From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.2281.1586485879345299175 for ; Thu, 09 Apr 2020 19:31:19 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.115, mailfrom: guomin.jiang@intel.com) IronPort-SDR: Pivym21tqazepS1C6QFBd2TvW4veJHBeApF600N5b9hAqoI9Xf38bXlzA7bD6Fps60+eTb+qqt KPQQoy/f8k+w== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Apr 2020 19:31:19 -0700 IronPort-SDR: 28C2hnUd77XkAxUGJg0BGaCdAG4eMcIIaQP3tIP9P7DUXbcv2ieDElvD4+dbfqbfIXOkSaEQkH 5IZWGQfRkXRA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,364,1580803200"; d="scan'208";a="452241709" Received: from unknown (HELO guominji-MOBL.ccr.corp.intel.com) ([10.239.158.147]) by fmsmga005.fm.intel.com with ESMTP; 09 Apr 2020 19:31:17 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jian J Wang , Xiaoyu Lu Subject: [PATCH v3] CryptoPkg/Pkcs7: Extend support for other OID types Date: Fri, 10 Apr 2020 10:31:17 +0800 Message-Id: <20200410023117.1322-1-guomin.jiang@intel.com> X-Mailer: git-send-email 2.25.1.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2539 Microsoft signtool supports creation of attached P7's with any OID payload via the "/p7co" parameter. It is necessary to check the data before get the string. Cc: Jian J Wang Cc: Xiaoyu Lu Signed-off-by: Guomin Jiang --- .../BaseCryptLib/Pk/CryptPkcs7VerifyBase.c | 63 ++++++++++++++++++- 1 file changed, 62 insertions(+), 1 deletion(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c b/Cry= ptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c index 313f459b11..00840e7f83 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c @@ -13,6 +13,63 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include =0D #include =0D =0D +/**=0D + Check the contents of PKCS7 is not data.=0D +=0D + It is copied from PKCS7_type_is_other() in pk7_doit.c.=0D +=0D + @param p7 Pointer to the location which the PKCS7 is located at.=0D +=0D + @return int The content type.=0D +**/=0D +static=0D +int=0D +Pkcs7TypeIsOther (=0D + PKCS7 *p7=0D + )=0D +{=0D + int isOthers =3D 1;=0D + int nid =3D OBJ_obj2nid(p7->type);=0D +=0D + switch (nid) {=0D + case NID_pkcs7_data:=0D + case NID_pkcs7_signed:=0D + case NID_pkcs7_enveloped:=0D + case NID_pkcs7_signedAndEnveloped:=0D + case NID_pkcs7_encrypted:=0D + isOthers =3D 0;=0D + break;=0D + default:=0D + isOthers =3D 1;=0D + }=0D +=0D + return isOthers;=0D +}=0D +=0D +/**=0D + Get the ASN.1 string for the PKCS7.=0D +=0D + It is copied from PKCS7_get_octet_string() in pk7_doit.c.=0D + @param p7 Pointer to the location which the PKCS7 is located at.=0D +=0D + @return ASN1_OCTET_STRING ASN.1 string.=0D +**/=0D +static=0D +ASN1_OCTET_STRING*=0D +Pkcs7GetOctetString (=0D + PKCS7 *p7=0D + )=0D +{=0D + if (PKCS7_type_is_data(p7)) {=0D + return p7->d.data;=0D + }=0D + if (Pkcs7TypeIsOther(p7) && p7->d.other &&=0D + (p7->d.other->type =3D=3D V_ASN1_OCTET_STRING)) {=0D + return p7->d.other->value.octet_string;=0D + }=0D + return NULL;=0D +}=0D +=0D /**=0D Extracts the attached content from a PKCS#7 signed data if existed. The = input signed=0D data could be wrapped in a ContentInfo structure.=0D @@ -98,7 +155,11 @@ Pkcs7GetAttachedContent ( //=0D // Retrieve the attached content in PKCS7 signedData=0D //=0D - OctStr =3D Pkcs7->d.sign->contents->d.data;=0D + OctStr =3D Pkcs7GetOctetString (Pkcs7->d.sign->contents);=0D + if (OctStr =3D=3D NULL) {=0D + goto _Exit;=0D + }=0D +=0D if ((OctStr->length > 0) && (OctStr->data !=3D NULL)) {=0D *ContentSize =3D OctStr->length;=0D *Content =3D AllocatePool (*ContentSize);=0D --=20 2.25.1.windows.1