integrate -P1 patch

diff --git a/CHANGES b/CHANGES
index 97b88eb614062ebce63fabf4b7d4194b923c636d..3ea021170364dccc0ad030d79c3baf24c11f7adf 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,8 @@
 2523.  [bug]           Random type rdata freed by dns_nsec_typepresent().
                        [RT #19112]
 
+2522.  [security]      Handle -1 from DSA_do_verify().
+
 2521.  [bug]           Improve epoll cross compilation support. [RT #19047]
 
 2519.  [bug]           dig/host with -4 or -6 didn't work if more than two

diff --git a/lib/dns/api b/lib/dns/api
index 7949ab0bbf8ab43bf9d914eaa20fa704b2f4bd86..0b8a3bc5beea405580cb859f1c7ac6b97d28cb8c 100644 (file)
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 36
-LIBREVISION = 1
+LIBREVISION = 2
 LIBAGE = 0

diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
index d2b08337733810f51e6feb7634333178c82c1a56..32cb1df4ea9441e105d266c44e39d927fea6aa53 100644 (file)
--- a/lib/dns/openssldsa_link.c
+++ b/lib/dns/openssldsa_link.c
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: openssldsa_link.c,v 1.1.6.9 2007/08/28 07:20:04 tbox Exp $ */
+/* $Id: openssldsa_link.c,v 1.1.6.10 2009/01/14 17:47:07 fdupont Exp $ */
 
 #ifdef OPENSSL
 
@@ -133,7 +133,7 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 
        status = DSA_do_verify(digest, ISC_SHA1_DIGESTLENGTH, dsasig, dsa);
        DSA_SIG_free(dsasig);
-       if (status == 0)
+       if (status != 1)
                return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
        return (ISC_R_SUCCESS);

diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index 2609df6e70675d29410a3160e244ee3f72a626e9..62ef5cb81632405129d713cdb13c750943096be5 100644 (file)
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: opensslrsa_link.c,v 1.1.6.11 2006/11/07 21:28:49 marka Exp $
+ * $Id: opensslrsa_link.c,v 1.1.6.12 2009/01/14 17:47:07 fdupont Exp $
  */
 #ifdef OPENSSL
 
@@ -246,7 +246,7 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 
        status = RSA_verify(type, digest, digestlen, sig->base,
                            RSA_size(rsa), rsa);
-       if (status == 0)
+       if (status != 1)
                return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
        return (ISC_R_SUCCESS);