Add comment for modules which have external input.

[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptAuthenticode.c

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
index 0321b203499fa678b39129881edf8466f5df00a7..a4f62b22b5675dd3589087d30849ce0ee527a82d 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
@@ -1,7 +1,15 @@
 /** @file\r
   Authenticode Portable Executable Signature Verification over OpenSSL.\r
 \r
-Copyright (c) 2011, Intel Corporation. All rights reserved.<BR>\r
+  Caution: This module requires additional review when modified.\r
+  This library will have external input - signature (e.g. PE/COFF Authenticode).\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  AuthenticodeVerify() will get PE/COFF Authenticode and will do basic check for\r
+  data structure.\r
+\r
+Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -23,8 +31,12 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
   Verifies the validility of a PE/COFF Authenticode Signature as described in "Windows\r
   Authenticode Portable Executable Signature Format".\r
 \r
-  If AuthData is NULL, then ASSERT().\r
-  If ImageHash is NULL, then ASSERT().\r
+  If AuthData is NULL, then return FALSE.\r
+  If ImageHash is NULL, then return FALSE.\r
+\r
+  Caution: This function may receive untrusted input.\r
+  PE/COFF Authenticode is external input, so this function will do basic check for\r
+  Authenticode data structure.\r
 \r
   @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from signed\r
                            PE/COFF image to be verified.\r
@@ -60,11 +72,15 @@ AuthenticodeVerify (
   UINTN        ContentSize;\r
 \r
   //\r
-  // ASSERT if Authenticode Signature Data or PE Image Hash is NULL.\r
+  // Check input parameters.\r
   //\r
-  ASSERT (AuthData  != NULL);\r
-  ASSERT (ImageHash != NULL);\r
-  ASSERT (DataSize  <= INT_MAX);\r
+  if ((AuthData == NULL) || (TrustedCert == NULL) || (ImageHash == NULL)) {\r
+    return FALSE;\r
+  }\r
+\r
+  if ((DataSize > INT_MAX) || (CertSize > INT_MAX) || (HashSize > INT_MAX)) {\r
+    return FALSE;\r
+  }\r
 \r
   Status       = FALSE;\r
   Pkcs7        = NULL;\r
@@ -96,6 +112,7 @@ AuthenticodeVerify (
   // Retrieve the SEQUENCE data size from ASN.1-encoded SpcIndirectDataContent.\r
   //\r
   Asn1Byte = *(SpcIndirectDataContent + 1);\r
+\r
   if ((Asn1Byte & 0x80) == 0) {\r
     //\r
     // Short Form of Length Encoding\r
@@ -105,9 +122,9 @@ AuthenticodeVerify (
     // Skip the SEQUENCE Tag;\r
     //\r
     SpcIndirectDataContent += 2;\r
-  } else {\r
+  } else if ((Asn1Byte & 0x82) == 0x82) {\r
     //\r
-    // Long Form of Length Encoding (Assume Only two bytes here)\r
+    // Long Form of Length Encoding, only support two bytes.\r
     //\r
     ContentSize  = (UINTN) (*(SpcIndirectDataContent + 2));\r
     ContentSize = (ContentSize << 8) + (UINTN)(*(SpcIndirectDataContent + 3));\r
@@ -115,6 +132,8 @@ AuthenticodeVerify (
     // Skip the SEQUENCE Tag;\r
     //\r
     SpcIndirectDataContent += 4;\r
+  } else {\r
+    goto _Exit;\r
   }\r
 \r
   //\r