From 17ef2916614ff3f1dfbab15c3250278528a31275 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulf=20M=C3=B6ller?= Date: Tue, 22 Feb 2000 11:34:01 +0000 Subject: Check tlen size in all padding_check functions. As called within the rsa library, the output buffer always is large enough, but if the tlen parameter is there, it should be checked in the interest of clarity, as proposed by David Sacerdote . --- crypto/rsa/rsa_pk1.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'crypto/rsa/rsa_pk1.c') diff --git a/crypto/rsa/rsa_pk1.c b/crypto/rsa/rsa_pk1.c index b35eb62682..48a32bc264 100644 --- a/crypto/rsa/rsa_pk1.c +++ b/crypto/rsa/rsa_pk1.c @@ -79,7 +79,7 @@ int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen, *(p++)=0; *(p++)=1; /* Private Key BT (Block Type) */ - /* padd out with 0xff data */ + /* pad out with 0xff data */ j=tlen-3-flen; memset(p,0xff,j); p+=j; @@ -130,6 +130,11 @@ int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen, } i++; /* Skip over the '\0' */ j-=i; + if (j > tlen) + { + RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE); + return(-1); + } memcpy(to,p,(unsigned int)j); return(j); @@ -207,6 +212,11 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, } i++; /* Skip over the '\0' */ j-=i; + if (j > tlen) + { + RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE); + return(-1); + } memcpy(to,p,(unsigned int)j); return(j); -- cgit v1.2.3