Skip to content

Commit

Permalink
RSA Verify Fix
Browse files Browse the repository at this point in the history
1. Switch from wc_RsaSSL_VerifyInline() to wc_RsaSSL_Verify(). Fixes a
   bad free.
  • Loading branch information
ejohnstown committed Feb 1, 2024
1 parent 815d22f commit 53ce7d7
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions src/internal.c
Original file line number Diff line number Diff line change
Expand Up @@ -9726,25 +9726,25 @@ int wolfSSH_RsaVerify(byte *sig, word32 sigSz,
const byte* digest, word32 digestSz,
RsaKey* key, void* heap, const char* loc)
{
byte* checkSig;
byte* check;
int ret = WS_SUCCESS;

checkSig = (byte*)WMALLOC(sigSz, heap, DYNTYPE_TEMP);
if (checkSig == NULL) {
check = (byte*)WMALLOC(digestSz, heap, DYNTYPE_TEMP);
if (check == NULL) {
ret = WS_MEMORY_E;
}
else {
int checkSz;

checkSz = wc_RsaSSL_VerifyInline(sig, sigSz, &checkSig, key);
checkSz = wc_RsaSSL_Verify(sig, sigSz, check, digestSz, key);
if (checkSz < 0
|| (word32)checkSz != digestSz
|| WMEMCMP(digest, checkSig, digestSz) != 0) {
|| WMEMCMP(digest, check, digestSz) != 0) {
WLOG(WS_LOG_DEBUG, "%s: %s", loc, "Bad RSA Sign Verify");
ret = WS_RSA_E;
}
ForceZero(checkSig, sigSz);
WFREE(checkSig, heap, DYNTYPE_TEMP);
ForceZero(check, digestSz);
WFREE(check, heap, DYNTYPE_TEMP);
}

return ret;
Expand Down

0 comments on commit 53ce7d7

Please sign in to comment.