diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2014-05-08 13:10:56 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2014-05-09 14:24:54 +0100 |
| commit | 0bcb17a7776b7f740e855932890edfb7acfd7124 (patch) | |
| tree | 20b800fa5e9a05b9396e472a90a8aff5a14f07f4 /crypto/cms | |
| parent | a935132099af20a8a742d30f8edcb613e73a368d (diff) | |
Return an error if no recipient type matches.
If the key type does not match any CMS recipient type return
an error instead of using a random key (MMA mitigation). This
does not leak any useful information to an attacker.
PR#3348
Diffstat (limited to 'crypto/cms')
| -rw-r--r-- | crypto/cms/cms_smime.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c index e907b279ea..7ad827697e 100644 --- a/crypto/cms/cms_smime.c +++ b/crypto/cms/cms_smime.c @@ -697,7 +697,7 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert) STACK_OF(CMS_RecipientInfo) *ris; CMS_RecipientInfo *ri; int i, r, ri_type; - int debug = 0; + int debug = 0, match_ri = 0; ris = CMS_get0_RecipientInfos(cms); if (ris) debug = cms->d.envelopedData->encryptedContentInfo->debug; @@ -714,6 +714,7 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert) ri = sk_CMS_RecipientInfo_value(ris, i); if (CMS_RecipientInfo_type(ri) != ri_type) continue; + match_ri = 1; if (ri_type == CMS_RECIPINFO_AGREE) { r = cms_kari_set1_pkey(cms, ri, pk, cert); @@ -757,7 +758,7 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert) } } /* If no cert and not debugging always return success */ - if (!cert && !debug) + if (match_ri && !cert && !debug) { ERR_clear_error(); return 1; |