From ba32fcac83ccb3454ece348d2360282b1739658a Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Thu, 30 Jun 2016 09:11:40 +0200
Subject: pkcs11_get_attribute_avalue: correctly handle a -1 value length from
 C_GetAttributeValue

That is, work-around modules which do not return an error on sensitive
objects.

Relates #108
---
 lib/pkcs11_int.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/pkcs11_int.c b/lib/pkcs11_int.c
index 25c537bbed..2994baf113 100644
--- a/lib/pkcs11_int.c
+++ b/lib/pkcs11_int.c
@@ -137,6 +137,12 @@ pkcs11_get_attribute_avalue(struct ck_function_list * module,
 	templ.value_len = 0;
 	rv = (module)->C_GetAttributeValue(sess, object, &templ, 1);
 	if (rv == CKR_OK) {
+		/* PKCS#11 v2.20 requires sensitive values to set a length
+		 * of -1. In that case an error should have been returned,
+		 * but some implementations return CKR_OK instead. */
+		if (templ.value_len == (unsigned long)-1)
+			return CKR_ATTRIBUTE_SENSITIVE;
+
 		if (templ.value_len == 0)
 			return rv;
 
-- 
cgit v1.2.1