From c6acb32cb24165396b53a48759e8cbc90cfc9b60 Mon Sep 17 00:00:00 2001
From: beck <>
Date: Fri, 9 Nov 2018 05:43:39 +0000
Subject: Ensure we only choose sigalgs from our prefernce list, not the whole
 list ok jsing@

---
 src/lib/libssl/ssl_clnt.c    |  5 +++--
 src/lib/libssl/ssl_sigalgs.c | 15 +++++++++++----
 src/lib/libssl/ssl_sigalgs.h |  4 ++--
 src/lib/libssl/ssl_srvr.c    |  5 +++--
 4 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index f1b3d40e7c..5dbda1f2fa 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_clnt.c,v 1.38 2018/11/09 00:34:55 beck Exp $ */
+/* $OpenBSD: ssl_clnt.c,v 1.39 2018/11/09 05:43:39 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1510,7 +1510,8 @@ ssl3_get_server_key_exchange(SSL *s)
 
 			if (!CBS_get_u16(&cbs, &sigalg))
 				goto truncated;
-			if ((md = ssl_sigalg_md(sigalg)) == NULL) {
+			if ((md = ssl_sigalg_md(sigalg, tls12_sigalgs,
+			    tls12_sigalgs_len)) == NULL) {
 				SSLerror(s, SSL_R_UNKNOWN_DIGEST);
 				al = SSL_AD_DECODE_ERROR;
 				goto f_err;
diff --git a/src/lib/libssl/ssl_sigalgs.c b/src/lib/libssl/ssl_sigalgs.c
index fe10965feb..3f82117dcf 100644
--- a/src/lib/libssl/ssl_sigalgs.c
+++ b/src/lib/libssl/ssl_sigalgs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sigalgs.c,v 1.2 2018/11/09 05:02:53 beck Exp $ */
+/* $OpenBSD: ssl_sigalgs.c,v 1.3 2018/11/09 05:43:39 beck Exp $ */
 /*
  * Copyright (c) 2018, Bob Beck <beck@openbsd.org>
  *
@@ -188,12 +188,19 @@ ssl_sigalg_lookup(uint16_t sigalg)
 }
 
 const EVP_MD *
-ssl_sigalg_md(uint16_t sigalg)
+ssl_sigalg_md(uint16_t sigalg, uint16_t *values, size_t len)
 {
 	const struct ssl_sigalg *sap;
+	int i;
 
-	if ((sap = ssl_sigalg_lookup(sigalg)) != NULL)
-		return sap->md();
+	for (i = 0; i < len; i++) {
+		if (values[i] == sigalg)
+			break;
+	}
+	if (values[i] == sigalg) {
+		if ((sap = ssl_sigalg_lookup(sigalg)) != NULL)
+			return sap->md();
+	}
 
 	return NULL;
 }
diff --git a/src/lib/libssl/ssl_sigalgs.h b/src/lib/libssl/ssl_sigalgs.h
index 629213e761..3839a8d37c 100644
--- a/src/lib/libssl/ssl_sigalgs.h
+++ b/src/lib/libssl/ssl_sigalgs.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sigalgs.h,v 1.3 2018/11/09 05:02:53 beck Exp $ */
+/* $OpenBSD: ssl_sigalgs.h,v 1.4 2018/11/09 05:43:39 beck Exp $ */
 /*
  * Copyright (c) 2018, Bob Beck <beck@openbsd.org>
  *
@@ -70,7 +70,7 @@ extern uint16_t tls12_sigalgs[];
 extern size_t tls12_sigalgs_len;
 
 const struct ssl_sigalg *ssl_sigalg_lookup(uint16_t sigalg);
-const EVP_MD * ssl_sigalg_md(uint16_t sigalg);
+const EVP_MD * ssl_sigalg_md(uint16_t sigalg, uint16_t *values, size_t len);
 uint16_t ssl_sigalg_value(const EVP_PKEY *pk, const EVP_MD *md);
 int ssl_sigalgs_build(CBB *cbb, uint16_t *values, size_t len);
 int ssl_sigalg_pkey_check(uint16_t sigalg, EVP_PKEY *pk);
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index 59d560d06d..51e5475f54 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_srvr.c,v 1.53 2018/11/09 05:02:53 beck Exp $ */
+/* $OpenBSD: ssl_srvr.c,v 1.54 2018/11/09 05:43:39 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2159,7 +2159,8 @@ ssl3_get_cert_verify(SSL *s)
 
 			if (!CBS_get_u16(&cbs, &sigalg))
 				goto truncated;
-			if ((md = ssl_sigalg_md(sigalg)) == NULL) {
+			if ((md = ssl_sigalg_md(sigalg, tls12_sigalgs,
+			    tls12_sigalgs_len)) == NULL) {
 				SSLerror(s, SSL_R_UNKNOWN_DIGEST);
 				al = SSL_AD_DECODE_ERROR;
 				goto f_err;
-- 
cgit v1.2.3-55-g6feb