diff options
Diffstat (limited to 'security/nss/lib/freebl/rsapkcs.c')
| -rw-r--r-- | security/nss/lib/freebl/rsapkcs.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/security/nss/lib/freebl/rsapkcs.c b/security/nss/lib/freebl/rsapkcs.c index f26cd2954..73d40909d 100644 --- a/security/nss/lib/freebl/rsapkcs.c +++ b/security/nss/lib/freebl/rsapkcs.c @@ -116,7 +116,7 @@ rsa_FormatOneBlock(unsigned modulusLen, unsigned char *block; unsigned char *bp; unsigned int padLen; - int i, j; + unsigned int i, j; SECStatus rv; block = (unsigned char *)PORT_Alloc(modulusLen); @@ -1409,6 +1409,7 @@ RSA_CheckSignRecover(RSAPublicKey *key, unsigned int modulusLen = rsa_modulusLen(&key->modulus); unsigned int i; unsigned char *buffer = NULL; + unsigned int padLen; if (sigLen != modulusLen) { PORT_SetError(SEC_ERROR_BAD_SIGNATURE); @@ -1446,6 +1447,11 @@ RSA_CheckSignRecover(RSAPublicKey *key, goto done; } } + padLen = i - 2; + if (padLen < RSA_BLOCK_MIN_PAD_LEN) { + PORT_SetError(SEC_ERROR_BAD_SIGNATURE); + goto done; + } if (*outputLen == 0) { PORT_SetError(SEC_ERROR_BAD_SIGNATURE); goto done; |