From 5006e178ba46dbb977c9e7363b770bc758782d4b Mon Sep 17 00:00:00 2001 From: Jack Lloyd Date: Sat, 17 Dec 2016 22:35:08 -0500 Subject: Disable TLS signature and finished message checks in fuzzer mode Also use a const time comparison for the finished message, though I don't see any real way of exploiting that timing channel. --- src/lib/tls/msg_cert_verify.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'src/lib/tls/msg_cert_verify.cpp') diff --git a/src/lib/tls/msg_cert_verify.cpp b/src/lib/tls/msg_cert_verify.cpp index ac8fa97fd..2f8e8230e 100644 --- a/src/lib/tls/msg_cert_verify.cpp +++ b/src/lib/tls/msg_cert_verify.cpp @@ -90,7 +90,14 @@ bool Certificate_Verify::verify(const X509_Certificate& cert, PK_Verifier verifier(*key, format.first, format.second); - return verifier.verify_message(state.hash().get_contents(), m_signature); + const bool signature_valid = + verifier.verify_message(state.hash().get_contents(), m_signature); + +#if defined(BOTAN_UNSAFE_FUZZER_MODE) + return true; +#else + return signature_valid; +#endif } } -- cgit v1.2.3