CVSROOT: /cvs
Module name: src
Changes by: j...@cvs.openbsd.org 2023/04/30 10:46:49
Modified files:
lib/libcrypto/asn1: tasn_dec.c tasn_enc.c
Log message:
Revert disablement of the encoding cache
Without the cache, we verify CRL signatures on bytes that have been
pulled through d2i_ -> i2d_, this can cause reordering, which in turn
invalidates the signature. for example if in the original CRL revocation
entries were sorted by date instead of ascending serial number order.
There are probably multiple things we can do here, but they will need
careful consideration and planning.
OK jsing@
