tolerate broken CMS/PKCS7 implementations using signature OID instead of digest

[openssl.git] / crypto / cms / cms_smime.c

diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c
index faa9c1d1d79db77fe9bdd11e82f933a06a4c5b5c..ab38a258e53ee07b312686e3c8ea254dd106b7ae 100644 (file)
--- a/crypto/cms/cms_smime.c
+++ b/crypto/cms/cms_smime.c
@@ -292,7 +292,7 @@ static int cms_signerinfo_verify_cert(CMS_SignerInfo *si,
                                                CMS_R_STORE_INIT_ERROR);
                goto err;
                }
-       X509_STORE_CTX_set_default(&cert_ctx, "smime_sign");
+       X509_STORE_CTX_set_default(&ctx, "smime_sign");
        if (crls)
                X509_STORE_CTX_set0_crls(&ctx, crls);
 
@@ -419,7 +419,7 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
                for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
                        {
                        si = sk_CMS_SignerInfo_value(sinfos, i);
-                       if (!CMS_SignerInfo_verify_content(si, cmsbio))
+                       if (CMS_SignerInfo_verify_content(si, cmsbio) <= 0)
                                {
                                CMSerr(CMS_F_CMS_VERIFY,
                                        CMS_R_CONTENT_VERIFY_ERROR);
@@ -680,6 +680,30 @@ int CMS_decrypt_set1_key(CMS_ContentInfo *cms,
        return 0;
 
        }
+
+int CMS_decrypt_set1_password(CMS_ContentInfo *cms, 
+                               unsigned char *pass, ssize_t passlen)
+       {
+       STACK_OF(CMS_RecipientInfo) *ris;
+       CMS_RecipientInfo *ri;
+       int i, r;
+       ris = CMS_get0_RecipientInfos(cms);
+       for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++)
+               {
+               ri = sk_CMS_RecipientInfo_value(ris, i);
+               if (CMS_RecipientInfo_type(ri) != CMS_RECIPINFO_PASS)
+                               continue;
+               CMS_RecipientInfo_set0_password(ri, pass, passlen);
+               r = CMS_RecipientInfo_decrypt(cms, ri);
+               CMS_RecipientInfo_set0_password(ri, NULL, 0);
+               if (r > 0)
+                       return 1;
+               }
+
+       CMSerr(CMS_F_CMS_DECRYPT_SET1_PASSWORD, CMS_R_NO_MATCHING_RECIPIENT);
+       return 0;
+
+       }
        
 int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert,
                                BIO *dcont, BIO *out,