280 lines
9.3 KiB
Diff
280 lines
9.3 KiB
Diff
|
diff --git a/lib/cryptohi/secvfy.c b/lib/cryptohi/secvfy.c
|
||
|
|
--- a/lib/cryptohi/secvfy.c
|
||
|
|
+++ b/lib/cryptohi/secvfy.c
|
||
|
|
@@ -164,6 +164,37 @@
|
||
|
|
PR_FALSE /*XXX: unsafeAllowMissingParameters*/);
|
||
|
|
}
|
||
|
|
|
||
|
|
+static unsigned int
|
||
|
|
+checkedSignatureLen(const SECKEYPublicKey *pubk)
|
||
|
|
+{
|
||
|
|
+ unsigned int sigLen = SECKEY_SignatureLen(pubk);
|
||
|
|
+ if (sigLen == 0) {
|
||
|
|
+ /* Error set by SECKEY_SignatureLen */
|
||
|
|
+ return sigLen;
|
||
|
|
+ }
|
||
|
|
+ unsigned int maxSigLen;
|
||
|
|
+ switch (pubk->keyType) {
|
||
|
|
+ case rsaKey:
|
||
|
|
+ case rsaPssKey:
|
||
|
|
+ maxSigLen = (RSA_MAX_MODULUS_BITS + 7) / 8;
|
||
|
|
+ break;
|
||
|
|
+ case dsaKey:
|
||
|
|
+ maxSigLen = DSA_MAX_SIGNATURE_LEN;
|
||
|
|
+ break;
|
||
|
|
+ case ecKey:
|
||
|
|
+ maxSigLen = 2 * MAX_ECKEY_LEN;
|
||
|
|
+ break;
|
||
|
|
+ default:
|
||
|
|
+ PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
|
||
|
|
+ return 0;
|
||
|
|
+ }
|
||
|
|
+ if (sigLen > maxSigLen) {
|
||
|
|
+ PORT_SetError(SEC_ERROR_INVALID_KEY);
|
||
|
|
+ return 0;
|
||
|
|
+ }
|
||
|
|
+ return sigLen;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
* decode the ECDSA or DSA signature from it's DER wrapping.
|
||
|
|
* The unwrapped/raw signature is placed in the buffer pointed
|
||
|
|
@@ -174,38 +205,38 @@
|
||
|
|
unsigned int len)
|
||
|
|
{
|
||
|
|
SECItem *dsasig = NULL; /* also used for ECDSA */
|
||
|
|
- SECStatus rv = SECSuccess;
|
||
|
|
|
||
|
|
- if ((algid != SEC_OID_ANSIX9_DSA_SIGNATURE) &&
|
||
|
|
- (algid != SEC_OID_ANSIX962_EC_PUBLIC_KEY)) {
|
||
|
|
- if (sig->len != len) {
|
||
|
|
- PORT_SetError(SEC_ERROR_BAD_DER);
|
||
|
|
- return SECFailure;
|
||
|
|
+ /* Safety: Ensure algId is as expected and that signature size is within maxmimums */
|
||
|
|
+ if (algid == SEC_OID_ANSIX9_DSA_SIGNATURE) {
|
||
|
|
+ if (len > DSA_MAX_SIGNATURE_LEN) {
|
||
|
|
+ goto loser;
|
||
|
|
}
|
||
|
|
-
|
||
|
|
- PORT_Memcpy(dsig, sig->data, sig->len);
|
||
|
|
- return SECSuccess;
|
||
|
|
+ } else if (algid == SEC_OID_ANSIX962_EC_PUBLIC_KEY) {
|
||
|
|
+ if (len > MAX_ECKEY_LEN * 2) {
|
||
|
|
+ goto loser;
|
||
|
|
+ }
|
||
|
|
+ } else {
|
||
|
|
+ goto loser;
|
||
|
|
}
|
||
|
|
|
||
|
|
- if (algid == SEC_OID_ANSIX962_EC_PUBLIC_KEY) {
|
||
|
|
- if (len > MAX_ECKEY_LEN * 2) {
|
||
|
|
- PORT_SetError(SEC_ERROR_BAD_DER);
|
||
|
|
- return SECFailure;
|
||
|
|
- }
|
||
|
|
+ /* Decode and pad to length */
|
||
|
|
+ dsasig = DSAU_DecodeDerSigToLen((SECItem *)sig, len);
|
||
|
|
+ if (dsasig == NULL) {
|
||
|
|
+ goto loser;
|
||
|
|
}
|
||
|
|
- dsasig = DSAU_DecodeDerSigToLen((SECItem *)sig, len);
|
||
|
|
-
|
||
|
|
- if ((dsasig == NULL) || (dsasig->len != len)) {
|
||
|
|
- rv = SECFailure;
|
||
|
|
- } else {
|
||
|
|
- PORT_Memcpy(dsig, dsasig->data, dsasig->len);
|
||
|
|
+ if (dsasig->len != len) {
|
||
|
|
+ SECITEM_FreeItem(dsasig, PR_TRUE);
|
||
|
|
+ goto loser;
|
||
|
|
}
|
||
|
|
|
||
|
|
- if (dsasig != NULL)
|
||
|
|
- SECITEM_FreeItem(dsasig, PR_TRUE);
|
||
|
|
- if (rv == SECFailure)
|
||
|
|
- PORT_SetError(SEC_ERROR_BAD_DER);
|
||
|
|
- return rv;
|
||
|
|
+ PORT_Memcpy(dsig, dsasig->data, len);
|
||
|
|
+ SECITEM_FreeItem(dsasig, PR_TRUE);
|
||
|
|
+
|
||
|
|
+ return SECSuccess;
|
||
|
|
+
|
||
|
|
+loser:
|
||
|
|
+ PORT_SetError(SEC_ERROR_BAD_DER);
|
||
|
|
+ return SECFailure;
|
||
|
|
}
|
||
|
|
|
||
|
|
const SEC_ASN1Template hashParameterTemplate[] =
|
||
|
|
@@ -281,7 +312,7 @@
|
||
|
|
sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg,
|
||
|
|
const SECItem *param, SECOidTag *encalgp, SECOidTag *hashalg)
|
||
|
|
{
|
||
|
|
- int len;
|
||
|
|
+ unsigned int len;
|
||
|
|
PLArenaPool *arena;
|
||
|
|
SECStatus rv;
|
||
|
|
SECItem oid;
|
||
|
|
@@ -466,48 +497,52 @@
|
||
|
|
cx->pkcs1RSADigestInfo = NULL;
|
||
|
|
rv = SECSuccess;
|
||
|
|
if (sig) {
|
||
|
|
- switch (type) {
|
||
|
|
- case rsaKey:
|
||
|
|
- rv = recoverPKCS1DigestInfo(hashAlg, &cx->hashAlg,
|
||
|
|
- &cx->pkcs1RSADigestInfo,
|
||
|
|
- &cx->pkcs1RSADigestInfoLen,
|
||
|
|
- cx->key,
|
||
|
|
- sig, wincx);
|
||
|
|
- break;
|
||
|
|
- case rsaPssKey:
|
||
|
|
- sigLen = SECKEY_SignatureLen(key);
|
||
|
|
- if (sigLen == 0) {
|
||
|
|
- /* error set by SECKEY_SignatureLen */
|
||
|
|
- rv = SECFailure;
|
||
|
|
+ rv = SECFailure;
|
||
|
|
+ if (type == rsaKey) {
|
||
|
|
+ rv = recoverPKCS1DigestInfo(hashAlg, &cx->hashAlg,
|
||
|
|
+ &cx->pkcs1RSADigestInfo,
|
||
|
|
+ &cx->pkcs1RSADigestInfoLen,
|
||
|
|
+ cx->key,
|
||
|
|
+ sig, wincx);
|
||
|
|
+ } else {
|
||
|
|
+ sigLen = checkedSignatureLen(key);
|
||
|
|
+ /* Check signature length is within limits */
|
||
|
|
+ if (sigLen == 0) {
|
||
|
|
+ /* error set by checkedSignatureLen */
|
||
|
|
+ rv = SECFailure;
|
||
|
|
+ goto loser;
|
||
|
|
+ }
|
||
|
|
+ if (sigLen > sizeof(cx->u)) {
|
||
|
|
+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
|
||
|
|
+ rv = SECFailure;
|
||
|
|
+ goto loser;
|
||
|
|
+ }
|
||
|
|
+ switch (type) {
|
||
|
|
+ case rsaPssKey:
|
||
|
|
+ if (sig->len != sigLen) {
|
||
|
|
+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
|
||
|
|
+ rv = SECFailure;
|
||
|
|
+ goto loser;
|
||
|
|
+ }
|
||
|
|
+ PORT_Memcpy(cx->u.buffer, sig->data, sigLen);
|
||
|
|
+ rv = SECSuccess;
|
||
|
|
break;
|
||
|
|
- }
|
||
|
|
- if (sig->len != sigLen) {
|
||
|
|
- PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
|
||
|
|
+ case ecKey:
|
||
|
|
+ case dsaKey:
|
||
|
|
+ /* decodeECorDSASignature will check sigLen == sig->len after padding */
|
||
|
|
+ rv = decodeECorDSASignature(encAlg, sig, cx->u.buffer, sigLen);
|
||
|
|
+ break;
|
||
|
|
+ default:
|
||
|
|
+ /* Unreachable */
|
||
|
|
rv = SECFailure;
|
||
|
|
- break;
|
||
|
|
- }
|
||
|
|
- PORT_Memcpy(cx->u.buffer, sig->data, sigLen);
|
||
|
|
- break;
|
||
|
|
- case dsaKey:
|
||
|
|
- case ecKey:
|
||
|
|
- sigLen = SECKEY_SignatureLen(key);
|
||
|
|
- if (sigLen == 0) {
|
||
|
|
- /* error set by SECKEY_SignatureLen */
|
||
|
|
- rv = SECFailure;
|
||
|
|
- break;
|
||
|
|
- }
|
||
|
|
- rv = decodeECorDSASignature(encAlg, sig, cx->u.buffer, sigLen);
|
||
|
|
- break;
|
||
|
|
- default:
|
||
|
|
- rv = SECFailure;
|
||
|
|
- PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
|
||
|
|
- break;
|
||
|
|
+ goto loser;
|
||
|
|
+ }
|
||
|
|
+ }
|
||
|
|
+ if (rv != SECSuccess) {
|
||
|
|
+ goto loser;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
- if (rv)
|
||
|
|
- goto loser;
|
||
|
|
-
|
||
|
|
/* check hash alg again, RSA may have changed it.*/
|
||
|
|
if (HASH_GetHashTypeByOidTag(cx->hashAlg) == HASH_AlgNULL) {
|
||
|
|
/* error set by HASH_GetHashTypeByOidTag */
|
||
|
|
@@ -650,11 +685,16 @@
|
||
|
|
switch (cx->key->keyType) {
|
||
|
|
case ecKey:
|
||
|
|
case dsaKey:
|
||
|
|
- dsasig.data = cx->u.buffer;
|
||
|
|
- dsasig.len = SECKEY_SignatureLen(cx->key);
|
||
|
|
+ dsasig.len = checkedSignatureLen(cx->key);
|
||
|
|
if (dsasig.len == 0) {
|
||
|
|
return SECFailure;
|
||
|
|
}
|
||
|
|
+ if (dsasig.len > sizeof(cx->u)) {
|
||
|
|
+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
|
||
|
|
+ return SECFailure;
|
||
|
|
+ }
|
||
|
|
+ dsasig.data = cx->u.buffer;
|
||
|
|
+
|
||
|
|
if (sig) {
|
||
|
|
rv = decodeECorDSASignature(cx->encAlg, sig, dsasig.data,
|
||
|
|
dsasig.len);
|
||
|
|
@@ -686,8 +726,13 @@
|
||
|
|
}
|
||
|
|
|
||
|
|
rsasig.data = cx->u.buffer;
|
||
|
|
- rsasig.len = SECKEY_SignatureLen(cx->key);
|
||
|
|
+ rsasig.len = checkedSignatureLen(cx->key);
|
||
|
|
if (rsasig.len == 0) {
|
||
|
|
+ /* Error set by checkedSignatureLen */
|
||
|
|
+ return SECFailure;
|
||
|
|
+ }
|
||
|
|
+ if (rsasig.len > sizeof(cx->u)) {
|
||
|
|
+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
|
||
|
|
return SECFailure;
|
||
|
|
}
|
||
|
|
if (sig) {
|
||
|
|
@@ -749,7 +794,6 @@
|
||
|
|
SECStatus rv;
|
||
|
|
VFYContext *cx;
|
||
|
|
SECItem dsasig; /* also used for ECDSA */
|
||
|
|
-
|
||
|
|
rv = SECFailure;
|
||
|
|
|
||
|
|
cx = vfy_CreateContext(key, sig, encAlg, hashAlg, NULL, wincx);
|
||
|
|
@@ -757,19 +801,25 @@
|
||
|
|
switch (key->keyType) {
|
||
|
|
case rsaKey:
|
||
|
|
rv = verifyPKCS1DigestInfo(cx, digest);
|
||
|
|
+ /* Error (if any) set by verifyPKCS1DigestInfo */
|
||
|
|
break;
|
||
|
|
- case dsaKey:
|
||
|
|
case ecKey:
|
||
|
|
+ case dsaKey:
|
||
|
|
dsasig.data = cx->u.buffer;
|
||
|
|
- dsasig.len = SECKEY_SignatureLen(cx->key);
|
||
|
|
+ dsasig.len = checkedSignatureLen(cx->key);
|
||
|
|
if (dsasig.len == 0) {
|
||
|
|
+ /* Error set by checkedSignatureLen */
|
||
|
|
+ rv = SECFailure;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
- if (PK11_Verify(cx->key, &dsasig, (SECItem *)digest, cx->wincx) !=
|
||
|
|
- SECSuccess) {
|
||
|
|
+ if (dsasig.len > sizeof(cx->u)) {
|
||
|
|
PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
|
||
|
|
- } else {
|
||
|
|
- rv = SECSuccess;
|
||
|
|
+ rv = SECFailure;
|
||
|
|
+ break;
|
||
|
|
+ }
|
||
|
|
+ rv = PK11_Verify(cx->key, &dsasig, (SECItem *)digest, cx->wincx);
|
||
|
|
+ if (rv != SECSuccess) {
|
||
|
|
+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
default:
|
||
|
|
|