[Tickets #6323] False positive SMIME verification

[bugs at horde.org]

DO NOT REPLY TO THIS MESSAGE. THIS EMAIL ADDRESS IS NOT MONITORED.

Ticket URL: http://bugs.horde.org/ticket/?id=6323
-----------------------------------------------------------------------
 Ticket             | 6323
 Created By         | thomas.belot at atosorigin.com
 Summary            | False positive SMIME verification
 Queue              | Horde Framework Packages
 Version            | FRAMEWORK_3
 Type               | Bug
 State              | Unconfirmed
 Priority           | 3. High
 Milestone          | 
 Patch              | 
 Owners             | 
-----------------------------------------------------------------------


thomas.belot at atosorigin.com (2008-02-26 11:25) wrote:

In file framework/Crypt/Crypt/smime.php,v 1.49.2.14 line 215
212:/* Try again without verfying the signer's cert */
213:        $result = openssl_pkcs7_verify($input, PKCS7_NOVERIFY,
$output);
214:
215:        if (($result === true) || ($result === -1)) {
216:            [Verification OK]
217:        } else {
218:            [Verification KO]
219:        }

Verification is OK if "$result === -1" but "openssl_pkcs7_verify"
documentation specify that "[openssl_pkcs7_verify] Returns [...] -1 on
error."
Why do you consider -1 a valid verification ???

In my case, I had malformed smime signature which lead to an encouraging
message "valid message verification, but unknown issuer"...