arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-04-19 23:22:16 +03:00
Code

Only check the actual used lenght of the hash. (#8709)

Browse Source
This commit is contained in:
seism0saurus 2022-11-05 22:20:23 +01:00 committed by GitHub
parent 3a2fe9ff0f
commit 80bf716625
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libraries/ESP8266WiFi/src/BearSSLHelpers.cpp
View File

@ -945,7 +945,7 @@ extern "C" bool SigningVerifier_verify(PublicKey *_pubKey, UpdaterHashClass *has
} }
br_rsa_pkcs1_vrfy vrfy = br_rsa_pkcs1_vrfy_get_default(); br_rsa_pkcs1_vrfy vrfy = br_rsa_pkcs1_vrfy_get_default();
bool ret = vrfy((const unsigned char *)signature, signatureLen, hash->oid(), hash->len(), _pubKey->getRSA(), vrf); bool ret = vrfy((const unsigned char *)signature, signatureLen, hash->oid(), hash->len(), _pubKey->getRSA(), vrf);
if (!ret || memcmp(vrf, hash->hash(), sizeof(vrf)) ) { if (!ret || memcmp(vrf, hash->hash(), std::min(HashLengthMax, hash->len())) ) {
return false; return false;
} else { } else {
return true; return true;