From 5e5345d98de4daff42970efd7f3fab2802710b20 Mon Sep 17 00:00:00 2001
From: miod <>
Date: Wed, 15 Jul 2015 16:45:24 +0000
Subject: Do not allow TS_check_signer_name() with signer == NULL from
 int_TS_RESP_verify_token(). Coverity CID 21710.

Looking further, int_TS_RESP_verify_token() will only initialize signer to
something non-NULL if TS_VFY_SIGNATURE is set in ctx->flags. But guess what?
TS_REQ_to_TS_VERIFY_CTX() in ts/ts_verify_ctx.c, which is the TS_VERIFY_CTX
constructor, explicitely clears this bit, with:
        ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE);
followed by more conditional flag clears.

Of course, nothing prevents the user to fiddle with ctx->flags afterwards. This
is exactly what ts.c in usr.bin/openssl does. This is gross, mistakes will
happen.

ok beck@
---
 src/lib/libcrypto/ts/ts_rsp_verify.c         | 5 ++++-
 src/lib/libssl/src/crypto/ts/ts_rsp_verify.c | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/lib/libcrypto/ts/ts_rsp_verify.c b/src/lib/libcrypto/ts/ts_rsp_verify.c
index 25fc22dfaf..56397eeec3 100644
--- a/src/lib/libcrypto/ts/ts_rsp_verify.c
+++ b/src/lib/libcrypto/ts/ts_rsp_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ts_rsp_verify.c,v 1.12 2014/07/11 08:44:49 jsing Exp $ */
+/* $OpenBSD: ts_rsp_verify.c,v 1.13 2015/07/15 16:45:24 miod Exp $ */
 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
  * project 2002.
  */
@@ -698,6 +698,9 @@ TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
 	int idx = -1;
 	int found = 0;
 
+	if (signer == NULL)
+		return 0;
+
 	/* Check the subject name first. */
 	if (tsa_name->type == GEN_DIRNAME &&
 	    X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0)
diff --git a/src/lib/libssl/src/crypto/ts/ts_rsp_verify.c b/src/lib/libssl/src/crypto/ts/ts_rsp_verify.c
index 25fc22dfaf..56397eeec3 100644
--- a/src/lib/libssl/src/crypto/ts/ts_rsp_verify.c
+++ b/src/lib/libssl/src/crypto/ts/ts_rsp_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ts_rsp_verify.c,v 1.12 2014/07/11 08:44:49 jsing Exp $ */
+/* $OpenBSD: ts_rsp_verify.c,v 1.13 2015/07/15 16:45:24 miod Exp $ */
 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
  * project 2002.
  */
@@ -698,6 +698,9 @@ TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
 	int idx = -1;
 	int found = 0;
 
+	if (signer == NULL)
+		return 0;
+
 	/* Check the subject name first. */
 	if (tsa_name->type == GEN_DIRNAME &&
 	    X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0)
-- 
cgit v1.2.3-55-g6feb