REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2539
Microsoft signtool supports creation of attached P7's with any OID payload via the "/p7co" parameter. It is necessary to check the data before get the string. Cc: Jian J Wang <[email protected]> Cc: Xiaoyu Lu <[email protected]> Signed-off-by: Guomin Jiang <[email protected]> --- .../BaseCryptLib/Pk/CryptPkcs7VerifyBase.c | 59 ++++++++++++++++++- 1 file changed, 58 insertions(+), 1 deletion(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c index 313f459b11..d03e97d265 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c @@ -13,6 +13,63 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include <openssl/x509v3.h> #include <openssl/pkcs7.h> +/** + Check the contents of PKCS7 is not data. + + It is copied from PKCS7_type_is_other() in pk7_doit.c. + + @param p7 Pointer to the location which the PKCS7 is located at. + + @return int The content type. +**/ +static +int +Pkcs7TypeIsOther ( + PKCS7 *p7 + ) +{ + int isOthers = 1; + int nid = OBJ_obj2nid(p7->type); + + switch (nid) { + case NID_pkcs7_data: + case NID_pkcs7_signed: + case NID_pkcs7_enveloped: + case NID_pkcs7_signedAndEnveloped: + case NID_pkcs7_encrypted: + isOthers = 0; + break; + default: + isOthers = 1; + } + + return isOthers; +} + +/** + Get the ASN.1 string for the PKCS7. + + It is copied from PKCS7_get_octet_string() in pk7_doit.c. + @param p7 Pointer to the location which the PKCS7 is located at. + + @return ASN1_OCTET_STRING ASN.1 string. +**/ +static +ASN1_OCTET_STRING* +Pkcs7GetOctetString ( + PKCS7 *p7 + ) +{ + if (PKCS7_type_is_data(p7)) { + return p7->d.data; + } + if (Pkcs7TypeIsOther(p7) && p7->d.other && + (p7->d.other->type == V_ASN1_OCTET_STRING)) { + return p7->d.other->value.octet_string; + } + return NULL; +} + /** Extracts the attached content from a PKCS#7 signed data if existed. The input signed data could be wrapped in a ContentInfo structure. @@ -98,7 +155,7 @@ Pkcs7GetAttachedContent ( // // Retrieve the attached content in PKCS7 signedData // - OctStr = Pkcs7->d.sign->contents->d.data; + OctStr = Pkcs7GetOctetString (Pkcs7->d.sign->contents); if ((OctStr->length > 0) && (OctStr->data != NULL)) { *ContentSize = OctStr->length; *Content = AllocatePool (*ContentSize); -- 2.25.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#56603): https://edk2.groups.io/g/devel/message/56603 Mute This Topic: https://groups.io/mt/72647274/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
