From 156a6ca5791f9c642a77270a90d5dbd0a3a7a33d Mon Sep 17 00:00:00 2001
From: Hubert Kario <hkario@redhat.com>
Date: Tue, 22 Nov 2022 18:25:49 +0100
Subject: [PATCH] smime/pkcs7: disable the Bleichenbacher workaround

CVE: CVE-2023-50781

Upstream-Status: Backport
[https://github.com/openssl/openssl/commit/056dade341d2589975a3aae71f81c8d7061583c7]

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13817)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>

---
 crypto/pkcs7/pk7_doit.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index a38e8a3..d751f5e 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -168,6 +168,13 @@ static int pkcs7_decrypt_rinfo(unsigned char **pek, int *peklen,
     if (EVP_PKEY_decrypt_init(pctx) <= 0)
         goto err;
 
+    if (EVP_PKEY_is_a(pkey, "RSA"))
+        /* upper layer pkcs7 code incorrectly assumes that a successful RSA
+         * decryption means that the key matches ciphertext (which never
+         * was the case, implicit rejection or not), so to make it work
+         * disable implicit rejection for RSA keys */
+        EVP_PKEY_CTX_ctrl_str(pctx, "rsa_pkcs1_implicit_rejection", "0");
+
     if (EVP_PKEY_decrypt(pctx, NULL, &eklen,
             ri->enc_key->data, ri->enc_key->length)
         <= 0)
