From a22f81f2bb430b603e1136b84175aaba6b4baa78 Mon Sep 17 00:00:00 2001 From: ashutoshharry Date: Tue, 9 Jun 2026 15:02:50 -0400 Subject: [PATCH 1/2] RDKB-65466 : secvuln for EVP_verifyfinal secvuln for EVP_verifyfinal --- source/jst_functions.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source/jst_functions.c b/source/jst_functions.c index 8790e1e..04751fd 100644 --- a/source/jst_functions.c +++ b/source/jst_functions.c @@ -578,14 +578,14 @@ static duk_ret_t do_openssl_verify_with_cert(duk_context *ctx) if(EVP_VerifyUpdate (md_ctx, token, strlen(token))) { err = EVP_VerifyFinal(md_ctx, (unsigned char *)sig2verify, (unsigned int)strlen(sig2verify), key); - if(err < 0) + if(err == 1) { - CosaPhpExtLog("openssl_verify_with_cert: EVP_VerifyFinal failed error:%d\n", err); + ok = 1; + CosaPhpExtLog("openssl_verify_with_cert: EVP_VerifyFinal success\n"); } else { - ok = 1; - CosaPhpExtLog("openssl_verify_with_cert: EVP_VerifyFinal success\n"); + CosaPhpExtLog("openssl_verify_with_cert: EVP_VerifyFinal failed error:%d\n", err); } } else From 3e49b6e8994a6fc35c11ae32faa5ece1fa4b4250 Mon Sep 17 00:00:00 2001 From: ashutoshharry Date: Wed, 10 Jun 2026 15:00:16 -0400 Subject: [PATCH 2/2] Update jst_functions.c --- source/jst_functions.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/source/jst_functions.c b/source/jst_functions.c index 04751fd..a2b41e9 100644 --- a/source/jst_functions.c +++ b/source/jst_functions.c @@ -500,7 +500,8 @@ static duk_ret_t do_openssl_verify_with_cert(duk_context *ctx) char* token; char* sig2verify; char* alg; - + duk_size_t sig2verify_len =0; + BIO* bio = NULL; X509* cert = NULL; EVP_PKEY * key = NULL; @@ -517,6 +518,11 @@ static duk_ret_t do_openssl_verify_with_cert(duk_context *ctx) RETURN_FALSE; } + /* Use duk_get_lstring to get the true binary length of the signature. + * strlen() would truncate at the first null byte, which is almost always + * present in a raw RSA signature, causing EVP_VerifyFinal to fail. */ + sig2verify = duk_get_lstring(ctx, 2, &sig2verify_len); + //open certificate file if(memcmp(filepath, "file://", sizeof("file://")-1) != 0) { @@ -573,11 +579,12 @@ static duk_ret_t do_openssl_verify_with_cert(duk_context *ctx) RETURN_FALSE; } + if(EVP_VerifyInit (md_ctx, mdtype)) { if(EVP_VerifyUpdate (md_ctx, token, strlen(token))) { - err = EVP_VerifyFinal(md_ctx, (unsigned char *)sig2verify, (unsigned int)strlen(sig2verify), key); + err = EVP_VerifyFinal(md_ctx, (unsigned char *)sig2verify, (unsigned int)sig2verify_len, key); if(err == 1) { ok = 1;