From 25ffeb11ea86bdc76db150c504550602a9acc9bc Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Fri, 23 Jun 2017 11:40:47 +0100 Subject: [PATCH 1/1] Fix another EVP_DigestVerify() instance Following on from the previous commit this fixes another instance where we need to treat a -ve return from EVP_DigestVerify() as a bad signature. Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3756) --- ssl/statem/statem_lib.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c index 63d8953164..5cd17f2836 100644 --- a/ssl/statem/statem_lib.c +++ b/ssl/statem/statem_lib.c @@ -459,10 +459,7 @@ MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt) } } else { j = EVP_DigestVerify(mctx, data, len, hdata, hdatalen); - if (j < 0) { - SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB); - goto f_err; - } else if (j == 0) { + if (j <= 0) { al = SSL_AD_DECRYPT_ERROR; SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_BAD_SIGNATURE); goto f_err; -- 2.34.1