Permit empty parameters field too, found after adding self tests.

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 853d4ade413e025fe7b2f5ab639e06ad16756897..b8080333bab5167e8a3eed6a791c13435cdf6a46 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -507,11 +507,15 @@ decode_ber_digest_info (const gnutls_datum_t * info,
 
   len = sizeof (str) - 1;
   result = asn1_read_value (dinfo, "digestAlgorithm.parameters", str, &len);
-  if (result != ASN1_ELEMENT_NOT_FOUND)
+  /* To avoid permitting garbage in the parameters field, either the
+     parameters field is not present, or it contains 0x05 0x00. */
+  if (!(result == ASN1_ELEMENT_NOT_FOUND ||
+       (result == ASN1_SUCCESS && len == 2 &&
+        str[0] == 0x05 && str[1] == 0x00)))
     {
       gnutls_assert ();
       asn1_delete_structure (&dinfo);
-      return _gnutls_asn2err (result);
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
     }
 
   result = asn1_read_value (dinfo, "digest", digest, digest_size);