From ff9b3b0873b594cd151a46e93fb933450990dc74 Mon Sep 17 00:00:00 2001 From: Jim Date: Sat, 1 Apr 2023 11:51:43 -0400 Subject: [PATCH] fix(bsr/kms): VerifySignatureWithBsrKey: handle invalid signature --- internal/bsr/kms/keys.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/internal/bsr/kms/keys.go b/internal/bsr/kms/keys.go index 50a52a4fb..5b483250e 100644 --- a/internal/bsr/kms/keys.go +++ b/internal/bsr/kms/keys.go @@ -405,6 +405,12 @@ func (k *Keys) VerifySignatureWithBsrKey(ctx context.Context, sig *wrapping.SigI return false, fmt.Errorf("%s: missing wrapped bsr key bytes: %w", op, ErrInvalidParameter) case len(msg) == 0: return false, fmt.Errorf("%s: missing msg: %w", op, ErrInvalidParameter) + case sig == nil: + return false, fmt.Errorf("%s: missing signature: %w", op, ErrInvalidParameter) + case sig.KeyInfo == nil: + return false, fmt.Errorf("%s: missing signature key info: %w", op, ErrInvalidParameter) + case len(sig.Signature) == 0: + return false, fmt.Errorf("%s: signature is empty: %w", op, ErrInvalidParameter) } opts := getOpts(opt...)