From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web10.45316.1585553126717976318 for ; Mon, 30 Mar 2020 00:25:27 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.115, mailfrom: guomin.jiang@intel.com) IronPort-SDR: D131jNF2H0o6XTO5KqcsaWyO2qKl99loU2DJa1t8qbwfLAnk0DTXpxVayy8xjJtD8rn3k0d1XF bl5N6xEpqlBA== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Mar 2020 00:25:22 -0700 IronPort-SDR: FObhuzKdatnygivwWyn8u3cZdKXaE12D+Og0odCDcYHWTT6mWf1jInZV9+/BfwUbx1z1Z8sxzm yE1dPKqqvqhg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,323,1580803200"; d="scan'208";a="272285127" Received: from guominji-mobl.ccr.corp.intel.com ([10.238.5.173]) by fmsmga004.fm.intel.com with ESMTP; 30 Mar 2020 00:25:20 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jian J Wang , Xiaoyu Lu Subject: [PATCH v2] CryptoPkg/Pkcs7: Extend support for other OID types Date: Mon, 30 Mar 2020 15:25:19 +0800 Message-Id: <20200330072519.2108-1-guomin.jiang@intel.com> X-Mailer: git-send-email 2.25.1.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2539 Microsoft signtool supports creation of attached P7's with any OID payload via the "/p7co" parameter. It is necessary to check the data before get the string. Cc: Jian J Wang Cc: Xiaoyu Lu Signed-off-by: Guomin Jiang --- .../BaseCryptLib/Pk/CryptPkcs7VerifyBase.c | 59 ++++++++++++++++++- 1 file changed, 58 insertions(+), 1 deletion(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c b/Cry= ptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c index 313f459b11..d03e97d265 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c @@ -13,6 +13,63 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include =0D #include =0D =0D +/**=0D + Check the contents of PKCS7 is not data.=0D +=0D + It is copied from PKCS7_type_is_other() in pk7_doit.c.=0D +=0D + @param p7 Pointer to the location which the PKCS7 is located at.=0D +=0D + @return int The content type.=0D +**/=0D +static=0D +int=0D +Pkcs7TypeIsOther (=0D + PKCS7 *p7=0D + )=0D +{=0D + int isOthers =3D 1;=0D + int nid =3D OBJ_obj2nid(p7->type);=0D +=0D + switch (nid) {=0D + case NID_pkcs7_data:=0D + case NID_pkcs7_signed:=0D + case NID_pkcs7_enveloped:=0D + case NID_pkcs7_signedAndEnveloped:=0D + case NID_pkcs7_encrypted:=0D + isOthers =3D 0;=0D + break;=0D + default:=0D + isOthers =3D 1;=0D + }=0D +=0D + return isOthers;=0D +}=0D +=0D +/**=0D + Get the ASN.1 string for the PKCS7.=0D +=0D + It is copied from PKCS7_get_octet_string() in pk7_doit.c.=0D + @param p7 Pointer to the location which the PKCS7 is located at.=0D +=0D + @return ASN1_OCTET_STRING ASN.1 string.=0D +**/=0D +static=0D +ASN1_OCTET_STRING*=0D +Pkcs7GetOctetString (=0D + PKCS7 *p7=0D + )=0D +{=0D + if (PKCS7_type_is_data(p7)) {=0D + return p7->d.data;=0D + }=0D + if (Pkcs7TypeIsOther(p7) && p7->d.other &&=0D + (p7->d.other->type =3D=3D V_ASN1_OCTET_STRING)) {=0D + return p7->d.other->value.octet_string;=0D + }=0D + return NULL;=0D +}=0D +=0D /**=0D Extracts the attached content from a PKCS#7 signed data if existed. The = input signed=0D data could be wrapped in a ContentInfo structure.=0D @@ -98,7 +155,7 @@ Pkcs7GetAttachedContent ( //=0D // Retrieve the attached content in PKCS7 signedData=0D //=0D - OctStr =3D Pkcs7->d.sign->contents->d.data;=0D + OctStr =3D Pkcs7GetOctetString (Pkcs7->d.sign->contents);=0D if ((OctStr->length > 0) && (OctStr->data !=3D NULL)) {=0D *ContentSize =3D OctStr->length;=0D *Content =3D AllocatePool (*ContentSize);=0D --=20 2.25.1.windows.1