1 files changed, 8 insertions, 1 deletions

diff --git a/src/lib/libcrypto/asn1/a_verify.c b/src/lib/libcrypto/asn1/a_verify.c
index ea937cab3a..3fc79b78f6 100644
--- a/src/lib/libcrypto/asn1/a_verify.c
+++ b/src/lib/libcrypto/asn1/a_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_verify.c,v 1.20 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: a_verify.c,v 1.21 2015/01/28 04:14:31 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -85,6 +85,13 @@ ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a,
                 return -1;
         }
 
+        if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)
+        {
+                ASN1err(ASN1_F_ASN1_VERIFY,
+                    ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
+                return -1;
+        }
+
         EVP_MD_CTX_init(&ctx);
 
         /* Convert signature OID into digest and public key OIDs */