diff options
author | Daniel Fiala <daniel@openssl.org> | 2022-06-22 20:49:51 +0200 |
---|---|---|
committer | Tomas Mraz <tomas@openssl.org> | 2022-06-27 10:59:55 +0200 |
commit | 7ee7ed9b793884f8a0de571434a44f42454adbdd (patch) | |
tree | 7f5fc7598b737728aff376dacf74d951beac5e3c /providers | |
parent | a56ccd9ee283fec5ae0c0f4b848137c208e4e1a7 (diff) |
Improve checks for invalid saltlen in DER writer.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18615)
(cherry picked from commit 08f876d0dea184b071a5aded4c55317e5a63c80e)
Diffstat (limited to 'providers')
-rw-r--r-- | providers/common/der/der_rsa_key.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/providers/common/der/der_rsa_key.c b/providers/common/der/der_rsa_key.c index 4bad32ee6d..2ae53a171d 100644 --- a/providers/common/der/der_rsa_key.c +++ b/providers/common/der/der_rsa_key.c @@ -305,7 +305,7 @@ int ossl_DER_w_RSASSA_PSS_params(WPACKET *pkt, int tag, saltlen = ossl_rsa_pss_params_30_saltlen(pss); trailerfield = ossl_rsa_pss_params_30_trailerfield(pss); - if (saltlen < 0) { + if (saltlen < 0 || (unsigned int)saltlen > UINT32_MAX) { ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_SALT_LENGTH); return 0; } @@ -347,8 +347,8 @@ int ossl_DER_w_RSASSA_PSS_params(WPACKET *pkt, int tag, return ossl_DER_w_begin_sequence(pkt, tag) && (trailerfield == default_trailerfield - || ossl_DER_w_uint32(pkt, 3, trailerfield)) - && (saltlen == default_saltlen || ossl_DER_w_uint32(pkt, 2, saltlen)) + || ossl_DER_w_uint32(pkt, 3, (uint32_t)trailerfield)) + && (saltlen == default_saltlen || ossl_DER_w_uint32(pkt, 2, (uint32_t)saltlen)) && DER_w_MaskGenAlgorithm(pkt, 1, pss) && (hashalg_nid == default_hashalg_nid || ossl_DER_w_precompiled(pkt, 0, hashalg, hashalg_sz)) |