- markus@cvs.openbsd.org 2003/06/16 08:22:35

     [ssh-rsa.c]
     make sure the signature has at least the expected length (don't
     insist on len == hlen + oidlen, since this breaks some smartcards)
     bugzilla #592; ok djm@

diff --git a/ChangeLog b/ChangeLog
index 05acfd4c207dce1ae739a76e1f0376af8cd93c6f..0d7523f407a4f1b9955f132348da31235cc34b92 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,11 @@
    - markus@cvs.openbsd.org 2003/06/12 19:12:03
      [scard.c scard.h ssh-agent.c ssh.c]
      add sc_get_key_label; larsch at trustcenter.de; bugzilla#591
+   - markus@cvs.openbsd.org 2003/06/16 08:22:35
+     [ssh-rsa.c]
+     make sure the signature has at least the expected length (don't
+     insist on len == hlen + oidlen, since this breaks some smartcards)
+     bugzilla #592; ok djm@
 
 20030614
  - (djm) Update license on fake-rfc2553.[ch]; ok itojun@

diff --git a/ssh-rsa.c b/ssh-rsa.c
index efbc9e66496e07a1556ad2be40e411c205fa03c5..db8e5e359f506bb4c173827ce015d77d32641ff7 100644 (file)
--- a/ssh-rsa.c
+++ b/ssh-rsa.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-rsa.c,v 1.28 2003/02/12 09:33:04 markus Exp $");
+RCSID("$OpenBSD: ssh-rsa.c,v 1.29 2003/06/16 08:22:35 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -247,8 +247,8 @@ openssh_RSA_verify(int type, u_char *hash, u_int hashlen,
                    ERR_error_string(ERR_get_error(), NULL));
                goto done;
        }
-       if (len != hlen + oidlen) {
-               error("bad decrypted len: %d != %d + %d", len, hlen, oidlen);
+       if (len < hlen + oidlen) {
+               error("bad decrypted len: %d < %d + %d", len, hlen, oidlen);
                goto done;
        }
        if (memcmp(decrypted, oid, oidlen) != 0) {