From 1a29085975194c17d31019768a7f7ec374642960 Mon Sep 17 00:00:00 2001
From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Wed, 9 Aug 2017 19:15:20 +0100
Subject: [PATCH] [Fix] Reject invalid bh for DKIM signatures earlier

---
 src/libserver/dkim.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/libserver/dkim.c b/src/libserver/dkim.c
index 06adab305..72cc7232f 100644
--- a/src/libserver/dkim.c
+++ b/src/libserver/dkim.c
@@ -2196,6 +2196,14 @@ rspamd_dkim_check (rspamd_dkim_context_t *ctx,
 					}
 				}
 			}
+			else {
+				msg_debug_dkim (
+						"bh value mismatch: %*xs versus %*xs",
+						dlen, ctx->bh,
+						dlen, cached_bh->digest_normal);
+
+				return DKIM_REJECT;
+			}
 		}
 
 		if (cpy_ctx) {
-- 
2.39.5