From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by mx.groups.io with SMTP id smtpd.web10.2343.1588034996398609348 for ; Mon, 27 Apr 2020 17:49:56 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.126, mailfrom: guomin.jiang@intel.com) IronPort-SDR: cGa2WAGW0rg5QmcSwcswAOg37psHgHZ5dTRNP4qsqbjRDNmZ47sHNP/QT1cnUTNCyupwozIC9X +mBdpgS6M3Tw== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Apr 2020 17:49:55 -0700 IronPort-SDR: cNL/N6J0cyO231aEZlZ+XQXB/s2w+xTRocSnGXv1wvDt5VkbcVwNBUqH7rAbKY0KwRba43d7dj prtY90s8a06A== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,325,1583222400"; d="scan'208";a="458597647" Received: from guominji-mobl.ccr.corp.intel.com ([10.238.5.173]) by fmsmga005.fm.intel.com with ESMTP; 27 Apr 2020 17:49:54 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jian J Wang , Xiaoyu Lu Subject: [PATCH v5] CryptoPkg/Pkcs7: Extend support for other OID types Date: Tue, 28 Apr 2020 08:49:53 +0800 Message-Id: <20200428004953.83-1-guomin.jiang@intel.com> X-Mailer: git-send-email 2.25.1.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2539 Microsoft signtool supports creation of attached P7's with any OID payload via the "/p7co" parameter. It is necessary to check the data before get the string. Cc: Jian J Wang Cc: Xiaoyu Lu Signed-off-by: Guomin Jiang --- .../BaseCryptLib/Pk/CryptPkcs7VerifyBase.c | 66 ++++++++++++++++++- 1 file changed, 65 insertions(+), 1 deletion(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c b/Cry= ptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c index 313f459b11..1b23ec99af 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c @@ -13,6 +13,66 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include =0D #include =0D =0D +/**=0D + Check the contents of PKCS7 is not data.=0D +=0D + It is copied from PKCS7_type_is_other() in pk7_doit.c.=0D +=0D + @param[in] P7 Pointer to the location at which the PKCS7 is located.=0D +=0D + @return INTN The content type.=0D +**/=0D +STATIC=0D +INTN=0D +Pkcs7TypeIsOther (=0D + IN PKCS7 *P7=0D + )=0D +{=0D + INTN Others =3D 1;=0D + INTN Nid =3D OBJ_obj2nid (P7->type);=0D +=0D + switch (Nid) {=0D + case NID_pkcs7_data:=0D + case NID_pkcs7_signed:=0D + case NID_pkcs7_enveloped:=0D + case NID_pkcs7_signedAndEnveloped:=0D + case NID_pkcs7_encrypted:=0D + Others =3D 0;=0D + break;=0D + default:=0D + Others =3D 1;=0D + }=0D +=0D + return Others;=0D +}=0D +=0D +/**=0D + Get the ASN.1 string for the PKCS7.=0D +=0D + It is copied from PKCS7_get_octet_string() in pk7_doit.c.=0D +=0D + @param[in] P7 Pointer to the location at which the PKCS7 is located.=0D +=0D + @return ASN1_OCTET_STRING ASN.1 string.=0D +**/=0D +STATIC=0D +ASN1_OCTET_STRING*=0D +Pkcs7GetOctetString (=0D + IN PKCS7 *P7=0D + )=0D +{=0D + if (PKCS7_type_is_data (P7)) {=0D + return P7->d.data;=0D + }=0D +=0D + if ((Pkcs7TypeIsOther(P7) =3D=3D 1) && P7->d.other &&=0D + (P7->d.other->type =3D=3D V_ASN1_OCTET_STRING)) {=0D + return P7->d.other->value.octet_string;=0D + }=0D +=0D + return NULL;=0D +}=0D +=0D /**=0D Extracts the attached content from a PKCS#7 signed data if existed. The = input signed=0D data could be wrapped in a ContentInfo structure.=0D @@ -98,7 +158,11 @@ Pkcs7GetAttachedContent ( //=0D // Retrieve the attached content in PKCS7 signedData=0D //=0D - OctStr =3D Pkcs7->d.sign->contents->d.data;=0D + OctStr =3D Pkcs7GetOctetString (Pkcs7->d.sign->contents);=0D + if (OctStr =3D=3D NULL) {=0D + goto _Exit;=0D + }=0D +=0D if ((OctStr->length > 0) && (OctStr->data !=3D NULL)) {=0D *ContentSize =3D OctStr->length;=0D *Content =3D AllocatePool (*ContentSize);=0D --=20 2.25.1.windows.1