2522. [security] Handle -1 from DSA_do_verify().

diff --git a/CHANGES b/CHANGES
index 6cc1fd2920fffec3ad9217643ff53eedf44e5fa8..124d232c7a12e1528460aa14b25d2852cc287b0d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+       --- 9.5.1-P1 released ---
+
+2522.  [security]      Handle -1 from DSA_do_verify().
 
        --- 9.5.1 released ---
 

diff --git a/lib/dns/api b/lib/dns/api
index dae232e124d6241bf482bc3cc94d7665b63325c9..c8e6ef167130a6d94ae0a8a620624c5def074b26 100644 (file)
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 45
-LIBREVISION = 3
+LIBREVISION = 4
 LIBAGE = 0

diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
index 1d971f1d8c890e9a1e6c9433945830ec60ddc0c9..6999458b7577b1a8fbff7c7ace480d084343ab03 100644 (file)
--- a/lib/dns/openssldsa_link.c
+++ b/lib/dns/openssldsa_link.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: openssldsa_link.c,v 1.11 2007/08/28 07:20:42 tbox Exp $ */
+/* $Id: openssldsa_link.c,v 1.11.178.1 2008/12/24 00:20:59 marka Exp $ */
 
 #ifdef OPENSSL
 
@@ -146,7 +146,7 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 
        status = DSA_do_verify(digest, ISC_SHA1_DIGESTLENGTH, dsasig, dsa);
        DSA_SIG_free(dsasig);
-       if (status == 0)
+       if (status != 1)
                return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
        return (ISC_R_SUCCESS);

diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index fa426b38b47e07ccb4a9a3550af1f6ea4fa1ce2a..53f593cf492b947ebd444f56c9219e82c8be2900 100644 (file)
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: opensslrsa_link.c,v 1.16 2007/06/19 23:47:16 tbox Exp $
+ * $Id: opensslrsa_link.c,v 1.16.214.1 2008/12/24 00:20:59 marka Exp $
  */
 #ifdef OPENSSL
 
@@ -247,7 +247,7 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 
        status = RSA_verify(type, digest, digestlen, sig->base,
                            RSA_size(rsa), rsa);
-       if (status == 0)
+       if (status != 1)
                return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
        return (ISC_R_SUCCESS);

diff --git a/version b/version
index 46a729c4b1ea84b8221d71ca7f547472063db4a2..6b0f11c07826ded02f5293ea90163f8cb4e37bdd 100644 (file)
--- a/version
+++ b/version
@@ -1,4 +1,4 @@
-# $Id: version,v 1.39.18.9.2.2 2008/12/21 23:47:31 marka Exp $
+# $Id: version,v 1.39.18.9.2.3 2008/12/24 00:20:59 marka Exp $
 # 
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
@@ -6,5 +6,5 @@
 MAJORVER=9
 MINORVER=5
 PATCHVER=1
-RELEASETYPE=
-RELEASEVER=
+RELEASETYPE=-P
+RELEASEVER=1