VerifyBuffer() in PKCS7 Verify Protocol should return EFI_UNSUPPORTED when signed data is embedded in SignedData but InData is not NULL. This patch is to comply with the spec definition.
Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <[email protected]> --- SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c b/SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c index 13c9138..8bf1f1f 100644 --- a/SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c +++ b/SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c @@ -833,6 +833,12 @@ VerifyBuffer ( return EFI_UNSUPPORTED; } if (AttachedData != NULL) { + if (InData != NULL) { + // + // Signed data embedded in SignedData but InData is not NULL + // + return EFI_UNSUPPORTED; + } // // PKCS7-formatted signedData with attached content; Use the embedded // content for verification -- 1.9.5.msysgit.1 _______________________________________________ edk2-devel mailing list [email protected] https://lists.01.org/mailman/listinfo/edk2-devel
