From d2e7f8c5a83560f5a40fc69c64f04a430b4bf545 Mon Sep 17 00:00:00 2001
From: "nelson%bolyard.com"
 <nelson%bolyard.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 13 Feb 2009 05:23:23 +0000
Subject: [PATCH] Bug 441321: Tolerate incorrect encoding of DSA signatures in
 SSL 3.0 handshakes r=wtc.

git-svn-id: svn://10.0.0.236/trunk@256213 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/security/nss/lib/ssl/ssl3con.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
index 2f3f93c6b13..4f9d484990c 100644
--- a/mozilla/security/nss/lib/ssl/ssl3con.c
+++ b/mozilla/security/nss/lib/ssl/ssl3con.c
@@ -39,7 +39,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: ssl3con.c,v 1.114 2008-12-17 06:09:19 nelson%bolyard.com Exp $ */
+/* $Id: ssl3con.c,v 1.115 2009-02-13 05:23:23 nelson%bolyard.com Exp $ */
 
 #include "cert.h"
 #include "ssl.h"
@@ -905,7 +905,8 @@ ssl3_VerifySignedHashes(SSL3Hashes *hash, CERTCertificate *cert,
     case dsaKey:
 	hashItem.data = hash->sha;
 	hashItem.len = sizeof(hash->sha);
-	if (isTLS) {
+	/* Allow DER encoded DSA signatures in SSL 3.0 */
+	if (isTLS || buf->len != DSA_SIGNATURE_LEN) {
 	    signature = DSAU_DecodeDerSig(buf);
 	    if (!signature) {
 	    	PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);