|
 |
e97c83 |
From 3d1cdbc4e3815dd8e489b8a9c95e945b67d3a045 Mon Sep 17 00:00:00 2001
|
|
|
e97c83 |
From: Peter Jones <pjones@redhat.com>
|
|
|
e97c83 |
Date: Fri, 19 Sep 2014 11:48:56 -0400
|
|
|
e97c83 |
Subject: [PATCH 58/74] Don't call AuthenticodeVerify if vendor_cert_size is 0.
|
|
|
e97c83 |
|
|
|
e97c83 |
Actually check the size of our vendor cert quite early, so that there's
|
|
|
e97c83 |
no confusion as to what's going on.
|
|
|
e97c83 |
|
|
|
e97c83 |
This isn't strictly necessary, in that in all cases if vendor_cert_size
|
|
|
e97c83 |
is 0, then AuthenticodeVerify -> Pkcs7Verify() -> d2i_X509() will result
|
|
|
e97c83 |
in a NULL "Cert", and it will return FALSE, and we'll reject the
|
|
|
e97c83 |
signature, but better to avoid all that code in the first place. Belt
|
|
|
e97c83 |
and suspenders and whatnot.
|
|
|
e97c83 |
|
|
|
e97c83 |
Based on a patch from https://github.com/TBOpen .
|
|
|
e97c83 |
|
|
|
e97c83 |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
e97c83 |
---
|
|
|
e97c83 |
shim.c | 9 ++++-----
|
|
|
e97c83 |
1 file changed, 4 insertions(+), 5 deletions(-)
|
|
|
e97c83 |
|
|
|
e97c83 |
diff --git a/shim.c b/shim.c
|
|
|
e97c83 |
index cfa90d1..caa05d8 100644
|
|
|
e97c83 |
--- a/shim.c
|
|
|
e97c83 |
+++ b/shim.c
|
|
|
e97c83 |
@@ -923,14 +923,13 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
|
|
|
e97c83 |
return status;
|
|
|
e97c83 |
}
|
|
|
e97c83 |
|
|
|
e97c83 |
-
|
|
|
e97c83 |
/*
|
|
|
e97c83 |
* And finally, check against shim's built-in key
|
|
|
e97c83 |
*/
|
|
|
e97c83 |
- if (AuthenticodeVerify(cert->CertData,
|
|
|
e97c83 |
- context->SecDir->Size - sizeof(cert->Hdr),
|
|
|
e97c83 |
- vendor_cert, vendor_cert_size, sha256hash,
|
|
|
e97c83 |
- SHA256_DIGEST_SIZE)) {
|
|
|
e97c83 |
+ if (vendor_cert_size && AuthenticodeVerify(cert->CertData,
|
|
|
e97c83 |
+ context->SecDir->Size - sizeof(cert->Hdr),
|
|
|
e97c83 |
+ vendor_cert, vendor_cert_size, sha256hash,
|
|
|
e97c83 |
+ SHA256_DIGEST_SIZE)) {
|
|
|
e97c83 |
status = EFI_SUCCESS;
|
|
|
e97c83 |
return status;
|
|
|
e97c83 |
}
|
|
|
e97c83 |
--
|
|
|
e97c83 |
1.9.3
|
|
|
e97c83 |
|