fips: Return the signature length

We need to pass the siglen from the fips wrapper for ECDSA signatures
to work

The OpenSSL d2i_* functions do not care about trailing data, but
rust-asn1 does not allow any trailing data so we need to pass the
signature length from the FIPS submodule to the ecc code and resize
the vector.

src/fips.rs

@@ -746,18 +746,22 @@ impl ProviderSignatureCtx {
         }
     }
 
-    pub fn digest_sign_final(&mut self, signature: &mut [u8]) -> KResult<()> {
+    pub fn digest_sign_final(&mut self, signature: &mut [u8]) -> KResult<usize> {
         unsafe {
             match (*self.vtable).digest_sign_final {
                 Some(f) => {
                     let mut siglen = 0usize;
                     let siglen_ptr: *mut usize = &mut siglen;
-                    res_to_err!(f(
+                    let res = f(
                         self.ctx,
                         signature.as_mut_ptr() as *mut c_uchar,
                         siglen_ptr,
                         signature.len()
-                    ))
+                    );
+                    if res != 1 {
+                        return err_rv!(CKR_DEVICE_ERROR);
+                    }
+                    Ok(siglen)
                 }
                 None => err_rv!(CKR_DEVICE_ERROR),
             }

src/ossl/rsa.rs

@@ -818,7 +818,14 @@ impl Sign for RsaPKCSOperation {
 
         #[cfg(feature = "fips")]
         {
-            self.sigctx.as_mut().unwrap().digest_sign_final(signature)
+            match self.sigctx.as_mut().unwrap().digest_sign_final(signature) {
+                Ok(siglen) => if siglen != signature.len() {
+                        err_rv!(CKR_DEVICE_ERROR)
+                    } else {
+                        Ok(())
+                    },
+                Err(_) => return err_rv!(CKR_DEVICE_ERROR),
+            }
         }
         #[cfg(not(feature = "fips"))]
         unsafe {