REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2539
Microsoft signtool supports creation of attached P7's with any OID payload via the "/p7co" parameter. It is necessary to check the data before get the string. Cc: Jian J Wang <[email protected]> Cc: Xiaoyu Lu <[email protected]> Signed-off-by: Guomin Jiang <[email protected]> Reviewed-by: Jian J Wang <[email protected]> --- .../BaseCryptLib/Pk/CryptPkcs7VerifyBase.c | 67 ++++++++++++++++++- 1 file changed, 66 insertions(+), 1 deletion(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c index 313f459b11..112c13c226 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c @@ -13,6 +13,67 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include <openssl/x509v3.h> #include <openssl/pkcs7.h> +/** + Check the contents of PKCS7 is not data. + + It is copied from PKCS7_type_is_other() in pk7_doit.c. + + @param[in] P7 Pointer to the location at which the PKCS7 is located. + + @retval TRUE If the type is others. + @retval FALSE If the type is expected. +**/ +STATIC +BOOLEAN +Pkcs7TypeIsOther ( + IN PKCS7 *P7 + ) +{ + BOOLEAN Others; + INTN Nid = OBJ_obj2nid (P7->type); + + switch (Nid) { + case NID_pkcs7_data: + case NID_pkcs7_signed: + case NID_pkcs7_enveloped: + case NID_pkcs7_signedAndEnveloped: + case NID_pkcs7_encrypted: + Others = FALSE; + break; + default: + Others = TRUE; + } + + return Others; +} + +/** + Get the ASN.1 string for the PKCS7. + + It is copied from PKCS7_get_octet_string() in pk7_doit.c. + + @param[in] P7 Pointer to the location at which the PKCS7 is located. + + @return ASN1_OCTET_STRING ASN.1 string. +**/ +STATIC +ASN1_OCTET_STRING* +Pkcs7GetOctetString ( + IN PKCS7 *P7 + ) +{ + if (PKCS7_type_is_data (P7)) { + return P7->d.data; + } + + if (Pkcs7TypeIsOther(P7) && (P7->d.other != NULL) && + (P7->d.other->type == V_ASN1_OCTET_STRING)) { + return P7->d.other->value.octet_string; + } + + return NULL; +} + /** Extracts the attached content from a PKCS#7 signed data if existed. The input signed data could be wrapped in a ContentInfo structure. @@ -98,7 +159,11 @@ Pkcs7GetAttachedContent ( // // Retrieve the attached content in PKCS7 signedData // - OctStr = Pkcs7->d.sign->contents->d.data; + OctStr = Pkcs7GetOctetString (Pkcs7->d.sign->contents); + if (OctStr == NULL) { + goto _Exit; + } + if ((OctStr->length > 0) && (OctStr->data != NULL)) { *ContentSize = OctStr->length; *Content = AllocatePool (*ContentSize); -- 2.25.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#58284): https://edk2.groups.io/g/devel/message/58284 Mute This Topic: https://groups.io/mt/73344002/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
