ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity

signature-params: Properly handle MGF1 algorithm identifier without parameters 

Credit to OSS-Fuzz.

Fixes: CVE-2018-6459
This commit is contained in:
Tobias Brunner 2017-12-04 10:51:47 +01:00
parent 0bb4d2179d
commit 40da179f28
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/libstrongswan/credentials/keys/signature_params.c
View File

@ -280,13 +280,17 @@ bool rsa_pss_params_parse(chunk_t asn1, int level0, rsa_pss_params_t *params)
case RSASSA_PSS_PARAMS_MGF_ALG:
if (object.len)
{
chunk_t hash;
chunk_t hash = chunk_empty;
alg = asn1_parse_algorithmIdentifier(object, level, &hash);
if (alg != OID_MGF1)
{
goto end;
}
if (!hash.len)
{
goto end;
}
alg = asn1_parse_algorithmIdentifier(hash, level+1, NULL);
params->mgf1_hash = hasher_algorithm_from_oid(alg);
if (params->mgf1_hash == HASH_UNKNOWN)