integrate -P1 patch

diff --git a/CHANGES b/CHANGES
index 317fe691368f4c182f0a1316622c5af60e8b0460..996b67dc5dff2e28b2d7ed23e1a6d85f209a00ac 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -17,7 +17,7 @@
 2523.  [bug]           Random type rdata freed by dns_nsec_typepresent().
                        [RT #19112]
 
-2522.  [placeholder]
+2522.  [security]      Handle -1 from DSA_do_verify() and EVP_VerifyFinal().
 
 2521.  [bug]           Improve epoll cross compilation support. [RT #19047]
 

diff --git a/lib/dns/api b/lib/dns/api
index 2240cdda3ac87220175e1fbb24317bd18955c804..fbbf923b5324c0681c4e314920c6f226b0344687 100644 (file)
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 50
-LIBREVISION = 1
+LIBREVISION = 3
 LIBAGE = 0

diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
index f4eb1125d9f92537217cd357db5bee7f7cc51149..e628bec60bd914ae79a95c2c99acc719209f73c4 100644 (file)
--- a/lib/dns/openssldsa_link.c
+++ b/lib/dns/openssldsa_link.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: openssldsa_link.c,v 1.13 2008/04/01 23:47:10 tbox Exp $ */
+/* $Id: openssldsa_link.c,v 1.14 2009/01/14 17:28:47 fdupont Exp $ */
 
 #ifdef OPENSSL
 #ifndef USE_EVP
@@ -277,7 +277,7 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
        status = DSA_do_verify(digest, ISC_SHA1_DIGESTLENGTH, dsasig, dsa);
 #endif
        DSA_SIG_free(dsasig);
-       if (status == 0)
+       if (status != 1)
                return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
        return (ISC_R_SUCCESS);

diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index aee7d21aea6cf204df050038d1263d4abfe92239..2812f7a5bd50ca4f680a07ab16143ab773249c93 100644 (file)
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: opensslrsa_link.c,v 1.20 2008/09/24 02:46:22 marka Exp $
+ * $Id: opensslrsa_link.c,v 1.21 2009/01/14 17:28:47 fdupont Exp $
  */
 #ifdef OPENSSL
 #ifndef USE_EVP
@@ -325,7 +325,7 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
        status = RSA_verify(type, digest, digestlen, sig->base,
                            RSA_size(rsa), rsa);
 #endif
-       if (status == 0)
+       if (status != 1)
                return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
        return (ISC_R_SUCCESS);