tolerate broken CMS/PKCS7 implementations using signature OID instead of digest
authorDr. Stephen Henson <steve@openssl.org>
Tue, 2 Feb 2010 14:30:39 +0000 (14:30 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Tue, 2 Feb 2010 14:30:39 +0000 (14:30 +0000)
crypto/cms/cms_lib.c

index 714b1d9..b62d1bf 100644 (file)
@@ -406,7 +406,11 @@ int cms_DigestAlgorithm_find_ctx(EVP_MD_CTX *mctx, BIO *chain,
                        return 0;
                        }
                BIO_get_md_ctx(chain, &mtmp);
-               if (EVP_MD_CTX_type(mtmp) == nid)
+               if (EVP_MD_CTX_type(mtmp) == nid
+               /* Workaround for broken implementations that use signature
+                * algorithm  OID instead of digest.
+                */
+                       || EVP_MD_pkey_type(EVP_MD_CTX_md(mtmp)) == nid)
                        return EVP_MD_CTX_copy_ex(mctx, mtmp);
                chain = BIO_next(chain);
                }