RSA PKCS1v1.5 verification: check padding length
The test case was generated by modifying our signature code so that it
produces a 7-byte long padding (which also means garbage at the end, so it is
essential to check that the error that is detected first is indeed the
padding rather than the final length check).
diff --git a/library/rsa.c b/library/rsa.c
index 79726c1..9a4134c 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -1376,7 +1376,11 @@
return( POLARSSL_ERR_RSA_INVALID_PADDING );
p++;
}
- p++;
+ p++; /* skip 00 byte */
+
+ /* We've read: 00 01 PS 00 where PS must be at least 8 bytes */
+ if( p - buf < 11 )
+ return( POLARSSL_ERR_RSA_INVALID_PADDING );
len = siglen - ( p - buf );