mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 20:19:29 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
44 lines
1.4 KiB
C
44 lines
1.4 KiB
C
/* Provenance: openssl/openssl tls1_check_sig_alg (fixed).
|
|
* repo: openssl/openssl
|
|
* commit: a87f3fe01a5a894aa27ccd6a239155fd129988e4
|
|
* parent: 3656c08ab4b1b892730cb5e808b6f4298b08a2e6
|
|
* commit_url: https://github.com/openssl/openssl/commit/a87f3fe01a5a894aa27ccd6a239155fd129988e4
|
|
* cve: CVE-2020-1967
|
|
* license: OpenSSL License
|
|
* function: tls1_check_sig_alg
|
|
* relpath: ssl/t1_lib.c
|
|
*/
|
|
|
|
static int tls1_check_sig_alg(SSL *s, X509 *x, int default_nid)
|
|
{
|
|
int sig_nid, use_pc_sigalgs = 0;
|
|
size_t i;
|
|
const SIGALG_LOOKUP *sigalg;
|
|
size_t sigalgslen;
|
|
if (default_nid == -1)
|
|
return 1;
|
|
sig_nid = X509_get_signature_nid(x);
|
|
if (default_nid)
|
|
return sig_nid == default_nid ? 1 : 0;
|
|
|
|
if (SSL_IS_TLS13(s) && s->s3.tmp.peer_cert_sigalgs != NULL) {
|
|
/*
|
|
* If we're in TLSv1.3 then we only get here if we're checking the
|
|
* chain. If the peer has specified peer_cert_sigalgs then we use them
|
|
* otherwise we default to normal sigalgs.
|
|
*/
|
|
sigalgslen = s->s3.tmp.peer_cert_sigalgslen;
|
|
use_pc_sigalgs = 1;
|
|
} else {
|
|
sigalgslen = s->shared_sigalgslen;
|
|
}
|
|
for (i = 0; i < sigalgslen; i++) {
|
|
sigalg = use_pc_sigalgs
|
|
? tls1_lookup_sigalg(s->s3.tmp.peer_cert_sigalgs[i])
|
|
: s->shared_sigalgs[i];
|
|
if (sigalg != NULL && sig_nid == sigalg->sigandhash)
|
|
return 1;
|
|
}
|
|
return 0;
|
|
}
|