diff options
| author |   jsing <jsing@openbsd.org> | 2018-08-14 16:19:06 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2018-08-14 16:19:06 +0000 |
| commit | c65d0191d02962449a29c3b28ea31960e799bf91 (patch) | |
| tree | f928120fc494c8daf3e5bbfa8d1312f95513346b /lib/libssl/ssl_clnt.c | |
| parent | Don't fail by default in the -new case; ok tb jca (diff) | |
| download | wireguard-openbsd-c65d0191d02962449a29c3b28ea31960e799bf91.tar.xz wireguard-openbsd-c65d0191d02962449a29c3b28ea31960e799bf91.zip | |
Actually check the return values for EVP_Sign* and EVP_Verify*.
ok bcook@ beck@ tb@
Diffstat (limited to 'lib/libssl/ssl_clnt.c')
| -rw-r--r-- | lib/libssl/ssl_clnt.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/lib/libssl/ssl_clnt.c b/lib/libssl/ssl_clnt.c index f9cdd8657ad..dcd4da3634c 100644 --- a/lib/libssl/ssl_clnt.c +++ b/lib/libssl/ssl_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_clnt.c,v 1.27 2018/08/10 17:52:35 jsing Exp $ */ +/* $OpenBSD: ssl_clnt.c,v 1.28 2018/08/14 16:19:06 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1553,13 +1553,17 @@ ssl3_get_server_key_exchange(SSL *s) goto f_err; } - EVP_VerifyInit_ex(&md_ctx, md, NULL); - EVP_VerifyUpdate(&md_ctx, s->s3->client_random, - SSL3_RANDOM_SIZE); - EVP_VerifyUpdate(&md_ctx, s->s3->server_random, - SSL3_RANDOM_SIZE); - EVP_VerifyUpdate(&md_ctx, param, param_len); - if (EVP_VerifyFinal(&md_ctx, p,(int)n, pkey) <= 0) { + if (!EVP_VerifyInit_ex(&md_ctx, md, NULL)) + goto err; + if (!EVP_VerifyUpdate(&md_ctx, s->s3->client_random, + SSL3_RANDOM_SIZE)) + goto err; + if (!EVP_VerifyUpdate(&md_ctx, s->s3->server_random, + SSL3_RANDOM_SIZE)) + goto err; + if (!EVP_VerifyUpdate(&md_ctx, param, param_len)) + goto err; + if (EVP_VerifyFinal(&md_ctx, p, (int)n, pkey) <= 0) { /* bad signature */ al = SSL_AD_DECRYPT_ERROR; SSLerror(s, SSL_R_BAD_SIGNATURE); |