[Fix] Do not assert if length of sig is bad, just fail verification

diff --git a/src/libcryptobox/cryptobox.c b/src/libcryptobox/cryptobox.c
index 7cd5e1b133a9443f974f253ca5d140e26c87d729..4d42ddb3831023058406173a560c0bcb15c7b4b1 100644 (file)
--- a/src/libcryptobox/cryptobox.c
+++ b/src/libcryptobox/cryptobox.c
@@ -590,8 +590,9 @@ rspamd_cryptobox_verify (const guchar *sig,
        bool ret = false;
 
        if (G_LIKELY (mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
-               g_assert (siglen == rspamd_cryptobox_signature_bytes (RSPAMD_CRYPTOBOX_MODE_25519));
-               ret = ed25519_verify (sig, m, mlen, pk);
+               if (siglen == rspamd_cryptobox_signature_bytes (RSPAMD_CRYPTOBOX_MODE_25519)) {
+                       ret = ed25519_verify (sig, m, mlen, pk);
+               }
        }
        else {
 #ifndef HAVE_USABLE_OPENSSL