CryptoPkg Updates to support RFC3161 timestamp signature verification.

[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptAuthenticode.c

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
index a4f62b22b5675dd3589087d30849ce0ee527a82d..4ce2b06b161c6d85341a89bf63567a006750e2c7 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
@@ -9,7 +9,7 @@
   AuthenticodeVerify() will get PE/COFF Authenticode and will do basic check for\r
   data structure.\r
 \r
-Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -26,6 +26,12 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <openssl/x509.h>\r
 #include <openssl/pkcs7.h>\r
 \r
+//\r
+// OID ASN.1 Value for SPC_INDIRECT_DATA_OBJID\r
+//\r
+UINT8 mSpcIndirectOidValue[] = {\r
+  0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x04\r
+  };\r
 \r
 /**\r
   Verifies the validility of a PE/COFF Authenticode Signature as described in "Windows\r
@@ -70,6 +76,7 @@ AuthenticodeVerify (
   UINT8        *SpcIndirectDataContent;\r
   UINT8        Asn1Byte;\r
   UINTN        ContentSize;\r
+  UINT8        *SpcIndirectDataOid;\r
 \r
   //\r
   // Check input parameters.\r
@@ -106,6 +113,19 @@ AuthenticodeVerify (
   //       some authenticode-specific structure. Use opaque ASN.1 string to retrieve\r
   //       PKCS#7 ContentInfo here.\r
   //\r
+  SpcIndirectDataOid = (UINT8 *)(Pkcs7->d.sign->contents->type->data);\r
+  if (CompareMem (\r
+        SpcIndirectDataOid,\r
+        mSpcIndirectOidValue,\r
+        sizeof (mSpcIndirectOidValue)\r
+        ) != 0) {\r
+    //\r
+    // Un-matched SPC_INDIRECT_DATA_OBJID.\r
+    //\r
+    goto _Exit;\r
+  }\r
+\r
+\r
   SpcIndirectDataContent = (UINT8 *)(Pkcs7->d.sign->contents->d.other->value.asn1_string->data);\r
 \r
   //\r
@@ -115,23 +135,35 @@ AuthenticodeVerify (
 \r
   if ((Asn1Byte & 0x80) == 0) {\r
     //\r
-    // Short Form of Length Encoding\r
+    // Short Form of Length Encoding (Length < 128)\r
     //\r
     ContentSize = (UINTN) (Asn1Byte & 0x7F);\r
     //\r
     // Skip the SEQUENCE Tag;\r
     //\r
     SpcIndirectDataContent += 2;\r
+\r
+  } else if ((Asn1Byte & 0x81) == 0x81) {\r
+    //\r
+    // Long Form of Length Encoding (128 <= Length < 255, Single Octet)\r
+    //\r
+    ContentSize = (UINTN) (*(UINT8 *)(SpcIndirectDataContent + 2));\r
+    //\r
+    // Skip the SEQUENCE Tag;\r
+    //\r
+    SpcIndirectDataContent += 3;\r
+\r
   } else if ((Asn1Byte & 0x82) == 0x82) {\r
     //\r
-    // Long Form of Length Encoding, only support two bytes.\r
+    // Long Form of Length Encoding (Length > 255, Two Octet)\r
     //\r
-    ContentSize  = (UINTN) (*(SpcIndirectDataContent + 2));\r
-    ContentSize = (ContentSize << 8) + (UINTN)(*(SpcIndirectDataContent + 3));\r
+    ContentSize = (UINTN) (*(UINT8 *)(SpcIndirectDataContent + 2));\r
+    ContentSize = (ContentSize << 8) + (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 3));\r
     //\r
     // Skip the SEQUENCE Tag;\r
     //\r
     SpcIndirectDataContent += 4;\r
+\r
   } else {\r
     goto _Exit;\r
   }\r