diff options
| author |   miod <miod@openbsd.org> | 2015-07-15 16:45:24 +0000 |
|---|---|---|
| committer | miod <miod@openbsd.org> | 2015-07-15 16:45:24 +0000 |
| commit | a1809d60b26fb01c9d6bb3252cef92048ba65a27 (patch) | |
| tree | 858a686cfa228d031b05b0a348deb9c74585adde /lib/libssl/src | |
| parent | Previous fix for Coverity CID 21785 did not cope correctly with seed_len != 0, (diff) | |
| download | wireguard-openbsd-a1809d60b26fb01c9d6bb3252cef92048ba65a27.tar.xz wireguard-openbsd-a1809d60b26fb01c9d6bb3252cef92048ba65a27.zip | |
Do not allow TS_check_signer_name() with signer == NULL from
int_TS_RESP_verify_token(). Coverity CID 21710.
Looking further, int_TS_RESP_verify_token() will only initialize signer to
something non-NULL if TS_VFY_SIGNATURE is set in ctx->flags. But guess what?
TS_REQ_to_TS_VERIFY_CTX() in ts/ts_verify_ctx.c, which is the TS_VERIFY_CTX
constructor, explicitely clears this bit, with:
ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE);
followed by more conditional flag clears.
Of course, nothing prevents the user to fiddle with ctx->flags afterwards. This
is exactly what ts.c in usr.bin/openssl does. This is gross, mistakes will
happen.
ok beck@
Diffstat (limited to 'lib/libssl/src')
| -rw-r--r-- | lib/libssl/src/crypto/ts/ts_rsp_verify.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lib/libssl/src/crypto/ts/ts_rsp_verify.c b/lib/libssl/src/crypto/ts/ts_rsp_verify.c index 25fc22dfaf1..56397eeec37 100644 --- a/lib/libssl/src/crypto/ts/ts_rsp_verify.c +++ b/lib/libssl/src/crypto/ts/ts_rsp_verify.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ts_rsp_verify.c,v 1.12 2014/07/11 08:44:49 jsing Exp $ */ +/* $OpenBSD: ts_rsp_verify.c,v 1.13 2015/07/15 16:45:24 miod Exp $ */ /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL * project 2002. */ @@ -698,6 +698,9 @@ TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer) int idx = -1; int found = 0; + if (signer == NULL) + return 0; + /* Check the subject name first. */ if (tsa_name->type == GEN_DIRNAME && X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0) |