diff options
| author | Werner Koch <[email protected]> | 2022-11-15 08:56:13 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2022-11-15 08:56:13 +0000 |
| commit | 868dabb4027a03f4ce39be3c143b480bccde1a63 (patch) | |
| tree | 5c054d683da09a60aeb64bd74b3a185a9e05d721 /dirmngr/crlcache.c | |
| parent | agent: Allow trustlist on Windows in Unicode homedirs. (diff) | |
| download | gnupg-868dabb4027a03f4ce39be3c143b480bccde1a63.tar.gz gnupg-868dabb4027a03f4ce39be3c143b480bccde1a63.zip | |
dirmngr: Fix verification of ECDSA signed CRLs.
* dirmngr/crlcache.c (finish_sig_check): Use raw value for the data.
--
This had the usual signed/unsigned problem. By using the modern form
we enforce Libgcrypt internal parsing as unsigned integer.
Diffstat (limited to 'dirmngr/crlcache.c')
| -rw-r--r-- | dirmngr/crlcache.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/dirmngr/crlcache.c b/dirmngr/crlcache.c index 45e0e6c0c..f0893a64a 100644 --- a/dirmngr/crlcache.c +++ b/dirmngr/crlcache.c @@ -1831,9 +1831,10 @@ finish_sig_check (ksba_crl_t crl, gcry_md_hd_t md, int algo, if (n > qbits/8) n = qbits/8; - err = gcry_sexp_build (&s_hash, NULL, "%b", + err = gcry_sexp_build (&s_hash, NULL, "(data(flags raw)(value %b))", (int)n, gcry_md_read (md, algo)); + } else { @@ -1852,7 +1853,7 @@ finish_sig_check (ksba_crl_t crl, gcry_md_hd_t md, int algo, /* Pass this on to the signature verification. */ err = gcry_pk_verify (s_sig, s_hash, s_pkey); if (DBG_X509) - log_debug ("gcry_pk_verify: %s\n", gpg_strerror (err)); + log_debug ("%s: gcry_pk_verify: %s\n", __func__, gpg_strerror (err)); leave: xfree (sigval); |