Fix CVE-2008-5077: Incorrect checks for malformed signatures

9 files changed, 11 insertions, 12 deletions

diff --git a/src/lib/libssl/src/apps/speed.c b/src/lib/libssl/src/apps/speed.c
index 2fc327c375..643a76870c 100644
--- a/src/lib/libssl/src/apps/speed.c
+++ b/src/lib/libssl/src/apps/speed.c
@@ -1486,7 +1486,7 @@ int MAIN(int argc, char **argv)
                                 {
                                 ret=RSA_verify(NID_md5_sha1, buf,36, buf2,
                                         rsa_num, rsa_key[j]);
-                                if (ret == 0)
+                                if (ret <= 0)
                                         {
                                         BIO_printf(bio_err,
                                                 "RSA verify failure\n");
diff --git a/src/lib/libssl/src/apps/spkac.c b/src/lib/libssl/src/apps/spkac.c
index 47ee53f1ee..4fb539537c 100644
--- a/src/lib/libssl/src/apps/spkac.c
+++ b/src/lib/libssl/src/apps/spkac.c
@@ -284,7 +284,7 @@ bad:
         pkey = NETSCAPE_SPKI_get_pubkey(spki);
         if(verify) {
                 i = NETSCAPE_SPKI_verify(spki, pkey);
-                if(i) BIO_printf(bio_err, "Signature OK\n");
+                if (i > 0) BIO_printf(bio_err, "Signature OK\n");
                 else {
                         BIO_printf(bio_err, "Signature Failure\n");
                         ERR_print_errors(bio_err);
diff --git a/src/lib/libssl/src/apps/verify.c b/src/lib/libssl/src/apps/verify.c
index d73280cdd0..dabbf6fc89 100644
--- a/src/lib/libssl/src/apps/verify.c
+++ b/src/lib/libssl/src/apps/verify.c
@@ -275,7 +275,7 @@ static int check(X509_STORE *ctx, char *file, STACK_OF(X509) *uchain, STACK_OF(X
 
         ret=0;
 end:
-        if (i)
+        if (i > 0)
                 {
                 fprintf(stdout,"OK\n");
                 ret=1;
@@ -366,4 +366,3 @@ static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx)
                 ERR_clear_error();
         return(ok);
         }
-
diff --git a/src/lib/libssl/src/apps/x509.c b/src/lib/libssl/src/apps/x509.c
index e7115cac67..b83d8a13a3 100644
--- a/src/lib/libssl/src/apps/x509.c
+++ b/src/lib/libssl/src/apps/x509.c
@@ -1123,7 +1123,7 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
         /* NOTE: this certificate can/should be self signed, unless it was
          * a certificate request in which case it is not. */
         X509_STORE_CTX_set_cert(&xsc,x);
-        if (!reqfile && !X509_verify_cert(&xsc))
+        if (!reqfile && X509_verify_cert(&xsc) <= 0)
                 goto end;
 
         if (!X509_check_private_key(xca,pkey))
diff --git a/src/lib/libssl/src/ssl/s2_clnt.c b/src/lib/libssl/src/ssl/s2_clnt.c
index 003809271b..72ff070495 100644
--- a/src/lib/libssl/src/ssl/s2_clnt.c
+++ b/src/lib/libssl/src/ssl/s2_clnt.c
@@ -1062,7 +1062,7 @@ int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
 
         i=ssl_verify_cert_chain(s,sk);
                 
-        if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
+        if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0))
                 {
                 SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
                 goto err;
diff --git a/src/lib/libssl/src/ssl/s2_srvr.c b/src/lib/libssl/src/ssl/s2_srvr.c
index 7a4992b7aa..a978aaea4b 100644
--- a/src/lib/libssl/src/ssl/s2_srvr.c
+++ b/src/lib/libssl/src/ssl/s2_srvr.c
@@ -1070,7 +1070,7 @@ static int request_certificate(SSL *s)
 
         i=ssl_verify_cert_chain(s,sk);
 
-        if (i)  /* we like the packet, now check the chksum */
+        if (i > 0)      /* we like the packet, now check the chksum */
                 {
                 EVP_MD_CTX ctx;
                 EVP_PKEY *pkey=NULL;
@@ -1099,7 +1099,7 @@ static int request_certificate(SSL *s)
                 EVP_PKEY_free(pkey);
                 EVP_MD_CTX_cleanup(&ctx);
 
-                if (i) 
+                if (i > 0)
                         {
                         if (s->session->peer != NULL)
                                 X509_free(s->session->peer);
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index 4163d97944..ec4b44979a 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -833,7 +833,7 @@ static int ssl3_get_server_certificate(SSL *s)
                 }
 
         i=ssl_verify_cert_chain(s,sk);
-        if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
+        if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
 #ifndef OPENSSL_NO_KRB5
                 && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
                 != (SSL_aKRB5|SSL_kKRB5)
@@ -1200,7 +1200,7 @@ static int ssl3_get_key_exchange(SSL *s)
                         EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
                         EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
                         EVP_VerifyUpdate(&md_ctx,param,param_len);
-                        if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
+                        if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
                                 {
                                 /* bad signature */
                                 al=SSL_AD_DECRYPT_ERROR;
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 36fc39d7f8..37fe43d397 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -2009,7 +2009,7 @@ static int ssl3_get_client_certificate(SSL *s)
         else
                 {
                 i=ssl_verify_cert_chain(s,sk);
-                if (!i)
+                if (i <= 0)
                         {
                         al=ssl_verify_alarm_type(s->verify_result);
                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);
diff --git a/src/lib/libssl/src/ssl/ssltest.c b/src/lib/libssl/src/ssl/ssltest.c
index 9381c435d5..0edd0d2025 100644
--- a/src/lib/libssl/src/ssl/ssltest.c
+++ b/src/lib/libssl/src/ssl/ssltest.c
@@ -1984,7 +1984,7 @@ static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
 
         if (cb_arg->proxy_auth)
                 {
-                if (ok)
+                if (ok > 0)
                         {
                         const char *cond_end = NULL;