tree 6309e5fa34f7626989fcddf188847c1e80da5072
parent 91c61bc4fd815f689b499f849b3baf828c0f8490
author Paul Bakker <p.j.bakker@polarssl.org> 1395842027 +0100
committer Paul Bakker <p.j.bakker@polarssl.org> 1395843261 +0100

Add a check for buffer overflow to pkcs11_sign()

pkcs11_sign() reuses *sig to store the header and hash, but those might
be larger than the actual sig, causing a buffer overflow.

An overflow can occur when using raw sigs with hashlen > siglen, or when
the RSA key is less than 664 bits long (or less when using hashes
shorter than SHA512)

As siglen is always within the 'low realm' < 32k, an overflow of asnlen
+ hashlen is not possible.