Closed
Bug 2019357
Opened 8 months ago
Closed 8 months ago
RSA_EMSAEncodePSS should validate the length of mHash
Categories
(NSS :: Libraries, defect)
NSS
Libraries
Tracking
(nss 3.122, firefox-esr140 fixed, firefox150 fixed)
RESOLVED
FIXED
People
(Reporter: keeler, Assigned: keeler)
References
Details
Attachments
(1 external file)
RSA_EMSAEncodePSS takes the hash of the message as an argument (mHash). However, it's possible for the caller to provide an insufficiently-long buffer for this argument (see bug 2018983). Callers of RSA_EMSAEncodePSS know how long that buffer is, so they should provide the length so it can validate it. (Admittedly, in the RSA_SignPSS case, the hash length is ultimately provided by the caller anyway, so this is really more of a belt-and-suspenders kind of thing.)
|
Assignee | |
Comment 1•8 months ago
|
||
Pushed by jschanck@mozilla.com:
https://hg.mozilla.org/projects/nss/rev/ff8b08f1808b
RSA_EMSAEncodePSS should validate the length of mHash r=nkulatova
Status: ASSIGNED → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED
|
||
Updated•7 months ago
|
status-nss:
--- → 3.122
Pushed by jschanck@mozilla.com:
https://hg.mozilla.org/projects/nss/rev/080173f5c37e
RSA_EMSAEncodePSS should validate the length of mHash r?nkulatova
|
||
Updated•7 months ago
|
status-firefox150:
--- → fixed
status-firefox-esr140:
--- → fixed
You need to log in
before you can comment on or make changes to this bug.
Description
•