From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web10.6650.1587879612974656178 for ; Sat, 25 Apr 2020 22:40:13 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.31, mailfrom: guomin.jiang@intel.com) IronPort-SDR: Dj5S/Gopk6cpfYr6yIqHdiZul7W0g5jWkRK3lfg7tSWP7POiRZ65/xyk+VG7A2hEzrES8ZD8Jy n2KpK4YRS/OA== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Apr 2020 22:40:11 -0700 IronPort-SDR: fFuZYlh9xH3/SCJdhJ9G04wuJnZP5bnNEPqQKTXRuRmsG4r39jYaI0GS9HNt33MReWRKQYcSBq 6q7zrr8GfvKA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,318,1583222400"; d="scan'208";a="403859634" Received: from guominji-mobl.ccr.corp.intel.com ([10.238.5.173]) by orsmga004.jf.intel.com with ESMTP; 25 Apr 2020 22:40:10 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jian J Wang , Xiaoyu Lu Subject: [PATCH v4] CryptoPkg/Pkcs7: Extend support for other OID types Date: Sun, 26 Apr 2020 13:40:09 +0800 Message-Id: <20200426054009.792-1-guomin.jiang@intel.com> X-Mailer: git-send-email 2.25.1.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2539 Microsoft signtool supports creation of attached P7's with any OID payload via the "/p7co" parameter. It is necessary to check the data before get the string. Cc: Jian J Wang Cc: Xiaoyu Lu Signed-off-by: Guomin Jiang --- .../BaseCryptLib/Pk/CryptPkcs7VerifyBase.c | 65 ++++++++++++++++++- 1 file changed, 64 insertions(+), 1 deletion(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c b/Cry= ptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c index 313f459b11..70d9880897 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c @@ -13,6 +13,65 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include =0D #include =0D =0D +/**=0D + Check the contents of PKCS7 is not data.=0D +=0D + It is copied from PKCS7_type_is_other() in pk7_doit.c.=0D +=0D + @param P7 Pointer to the location which the PKCS7 is located at.=0D +=0D + @return UINT8 The content type.=0D +**/=0D +static=0D +UINT8=0D +Pkcs7TypeIsOther (=0D + PKCS7 *P7=0D + )=0D +{=0D + UINT8 Others =3D 1;=0D + UINT8 Nid =3D (UINT8) OBJ_obj2nid (P7->type);=0D +=0D + switch (Nid) {=0D + case NID_pkcs7_data:=0D + case NID_pkcs7_signed:=0D + case NID_pkcs7_enveloped:=0D + case NID_pkcs7_signedAndEnveloped:=0D + case NID_pkcs7_encrypted:=0D + Others =3D 0;=0D + break;=0D + default:=0D + Others =3D 1;=0D + }=0D +=0D + return Others;=0D +}=0D +=0D +/**=0D + Get the ASN.1 string for the PKCS7.=0D +=0D + It is copied from PKCS7_get_octet_string() in pk7_doit.c.=0D + @param P7 Pointer to the location which the PKCS7 is located at.=0D +=0D + @return ASN1_OCTET_STRING ASN.1 string.=0D +**/=0D +static=0D +ASN1_OCTET_STRING*=0D +Pkcs7GetOctetString (=0D + PKCS7 *P7=0D + )=0D +{=0D + if (PKCS7_type_is_data (P7)) {=0D + return P7->d.data;=0D + }=0D +=0D + if ((Pkcs7TypeIsOther(P7) =3D=3D 1) && P7->d.other &&=0D + (P7->d.other->type =3D=3D V_ASN1_OCTET_STRING)) {=0D + return P7->d.other->value.octet_string;=0D + }=0D +=0D + return NULL;=0D +}=0D +=0D /**=0D Extracts the attached content from a PKCS#7 signed data if existed. The = input signed=0D data could be wrapped in a ContentInfo structure.=0D @@ -98,7 +157,11 @@ Pkcs7GetAttachedContent ( //=0D // Retrieve the attached content in PKCS7 signedData=0D //=0D - OctStr =3D Pkcs7->d.sign->contents->d.data;=0D + OctStr =3D Pkcs7GetOctetString (Pkcs7->d.sign->contents);=0D + if (OctStr =3D=3D NULL) {=0D + goto _Exit;=0D + }=0D +=0D if ((OctStr->length > 0) && (OctStr->data !=3D NULL)) {=0D *ContentSize =3D OctStr->length;=0D *Content =3D AllocatePool (*ContentSize);=0D --=20 2.25.1.windows.1