From: Dr. David von Oheimb <dev@ddvo.net>
Date: Tue, 29 Oct 2024 18:41:02 +0000 (+0100)
Subject: APPS/pkeyutl: strengthen error message on too long sign/verify input
X-Git-Tag: openssl-3.5.0-alpha1~946
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1ee906143c0b0ebb6bcbeb87277833a665e79836;p=thirdparty%2Fopenssl.git

APPS/pkeyutl: strengthen error message on too long sign/verify input

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
---

diff --git a/apps/pkeyutl.c b/apps/pkeyutl.c
index 30a4259fe46..ca2575bc179 100644
--- a/apps/pkeyutl.c
+++ b/apps/pkeyutl.c
@@ -490,12 +490,14 @@ int pkeyutl_main(int argc, char **argv)
 
     /* Sanity check the input if the input is not raw */
     if (!rawin
-            && buf_inlen > EVP_MAX_MD_SIZE
-            && (pkey_op == EVP_PKEY_OP_SIGN
-                || pkey_op == EVP_PKEY_OP_VERIFY)) {
-        BIO_printf(bio_err,
-                   "Error: The input data looks too long to be a hash\n");
-        goto end;
+        && (pkey_op == EVP_PKEY_OP_SIGN || pkey_op == EVP_PKEY_OP_VERIFY
+            || pkey_op == EVP_PKEY_OP_VERIFYRECOVER)) {
+        if (buf_inlen > EVP_MAX_MD_SIZE) {
+            BIO_printf(bio_err,
+                       "Error: The non-raw input data length %d is too long - max supported hashed size is %d\n",
+                       buf_inlen, EVP_MAX_MD_SIZE);
+            goto end;
+        }
     }
 
     if (pkey_op == EVP_PKEY_OP_VERIFY) {