err;
        ret=DSA_do_verify(dgst,dgst_len,s,dsa);
 err:
+       if (derlen > 0)
+               {
+               OPENSSL_cleanse(der, derlen);
+               OPENSSL_free(der);
+               }
        DSA_SIG_free(s);
        return(ret);
        }