X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fsrc%2Fpdkim%2Fsigning.c;h=d78f31acf290a600aaa42bdc3f323fa1e69a45bc;hb=6b331d5834d12bdda21857cd6fffac17038ce3c7;hp=b55bd9f5f5c70373463fee4fd2a706205997386c;hpb=a841a6eca79ff08b36f2225dcf89c1c162bb8777;p=user%2Fhenk%2Fcode%2Fexim.git

diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c
index b55bd9f5f..d78f31acf 100644
--- a/src/src/pdkim/signing.c
+++ b/src/src/pdkim/signing.c
@@ -1,7 +1,6 @@
 /*
  *  PDKIM - a RFC4871 (DKIM) implementation
- *
- *  Copyright (C) 1995 - 2018  Exim maintainers
+ *  Copyright (c) The Exim Maintainers 1995 - 2022
  *
  *  signing/verification interface
  */
@@ -37,6 +36,10 @@ features_crypto(void)
 #ifdef SIGN_GNUTLS
 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL 3
 
+# ifndef GNUTLS_VERIFY_ALLOW_BROKEN
+#  define GNUTLS_VERIFY_ALLOW_BROKEN 0
+# endif
+
 
 /* Logging function which can be registered with
  *   gnutls_global_set_log_function()
@@ -219,7 +222,8 @@ else
     default:		return US"nonhandled hash type";
     }
 
-  if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->key, algo, 0, &k, &s)) < 0)
+  if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->key, algo,
+	      GNUTLS_VERIFY_ALLOW_BROKEN, &k, &s)) < 0)
     ret = US gnutls_strerror(rc);
   }
 
@@ -502,7 +506,7 @@ switch (hash)
   }
 
 #define SIGSPACE 128
-sig->data = store_get(SIGSPACE, FALSE);
+sig->data = store_get(SIGSPACE, GET_UNTAINTED);
 
 if (gcry_mpi_cmp (sign_ctx->p, sign_ctx->q) > 0)
   {
@@ -761,7 +765,7 @@ switch (hash)
 if (  (ctx = EVP_MD_CTX_new())
    && EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
    && EVP_DigestSign(ctx, NULL, &siglen, NULL, 0) > 0
-   && (sig->data = store_get(siglen, FALSE))
+   && (sig->data = store_get(siglen, GET_UNTAINTED))
 
    /* Obtain the signature (slen could change here!) */
    && EVP_DigestSign(ctx, sig->data, &siglen, data->data, data->len) > 0
@@ -777,7 +781,7 @@ if (  (ctx = EVP_MD_CTX_create())
    && EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
    && EVP_DigestSignUpdate(ctx, data->data, data->len) > 0
    && EVP_DigestSignFinal(ctx, NULL, &siglen) > 0
-   && (sig->data = store_get(siglen, FALSE))
+   && (sig->data = store_get(siglen, GET_UNTAINTED))
  
    /* Obtain the signature (slen could change here!) */
    && EVP_DigestSignFinal(ctx, sig->data, &siglen) > 0