From a63b5a361f25459a9c6a2e2027a50a5ea2b3e23b Mon Sep 17 00:00:00 2001 From: Aleksey Sanin Date: Thu, 1 Oct 2026 19:45:43 -0400 Subject: [PATCH 1/2] Fixed typos / errors in comments, docs, error messages --- docs/bugs.html | 4 +-- docs/faq.html | 4 +-- docs/index.html | 6 +++- docs/mailing-list.html | 5 +-- docs/news.html | 4 +++ docs/xmldsig.html | 57 +++++++++++++++++++++++++++------ docs/xmlenc.html | 2 +- docs/xmlsec-man.html | 26 +++++++++++++-- include/xmlsec/app.h | 2 +- include/xmlsec/errors.h | 9 +++++- include/xmlsec/keys.h | 4 +-- include/xmlsec/keysmngr.h | 10 +++--- include/xmlsec/openssl/crypto.h | 4 +-- man/xmlsec1.1 | 5 +++ src/keyinfo.c | 22 ++++++------- src/mscng/app.c | 3 +- src/mscng/x509.c | 2 +- src/mscrypto/ciphers.c | 2 +- src/mscrypto/keysstore.c | 17 +++++++--- src/mscrypto/kw_des.c | 6 ++-- src/nss/signatures.c | 8 +++-- 21 files changed, 148 insertions(+), 54 deletions(-) diff --git a/docs/bugs.html b/docs/bugs.html index 0b8672305..4285d9700 100644 --- a/docs/bugs.html +++ b/docs/bugs.html @@ -52,7 +52,7 @@

Before writing bug reports or questions do not hesitate to check FAQ. If you are writing your own code based on the XMLSec library then you should try to reproduce your problem with xmlsec command -line utiliy first. And if it works just fine then you know whom to blame, +line utility first. And if it works just fine then you know whom to blame, don't you? :)

@@ -84,7 +84,7 @@
Ask google
-Unfortunatelly, I don't know the author of this picture and I was not +Unfortunately, I don't know the author of this picture and I was not able to ask permissions to publish it. If you are the author or know the author then I would appreciate if you send me a message on GitHub so I can ask permissions and put author's name here. diff --git a/docs/faq.html b/docs/faq.html index 00486c2ad..aa2541779 100644 --- a/docs/faq.html +++ b/docs/faq.html @@ -48,7 +48,7 @@

Frequently Asked Questions

0. Where can I read more about XML Signature and XML Encryption?

-

First of all, read the original specifications: XML Digital Signature and XML Encrytpion. Also there several books available that can +

First of all, read the original specifications: XML Digital Signature and XML Encryption. Also there several books available that can help you get started.

1. License(s).

1.1. Licensing Terms for @@ -390,7 +390,7 @@

|= XMLSEC_DSIG_FLAGS_USE_VISA3D_HACK or --enable-visa3d-hack option for xmlsec command line utility). -This is a hack. You are warned!

UPDATE: It appears that recent version (Novemeber, 2005) +This is a hack. You are warned!

UPDATE: It appears that recent version (November, 2005) of Visa3D DTD does have this problem corrected and now "id" attribute is declared as ID. Just get the new DTD and everything should work without this hack.

diff --git a/docs/index.html b/docs/index.html index bb1aa820e..b0a5f9118 100644 --- a/docs/index.html +++ b/docs/index.html @@ -85,6 +85,10 @@

XML Security Library

  • (xmlsec-core) Hardened XML parser defaults for XXE mitigation across libxml2 versions.
  • (xmlsec-core) Added stronger overflow and conversion safety checks.
  • (xmlsec-core) Fixed multiple memory/resource issues on error paths.
    • +
  • (xmlsec-core) Enforced the max nesting depth when processing EncryptedKey elements (default is 1); + documents with deeper nested EncryptedKey structures will now fail to decrypt. Use the + `--max-encrypted-key-level <level>` option in the xmlsec command line tool (or set + `xmlSecKeyInfoCtx->maxEncryptedKeyLevel` in your application code) to adjust the limit.
  • (xmlsec-openssl) Improved X.509/CRL verification flow with verification-time-aware revocation checks and stricter CRL validity handling.
  • (xmlsec-gnutls) Prevented certificate-chain self-loop cases and improved SKI comparison behavior when SKI extension is absent.
  • (xmlsec-nss) Fixed certificate lookup memory handling in issuer/serial resolution paths.
    • @@ -118,7 +122,7 @@

    XML Security Library

  • July 11 2024
    - The legacy a href="download.html">XML Security Library 1.2.40 release includes the following changes: + The legacy XML Security Library 1.2.40 release includes the following changes:
    • (xmlsec-core) Fixed functions deprecated in LibXML2 2.13.1 (including disabling HTTP support by default).
    • (xmlsec-nss) Increased keys size in all tests to support NSS 3.101.
      • diff --git a/docs/mailing-list.html b/docs/mailing-list.html index 809918cfe..9e4e6bc15 100644 --- a/docs/mailing-list.html +++ b/docs/mailing-list.html @@ -2,7 +2,7 @@ -XML Security Library: Related +XML Security Library: Mailing List @@ -52,5 +52,6 @@

      XMLSec Mailing list is retired as of October, 2022

      The read-only XMLSec mailing list archive will continue to be available.

      - +
      + diff --git a/docs/news.html b/docs/news.html index 2380f2f0a..6c8b0563e 100644 --- a/docs/news.html +++ b/docs/news.html @@ -57,6 +57,10 @@

      XML Security Library News

    • (xmlsec-core) Hardened XML parser defaults for XXE mitigation across libxml2 versions.
    • (xmlsec-core) Added stronger overflow and conversion safety checks.
    • (xmlsec-core) Fixed multiple memory/resource issues on error paths.
      • +
    • (xmlsec-core) Enforced the max nesting depth when processing EncryptedKey elements (default is 1); + documents with deeper nested EncryptedKey structures will now fail to decrypt. Use the + `--max-encrypted-key-level <level>` option in the xmlsec command line tool (or set + `xmlSecKeyInfoCtx->maxEncryptedKeyLevel` in your application code) to adjust the limit.
    • (xmlsec-openssl) Improved X.509/CRL verification flow with verification-time-aware revocation checks and stricter CRL validity handling.
    • (xmlsec-gnutls) Prevented certificate-chain self-loop cases and improved SKI comparison behavior when SKI extension is absent.
    • (xmlsec-nss) Fixed certificate lookup memory handling in issuer/serial resolution paths.
      • diff --git a/docs/xmldsig.html b/docs/xmldsig.html index 917266a52..842ad7d8f 100644 --- a/docs/xmldsig.html +++ b/docs/xmldsig.html @@ -285,7 +285,7 @@

      XML Digital Signature 1.0 ( -Exlusive Canonical XML 1.0 +Exclusive Canonical XML 1.0 Y Y @@ -341,7 +341,7 @@

      XML Digital Signature 1.0 (Y N N - N + Y N N @@ -386,7 +386,7 @@

      XML Digital Signature 1.0 (Y N N - N + Y N N @@ -440,7 +440,7 @@

      XML Digital Signature 1.0 (Y N N - N + Y N N @@ -494,7 +494,7 @@

      XML Digital Signature 1.0 (Y N N - N + Y N Y @@ -675,27 +675,66 @@

      Other algorithms

      GOST94 digests + Y      (3) N N N - N - Y(2) + Y(2) N GOST2001 signatures + Y(3) + N + N + N + Y(2) + N + + +GOST-2012 (256 bit) digests + Y(3) + N N N + Y(2) + N + + +GOST-2012 (512 bit) digests + Y(3) + N + N + N + Y(2) + N + + +GOST-2012 (256 bit) signatures + Y(3) + N + N + N + Y(2) + N + + +GOST-2012 (512 bit) signatures + Y(3) + N N N - Y(2) + Y(2) N

      (1) Defining DSA key with Seed and PgenCounter is not supported.
      (2) Requires install of a CSP -providing these algorithms.

      Test vectors (from IETF/W3C +providing these algorithms. +
      (3) Requires install of a GOST-capable OpenSSL +engine and the corresponding build options to be enabled +(--enable-gost for GOST94/2001 and --enable-gost2012 for GOST-2012).

      Test vectors (from IETF/W3C XML Signature WG: XML Signature Interoperability page):
      merlin-xmldsig-twenty-three.tar.gz
      merlin-xmldsig-sixteen.tar.gz (features, deprecated)
      merlin-xmldsig-fifteen.tar.gz diff --git a/docs/xmlenc.html b/docs/xmlenc.html index 9c4b08d63..fdfd0fde1 100644 --- a/docs/xmlenc.html +++ b/docs/xmlenc.html @@ -427,7 +427,7 @@

      XML Encryption 1.0 (Y -Exlusive Canonical XML 1.0 +Exclusive Canonical XML 1.0 Y Y Y diff --git a/docs/xmlsec-man.html b/docs/xmlsec-man.html index 8bd3cb901..d88d1e2c8 100644 --- a/docs/xmlsec-man.html +++ b/docs/xmlsec-man.html @@ -58,6 +58,14 @@

      XMLSEC1

      display help information for command <cmd> and exit
      --version
      print version information and exit
      +
      --list-key-data
      +
      prints the list of known key data klasses
      +
      --check-key-data <key-data-name> [<key-data-name> ...]
      +
      checks the given key-data against the list of known key-data klasses
      +
      --list-transforms
      +
      prints the list of known transform klasses
      +
      --check-transforms <transform-name> [<transform-name> ...]
      +
      checks the given transforms against the list of known transform klasses
      --keys
      keys XML file manipulation
      --sign
      @@ -70,6 +78,8 @@

      XMLSEC1

      encrypt data and output XML document
      --decrypt
      decrypt data from XML document
      +
      --encrypt-tmpl
      +
      creates a simple dynamic template and calculates XML Encryption (for testing only)

      OPTIONS

      --ignore-manifests
      @@ -140,6 +150,10 @@

      XMLSEC1

      adds attributes <attr-name> (default value "id") from all nodes with<node-name> and namespace <node-namespace-uri> to the list of known ID attributes; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "--dtd-file" option), I don't know what else might be broken in your application when you use this hack
      +
      --max-encrypted-key-level <level>
      + +
      sets the max depth level when processing encrypted keys, key agreements, etc. to <level>; default is 1
      +
      --enabled-key-data <list>
      comma separated list of enabled key data (list of registered key data klasses is available with "--list-key-data" command); by default, all registered key data are enabled
      @@ -166,11 +180,11 @@

      XMLSEC1

      --pkcs8-pem[:<name>] <file>[,<cafile>[,<cafile>[...]]]
      -
      load private key from PKCS8 PEM file and PEM certificates that verify this key
      +
      load private key from PKCS8 PEM file and PEM certificates that verify this key (alias: --privkey-p8-pem)
      --pkcs8-der[:<name>] <file>[,<cafile>[,<cafile>[...]]]
      -
      load private key from PKCS8 DER file and DER certificates that verify this key
      +
      load private key from PKCS8 DER file and DER certificates that verify this key (alias: --privkey-p8-der)
      --pubkey-pem[:<name>] <file>
      @@ -232,6 +246,10 @@

      XMLSEC1

      the local time in "YYYY-MM-DD HH:MM:SS" format used certificates verification
      +
      --verification-gmt-time <time>
      + +
      the GMT time in "YYYY-MM-DD HH:MM:SS" format used certificates verification
      +
      --depth <number>
      maximum certificates chain depth
      @@ -244,6 +262,10 @@

      XMLSEC1

      do not verify certificates
      +
      --privkey-openssl-engine[:<name>] <openssl-engine>;<openssl-key-id>[,<crtfile>[,<crtfile>[...]]]
      + +
      load private key by OpenSSL ENGINE interface; specify the name of engine (like with "-engine" params), the key specs (like with "-inkey" or "-key" params) and optionally certificates that verify this key
      +
      --crypto <name>
      the name of the crypto engine to use from the following list: openssl, mscrypto, nss, gnutls, gcrypt (if no crypto engine is specified then the default one is used)
      diff --git a/include/xmlsec/app.h b/include/xmlsec/app.h index 475661e7c..98cbdcab7 100644 --- a/include/xmlsec/app.h +++ b/include/xmlsec/app.h @@ -415,7 +415,7 @@ XMLSEC_EXPORT xmlSecTransformId xmlSecTransformRsaPkcs1GetKlass /** * xmlSecTransformRsaOaepId: * - * The RSA PKCS1 key transport transform klass. + * The RSA-OAEP key transport transform klass. */ #define xmlSecTransformRsaOaepId xmlSecTransformRsaOaepGetKlass() XMLSEC_EXPORT xmlSecTransformId xmlSecTransformRsaOaepGetKlass (void); diff --git a/include/xmlsec/errors.h b/include/xmlsec/errors.h index 83e1d4dfd..4210e253a 100644 --- a/include/xmlsec/errors.h +++ b/include/xmlsec/errors.h @@ -380,7 +380,14 @@ extern "C" { * * Impossible to cast from one type to another. */ -#define XMLSEC_ERROR_R_CAST_IMPOSSIBLE 101 +#define XMLSEC_ERRORS_R_CAST_IMPOSSIBLE 101 + +/** + * XMLSEC_ERROR_R_CAST_IMPOSSIBLE: + * + * DEPRECATED. Use #XMLSEC_ERRORS_R_CAST_IMPOSSIBLE instead. + */ +#define XMLSEC_ERROR_R_CAST_IMPOSSIBLE XMLSEC_ERRORS_R_CAST_IMPOSSIBLE /** * XMLSEC_ERRORS_MAX_NUMBER: diff --git a/include/xmlsec/keys.h b/include/xmlsec/keys.h index 097585323..f816ee70a 100644 --- a/include/xmlsec/keys.h +++ b/include/xmlsec/keys.h @@ -237,8 +237,8 @@ XMLSEC_EXPORT xmlSecKeyPtr xmlSecKeyReadMemory (xmlSecKeyDataId dataId, * xmlSecKeyIsValid: * @key: the pointer to key. * - * Macro. Returns 1 if @key is not NULL and @key->id is not NULL - * or 0 otherwise. + * Macro. Returns 1 if @key is not NULL, @key->value is not NULL + * and @key->value->id is not NULL or 0 otherwise. */ #define xmlSecKeyIsValid(key) \ ((( key ) != NULL) && \ diff --git a/include/xmlsec/keysmngr.h b/include/xmlsec/keysmngr.h index fcaa95e10..883b2f1c1 100644 --- a/include/xmlsec/keysmngr.h +++ b/include/xmlsec/keysmngr.h @@ -242,13 +242,11 @@ struct _xmlSecKeyStoreKlass { /** - * xmlSecKeyDataDsaWrite: - * @id: the key data data. - * @data: the pointer to input @xmlSecKeyData. - * @dsaValue: the pointer to input @xmlSecKeyValueDsa. - * @writePrivateKey: the flag indicating if private key component should be output or not. + * xmlSecSimpleKeysStoreAdoptKeyFunc: + * @store: the pointer to key store. + * @key: the pointer to key. * - * Writes @xmlSecKeyData to @xmlSecKeyValueDsa. + * Adds @key to the @store. On success, the @store owns the @key. * * Returns: 0 on success or a negative value if an error occurs. */ diff --git a/include/xmlsec/openssl/crypto.h b/include/xmlsec/openssl/crypto.h index a4da083ec..21a0b1fb6 100644 --- a/include/xmlsec/openssl/crypto.h +++ b/include/xmlsec/openssl/crypto.h @@ -471,7 +471,7 @@ XMLSEC_CRYPTO_EXPORT xmlSecTransformId xmlSecOpenSSLTransformGostR3411_94GetKlas *******************************************************************/ /** - * xmlSecOpenSSLKeyDataGostR4310_2012_256Id: + * xmlSecOpenSSLKeyDataGostR3410_2012_256Id: * * The GOST R 34.10-2012 256 key klass. */ @@ -481,7 +481,7 @@ XMLSEC_CRYPTO_EXPORT xmlSecKeyDataId xmlSecOpenSSLKeyDataGostR3410_2012_256Ge /** - * xmlSecOpenSSLKeyDataGostR4310_2012_512Id: + * xmlSecOpenSSLKeyDataGostR3410_2012_512Id: * * The GOST R 34.10-2012 512 key klass. */ diff --git a/man/xmlsec1.1 b/man/xmlsec1.1 index 5a8329f43..7f482a4d3 100644 --- a/man/xmlsec1.1 +++ b/man/xmlsec1.1 @@ -126,6 +126,11 @@ to declare ID attributes instead (see "\-\-dtd\-file" option), I don't know what else might be broken in your application when you use this hack .HP +\fB\-\-max\-encrypted\-key\-level\fR +.IP +sets the max depth level when processing encrypted keys, key agreements, etc. +to ; default is 1 +.HP \fB\-\-enabled\-key\-data\fR .IP comma separated list of enabled key data (list of diff --git a/src/keyinfo.c b/src/keyinfo.c index fcd5d32e4..379b1564f 100644 --- a/src/keyinfo.c +++ b/src/keyinfo.c @@ -542,7 +542,7 @@ xmlSecKeyInfoCtxDebugXmlDump(xmlSecKeyInfoCtxPtr keyInfoCtx, FILE* output) { } fprintf(output, "\n", - keyInfoCtx->curEncryptedKeyLevel, keyInfoCtx->maxEncryptedKeyLevel); + keyInfoCtx->curRetrievalMethodLevel, keyInfoCtx->maxRetrievalMethodLevel); xmlSecTransformCtxDebugXmlDump(&(keyInfoCtx->retrievalMethodCtx), output); #ifndef XMLSEC_NO_XMLENC @@ -1397,15 +1397,13 @@ xmlSecKeyDataEncryptedKeyXmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key, xmlNodeP /* dump key to a binary buffer */ ret = xmlSecKeyInfoCtxInitialize(&keyInfoCtx2, NULL); if(ret < 0) { - xmlSecInternalError("xmlSecKeyInfoCtxInitialize", - xmlSecKeyDataKlassGetName(id)); + xmlSecInternalError("xmlSecKeyInfoCtxInitialize", xmlSecKeyDataKlassGetName(id)); goto done; } ret = xmlSecKeyInfoCtxCopyUserPref(&keyInfoCtx2, keyInfoCtx); if(ret < 0) { - xmlSecInternalError("xmlSecKeyInfoCtxCopyUserPref", - xmlSecKeyDataKlassGetName(id)); + xmlSecInternalError("xmlSecKeyInfoCtxCopyUserPref", xmlSecKeyDataKlassGetName(id)); xmlSecKeyInfoCtxFinalize(&keyInfoCtx2); goto done; } @@ -1413,8 +1411,7 @@ xmlSecKeyDataEncryptedKeyXmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key, xmlNodeP keyInfoCtx2.keyReq.keyType = xmlSecKeyDataTypeAny; ret = xmlSecKeyDataBinWrite(key->value->id, key, &keyBuf, &keySize, &keyInfoCtx2); if(ret < 0) { - xmlSecInternalError("xmlSecKeyDataBinWrite", - xmlSecKeyDataKlassGetName(id)); + xmlSecInternalError("xmlSecKeyDataBinWrite", xmlSecKeyDataKlassGetName(id)); xmlSecKeyInfoCtxFinalize(&keyInfoCtx2); goto done; } @@ -1426,17 +1423,20 @@ xmlSecKeyDataEncryptedKeyXmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key, xmlNodeP } else { ret = xmlSecKeyInfoCtxCreateEncCtx(keyInfoCtx); if(ret < 0) { - xmlSecInternalError("xmlSecKeyInfoCtxCreateEncCtx", - xmlSecKeyDataKlassGetName(id)); + xmlSecInternalError("xmlSecKeyInfoCtxCreateEncCtx", xmlSecKeyDataKlassGetName(id)); goto done; } } xmlSecAssert2(keyInfoCtx->encCtx != NULL, -1); + /* setup current recursion levels for the write context */ + keyInfoCtx->encCtx->keyInfoWriteCtx.curRetrievalMethodLevel = keyInfoCtx->curRetrievalMethodLevel; + keyInfoCtx->encCtx->keyInfoWriteCtx.curEncryptedKeyLevel = keyInfoCtx->curEncryptedKeyLevel + 1; + + /* encrypt */ ret = xmlSecEncCtxBinaryEncrypt(keyInfoCtx->encCtx, node, keyBuf, keySize); if(ret < 0) { - xmlSecInternalError("xmlSecEncCtxBinaryEncrypt", - xmlSecKeyDataKlassGetName(id)); + xmlSecInternalError("xmlSecEncCtxBinaryEncrypt", xmlSecKeyDataKlassGetName(id)); goto done; } diff --git a/src/mscng/app.c b/src/mscng/app.c index fcebbb39d..bc654bbd4 100755 --- a/src/mscng/app.c +++ b/src/mscng/app.c @@ -230,8 +230,7 @@ xmlSecMSCngAppKeyLoadMemory(const xmlSecByte* data, xmlSecSize dataSize, xmlSecK /* create key */ key = xmlSecKeyCreate(); if(key == NULL) { - xmlSecInternalError("xmlSecKeyCreate", - xmlSecKeyDataGetName(x509Data)); + xmlSecInternalError("xmlSecKeyCreate", NULL); goto done; } diff --git a/src/mscng/x509.c b/src/mscng/x509.c index c12a9aeab..a0513e767 100755 --- a/src/mscng/x509.c +++ b/src/mscng/x509.c @@ -447,7 +447,7 @@ xmlSecMSCngKeyDataX509Read(xmlSecKeyDataPtr data, xmlSecKeyValueX509Ptr x509Valu crl = xmlSecMSCngX509CrlDerRead(xmlSecBufferGetData(&(x509Value->crl)), xmlSecBufferGetSize(&(x509Value->crl))); if (crl == NULL) { - xmlSecInternalError("xmlSecMSCngX509CertDerRead", xmlSecKeyDataGetName(data)); + xmlSecInternalError("xmlSecMSCngX509CrlDerRead", xmlSecKeyDataGetName(data)); goto done; } } diff --git a/src/mscrypto/ciphers.c b/src/mscrypto/ciphers.c index d72304460..1a890e04e 100644 --- a/src/mscrypto/ciphers.c +++ b/src/mscrypto/ciphers.c @@ -162,7 +162,7 @@ xmlSecMSCryptoBlockCipherCtxUpdate(xmlSecMSCryptoBlockCipherCtxPtr ctx, dwBlockLenBitsLen = sizeof(dwBlockLenBits); if (!CryptGetKeyParam(ctx->cryptKey, KP_BLOCKLEN, (BYTE *)&dwBlockLenBits, &dwBlockLenBitsLen, 0)) { - xmlSecMSCryptoError("CryptSetKeyParam", cipherName); + xmlSecMSCryptoError("CryptGetKeyParam", cipherName); return(-1); } dwBlockLen = dwBlockLenBits / 8; diff --git a/src/mscrypto/keysstore.c b/src/mscrypto/keysstore.c index bf380f570..d7208cf1a 100644 --- a/src/mscrypto/keysstore.c +++ b/src/mscrypto/keysstore.c @@ -217,10 +217,19 @@ xmlSecMSCryptoKeysStoreFindCert(xmlSecKeyStorePtr store, const xmlChar* name, hStoreHandle = CertOpenSystemStore(0, storeName); if (NULL == hStoreHandle) { - xmlSecMSCryptoError2("CertOpenSystemStore", - xmlSecKeyStoreGetName(store), - "storeName=%s", - xmlSecErrorsSafeString(storeName)); + xmlChar* storeNameUtf8; + + storeNameUtf8 = xmlSecWin32ConvertTstrToUtf8(storeName); + if(storeNameUtf8 != NULL) { + xmlSecMSCryptoError2("CertOpenSystemStore", + xmlSecKeyStoreGetName(store), + "storeName=%s", + storeNameUtf8); + xmlFree(storeNameUtf8); + } else { + xmlSecMSCryptoError("CertOpenSystemStore", + xmlSecKeyStoreGetName(store)); + } return(NULL); } diff --git a/src/mscrypto/kw_des.c b/src/mscrypto/kw_des.c index 7d4aa4ea5..358fdccbb 100644 --- a/src/mscrypto/kw_des.c +++ b/src/mscrypto/kw_des.c @@ -538,8 +538,10 @@ xmlSecMSCryptoKWDes3BlockDecrypt(xmlSecTransformPtr transform, keyBuf, dwKeyBufSize, TRUE, - &cryptKey)) { + &cryptKey) + ) { + xmlSecInternalError("xmlSecMSCryptoImportPlainSessionBlob", NULL); goto done; } xmlSecAssert2(cryptKey != 0, -1); @@ -570,7 +572,7 @@ xmlSecMSCryptoKWDes3BlockDecrypt(xmlSecTransformPtr transform, XMLSEC_SAFE_CAST_SIZE_TO_ULONG(inSize, dwCLen, goto done, NULL); if(!CryptDecrypt(cryptKey, 0, FALSE, 0, out, &dwCLen)) { - xmlSecMSCryptoError("CryptEncrypt", NULL); + xmlSecMSCryptoError("CryptDecrypt", NULL); goto done; } diff --git a/src/nss/signatures.c b/src/nss/signatures.c index d281b374e..b79ea11f6 100644 --- a/src/nss/signatures.c +++ b/src/nss/signatures.c @@ -464,11 +464,15 @@ xmlSecNssSignatureVerify(xmlSecTransformPtr transform, } if (status != SECSuccess) { - if (PORT_GetError() == SEC_ERROR_PKCS7_BAD_SIGNATURE) { + PRErrorCode err; + + err = PORT_GetError(); + if((err == SEC_ERROR_BAD_SIGNATURE) || (err == SEC_ERROR_PKCS7_BAD_SIGNATURE)) { xmlSecOtherError(XMLSEC_ERRORS_R_DATA_NOT_MATCH, xmlSecTransformGetName(transform), - "VFY_EndWithSignature: signature verification failed"); + "signature verification failed"); transform->status = xmlSecTransformStatusFail; + return(0); } else { xmlSecNssError("VFY_EndWithSignature", xmlSecTransformGetName(transform)); From c6fe7e7593c0a4a3d980dc5934f54f9f14803164 Mon Sep 17 00:00:00 2001 From: Aleksey Sanin Date: Thu, 1 Oct 2026 19:50:05 -0400 Subject: [PATCH 2/2] Remove change --- src/keyinfo.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/keyinfo.c b/src/keyinfo.c index 379b1564f..cfe1b418e 100644 --- a/src/keyinfo.c +++ b/src/keyinfo.c @@ -1429,10 +1429,6 @@ xmlSecKeyDataEncryptedKeyXmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key, xmlNodeP } xmlSecAssert2(keyInfoCtx->encCtx != NULL, -1); - /* setup current recursion levels for the write context */ - keyInfoCtx->encCtx->keyInfoWriteCtx.curRetrievalMethodLevel = keyInfoCtx->curRetrievalMethodLevel; - keyInfoCtx->encCtx->keyInfoWriteCtx.curEncryptedKeyLevel = keyInfoCtx->curEncryptedKeyLevel + 1; - /* encrypt */ ret = xmlSecEncCtxBinaryEncrypt(keyInfoCtx->encCtx, node, keyBuf, keySize); if(ret < 0) {