Fix various certificate fingerprint issues.

[openssl.git] / crypto / ecdsa / ecs_vrf.c

diff --git a/crypto/ecdsa/ecs_vrf.c b/crypto/ecdsa/ecs_vrf.c
index ef9acf7b610284d697bcea815061ef29a67fce0e..7191b8ab0aea2c3631c1504fdc810a7364d98d56 100644 (file)
--- a/crypto/ecdsa/ecs_vrf.c
+++ b/crypto/ecdsa/ecs_vrf.c
@@ -57,11 +57,13 @@
  */
 
 #include "ecs_locl.h"
+#include "cryptlib.h"
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
 
-/* returns
+/*-
+ * returns
  *      1: correct signature
  *      0: incorrect signature
  *     -1: error
@@ -75,7 +77,8 @@ int ECDSA_do_verify(const unsigned char *dgst, int dgst_len,
        return ecdsa->meth->ecdsa_do_verify(dgst, dgst_len, sig, eckey);
        }
 
-/* returns
+/*-
+ * returns
  *      1: correct signature
  *      0: incorrect signature
  *     -1: error
@@ -84,13 +87,25 @@ int ECDSA_verify(int type, const unsigned char *dgst, int dgst_len,
                const unsigned char *sigbuf, int sig_len, EC_KEY *eckey)
        {
        ECDSA_SIG *s;
+       const unsigned char *p = sigbuf;
+       unsigned char *der = NULL;
+       int derlen = -1;
        int ret=-1;
 
        s = ECDSA_SIG_new();
        if (s == NULL) return(ret);
-       if (d2i_ECDSA_SIG(&s, &sigbuf, sig_len) == NULL) goto err;
+       if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) goto err;
+       /* Ensure signature uses DER and doesn't have trailing garbage */
+       derlen = i2d_ECDSA_SIG(s, &der);
+       if (derlen != sig_len || memcmp(sigbuf, der, derlen))
+               goto err;
        ret=ECDSA_do_verify(dgst, dgst_len, s, eckey);
 err:
+       if (derlen > 0)
+               {
+               OPENSSL_cleanse(der, derlen);
+               OPENSSL_free(der);
+               }
        ECDSA_SIG_free(s);
        return(ret);
        }