diff options
| -rw-r--r-- | CHANGES | 4 | ||||
| -rw-r--r-- | apps/speed.c | 2 | ||||
| -rw-r--r-- | apps/spkac.c | 2 | ||||
| -rw-r--r-- | apps/verify.c | 3 | ||||
| -rw-r--r-- | apps/x509.c | 2 | ||||
| -rw-r--r-- | crypto/cms/cms_sd.c | 2 | ||||
| -rw-r--r-- | ssl/s2_clnt.c | 2 | ||||
| -rw-r--r-- | ssl/s2_srvr.c | 4 | ||||
| -rw-r--r-- | ssl/s3_clnt.c | 6 | ||||
| -rw-r--r-- | ssl/s3_srvr.c | 2 | ||||
| -rw-r--r-- | ssl/ssltest.c | 2 |
11 files changed, 17 insertions, 14 deletions
@@ -4,6 +4,10 @@ Changes between 0.9.8i and 0.9.8j [xx XXX xxxx] + *) Properly check EVP_VerifyFinal() and similar return values + (CVE-2008-5077). + [Ben Laurie, Bodo Moeller, Google Security Team] + *) Enable TLS extensions by default. [Ben Laurie] diff --git a/apps/speed.c b/apps/speed.c index e6b187d840..af077b54a8 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -2132,7 +2132,7 @@ int MAIN(int argc, char **argv) { ret=RSA_verify(NID_md5_sha1, buf,36, buf2, rsa_num, rsa_key[j]); - if (ret == 0) + if (ret <= 0) { BIO_printf(bio_err, "RSA verify failure\n"); diff --git a/apps/spkac.c b/apps/spkac.c index ae2d88694f..0e01ea9947 100644 --- a/apps/spkac.c +++ b/apps/spkac.c @@ -285,7 +285,7 @@ bad: pkey = NETSCAPE_SPKI_get_pubkey(spki); if(verify) { i = NETSCAPE_SPKI_verify(spki, pkey); - if(i) BIO_printf(bio_err, "Signature OK\n"); + if (i > 0) BIO_printf(bio_err, "Signature OK\n"); else { BIO_printf(bio_err, "Signature Failure\n"); ERR_print_errors(bio_err); diff --git a/apps/verify.c b/apps/verify.c index 9ff32cb068..20cc9e354c 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -266,7 +266,7 @@ static int check(X509_STORE *ctx, char *file, STACK_OF(X509) *uchain, STACK_OF(X ret=0; end: - if (i) + if (i > 0) { fprintf(stdout,"OK\n"); ret=1; @@ -367,4 +367,3 @@ static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx) ERR_clear_error(); return(ok); } - diff --git a/apps/x509.c b/apps/x509.c index f6938356f8..d904d34021 100644 --- a/apps/x509.c +++ b/apps/x509.c @@ -1151,7 +1151,7 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest, /* NOTE: this certificate can/should be self signed, unless it was * a certificate request in which case it is not. */ X509_STORE_CTX_set_cert(&xsc,x); - if (!reqfile && !X509_verify_cert(&xsc)) + if (!reqfile && X509_verify_cert(&xsc) <= 0) goto end; if (!X509_check_private_key(xca,pkey)) diff --git a/crypto/cms/cms_sd.c b/crypto/cms/cms_sd.c index 591bfbec33..cdac3b870d 100644 --- a/crypto/cms/cms_sd.c +++ b/crypto/cms/cms_sd.c @@ -830,7 +830,7 @@ int CMS_SignerInfo_verify(CMS_SignerInfo *si) cms_fixup_mctx(&mctx, si->pkey); r = EVP_VerifyFinal(&mctx, si->signature->data, si->signature->length, si->pkey); - if (!r) + if (r <= 0) CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE); err: EVP_MD_CTX_cleanup(&mctx); diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c index e2a90a3ca2..782129cd5d 100644 --- a/ssl/s2_clnt.c +++ b/ssl/s2_clnt.c @@ -1044,7 +1044,7 @@ int ssl2_set_certificate(SSL *s, int type, int len, const unsigned char *data) i=ssl_verify_cert_chain(s,sk); - if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)) + if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)) { SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED); goto err; diff --git a/ssl/s2_srvr.c b/ssl/s2_srvr.c index 0daf2b129d..50d55e6bf1 100644 --- a/ssl/s2_srvr.c +++ b/ssl/s2_srvr.c @@ -1054,7 +1054,7 @@ static int request_certificate(SSL *s) i=ssl_verify_cert_chain(s,sk); - if (i) /* we like the packet, now check the chksum */ + if (i > 0) /* we like the packet, now check the chksum */ { EVP_MD_CTX ctx; EVP_PKEY *pkey=NULL; @@ -1083,7 +1083,7 @@ static int request_certificate(SSL *s) EVP_PKEY_free(pkey); EVP_MD_CTX_cleanup(&ctx); - if (i) + if (i > 0) { if (s->session->peer != NULL) X509_free(s->session->peer); diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 837507cce1..5fd3520caf 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -972,7 +972,7 @@ int ssl3_get_server_certificate(SSL *s) } i=ssl_verify_cert_chain(s,sk); - if ((s->verify_mode != SSL_VERIFY_NONE) && (!i) + if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0) #ifndef OPENSSL_NO_KRB5 && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK)) != (SSL_aKRB5|SSL_kKRB5) @@ -1459,7 +1459,7 @@ int ssl3_get_key_exchange(SSL *s) EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); EVP_VerifyUpdate(&md_ctx,param,param_len); - if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey)) + if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0) { /* bad signature */ al=SSL_AD_DECRYPT_ERROR; @@ -1477,7 +1477,7 @@ int ssl3_get_key_exchange(SSL *s) EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); EVP_VerifyUpdate(&md_ctx,param,param_len); - if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey)) + if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0) { /* bad signature */ al=SSL_AD_DECRYPT_ERROR; diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c index 04f9f79ab2..80b45eb86f 100644 --- a/ssl/s3_srvr.c +++ b/ssl/s3_srvr.c @@ -2566,7 +2566,7 @@ int ssl3_get_client_certificate(SSL *s) else { i=ssl_verify_cert_chain(s,sk); - if (!i) + if (i <= 0) { al=ssl_verify_alarm_type(s->verify_result); SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED); diff --git a/ssl/ssltest.c b/ssl/ssltest.c index 82086d1718..b09c542087 100644 --- a/ssl/ssltest.c +++ b/ssl/ssltest.c @@ -2093,7 +2093,7 @@ static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg) if (cb_arg->proxy_auth) { - if (ok) + if (ok > 0) { const char *cond_end = NULL; |