From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Fri, 29 Aug 2014 15:47:22 +0000 (+0200)
Subject: additional sanity check in RSA key generation testing in FIPS-140-2 mode
X-Git-Tag: gnutls_3_4_0~1010
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6baff0d0d64d31da8b52f0b0a6856d09d8583f75;p=thirdparty%2Fgnutls.git

additional sanity check in RSA key generation testing in FIPS-140-2 mode

The encrypted data are checked to differ from the plaintext, to prevent
any issues with an accidental null encryption.
---

diff --git a/lib/x509/privkey.c b/lib/x509/privkey.c
index 1fbcccba62..f5855ab638 100644
--- a/lib/x509/privkey.c
+++ b/lib/x509/privkey.c
@@ -1327,12 +1327,19 @@ char* gen_data = NULL;
 			goto cleanup;
 		}
 
+		if (ddata.size == sig.size && memcmp(ddata.data, sig.data, sig.size) == 0) {
+			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
+			gnutls_assert();
+			goto cleanup;
+		}
+
 		ret = _gnutls_pk_decrypt(algo, &tmp, &sig, params);
 		if (ret < 0) {
 			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
 			gnutls_assert();
 			goto cleanup;
 		}
+
 		if (tmp.size != ddata.size || memcmp(tmp.data, ddata.data, tmp.size) != 0) {
 			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
 			gnutls_assert();