From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sun, 26 Aug 2012 18:04:47 +0000 (+0200)
Subject: Use _gnutls_dsa_q_to_hash() only for warning reasons.
X-Git-Tag: gnutls_3_1_1~22
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8bb82a3d386abc1c59cb16d3a6d8c68fb66a2170;p=thirdparty%2Fgnutls.git

Use _gnutls_dsa_q_to_hash() only for warning reasons.
---

diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
index 41a0fb1af1..126374b169 100644
--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
@@ -481,10 +481,15 @@ _wrap_nettle_pk_verify (gnutls_pk_algorithm_t algo,
         memcpy (&sig.s, tmp[1], sizeof (sig.s));
 
         _gnutls_dsa_q_to_hash (algo, pk_params, &hash_len);
+
         if (hash_len > vdata->size)
-          hash_len = vdata->size;
+          {
+            gnutls_assert ();
+            _gnutls_debug_log("Security level of algorithm requires a hash of %d bytes or better (have %d)\n", hash_len, (int)vdata->size);
+            hash_len = vdata->size;
+          }
 
-        ret = ecc_verify_hash(&sig, vdata->data, hash_len, &stat, &pub);
+        ret = ecc_verify_hash(&sig, vdata->data, vdata->size, &stat, &pub);
         if (ret != 0 || stat != 1)
           {
             gnutls_assert();
@@ -516,9 +521,13 @@ _wrap_nettle_pk_verify (gnutls_pk_algorithm_t algo,
 
         _gnutls_dsa_q_to_hash (algo, pk_params, &hash_len);
         if (hash_len > vdata->size)
-          hash_len = vdata->size;
+          {
+            gnutls_assert ();
+            _gnutls_debug_log("Security level of algorithm requires a hash of %d bytes or better (have %d)\n", hash_len, (int)vdata->size);
+            hash_len = vdata->size;
+          }
 
-        ret = _dsa_verify (&pub, hash_len, vdata->data, &sig);
+        ret = _dsa_verify (&pub, vdata->size, vdata->data, &sig);
         if (ret == 0)
           {
             gnutls_assert();