| Message ID | 20200529064130.28332-5-takahiro.akashi@linaro.org |
|---|---|
| State | Superseded |
| Headers | show |
| Series | efi_loader: rework/improve UEFI secure boot code | expand |
On 5/29/20 8:41 AM, AKASHI Takahiro wrote: > Since the size check against an entry in efi_search_siglist() is > incorrect, this function will never find out a to-be-matched certificate > and its associated revocation time in signature list. %s/in signature/in the signature/ > > Signed-off-by: AKASHI Takahiro <takahiro.akashi at linaro.org> > --- > lib/efi_loader/efi_signature.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c > index be6491c6e255..35f678de057e 100644 > --- a/lib/efi_loader/efi_signature.c > +++ b/lib/efi_loader/efi_signature.c > @@ -432,10 +432,11 @@ static bool efi_search_siglist(struct x509_certificate *cert, > * time64_t revocation_time; > * }; > */ > - if ((sig_data->size == SHA256_SUM_LEN) && > - !memcmp(sig_data->data, hash, SHA256_SUM_LEN)) { > + if ((sig_data->size >= SHA256_SUM_LEN + sizeof(time64_t)) && > + !memcmp(sig_data->data, msg, SHA256_SUM_LEN)) { > memcpy(revoc_time, sig_data->data + SHA256_SUM_LEN, > sizeof(*revoc_time)); > + debug("revocation time: 0x%llx\n", *revoc_time); Since this is seconds since 1970 wouldn't it be reasonable to use decimal output (%llu)? Otherwise: Reviewed-by: Heinrich Schuchardt <xypron.glpk at gmx.de> > found = true; > goto out; > } >
diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c index be6491c6e255..35f678de057e 100644 --- a/lib/efi_loader/efi_signature.c +++ b/lib/efi_loader/efi_signature.c @@ -432,10 +432,11 @@ static bool efi_search_siglist(struct x509_certificate *cert, * time64_t revocation_time; * }; */ - if ((sig_data->size == SHA256_SUM_LEN) && - !memcmp(sig_data->data, hash, SHA256_SUM_LEN)) { + if ((sig_data->size >= SHA256_SUM_LEN + sizeof(time64_t)) && + !memcmp(sig_data->data, msg, SHA256_SUM_LEN)) { memcpy(revoc_time, sig_data->data + SHA256_SUM_LEN, sizeof(*revoc_time)); + debug("revocation time: 0x%llx\n", *revoc_time); found = true; goto out; }
Since the size check against an entry in efi_search_siglist() is incorrect, this function will never find out a to-be-matched certificate and its associated revocation time in signature list. Signed-off-by: AKASHI Takahiro <takahiro.akashi at linaro.org> --- lib/efi_loader/efi_signature.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)