UefiCpuPkg: Move AsmRelocateApLoopStart from Mpfuncs.nasm to AmdSev.nasm

[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptAuthenticode.c

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
index bb5f6d4b0d862dba66e64208d2597839bc56b3fe..6b0dddd4af5533d7e3f3ce619cbca9d26325572e 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
@@ -9,14 +9,8 @@
   AuthenticodeVerify() will get PE/COFF Authenticode and will do basic check for\r
   data structure.\r
 \r
-Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
-This program and the accompanying materials\r
-are licensed and made available under the terms and conditions of the BSD License\r
-which accompanies this distribution.  The full text of the license may be found at\r
-http://opensource.org/licenses/bsd-license.php\r
-\r
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+Copyright (c) 2011 - 2020, Intel Corporation. All rights reserved.<BR>\r
+SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
 **/\r
 \r
@@ -29,12 +23,12 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 //\r
 // OID ASN.1 Value for SPC_INDIRECT_DATA_OBJID\r
 //\r
-UINT8 mSpcIndirectOidValue[] = {\r
+GLOBAL_REMOVE_IF_UNREFERENCED const UINT8  mSpcIndirectOidValue[] = {\r
   0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x04\r
-  };\r
+};\r
 \r
 /**\r
-  Verifies the validility of a PE/COFF Authenticode Signature as described in "Windows\r
+  Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows\r
   Authenticode Portable Executable Signature Format".\r
 \r
   If AuthData is NULL, then return FALSE.\r
@@ -50,7 +44,7 @@ UINT8 mSpcIndirectOidValue[] = {
   @param[in]  TrustedCert  Pointer to a trusted/root certificate encoded in DER, which\r
                            is used for certificate chain verification.\r
   @param[in]  CertSize     Size of the trusted certificate in bytes.\r
-  @param[in]  ImageHash    Pointer to the original image file hash value. The procudure\r
+  @param[in]  ImageHash    Pointer to the original image file hash value. The procedure\r
                            for calculating the image hash value is described in Authenticode\r
                            specification.\r
   @param[in]  HashSize     Size of Image hash value in bytes.\r
@@ -72,11 +66,12 @@ AuthenticodeVerify (
 {\r
   BOOLEAN      Status;\r
   PKCS7        *Pkcs7;\r
+  CONST UINT8  *Temp;\r
   CONST UINT8  *OrigAuthData;\r
   UINT8        *SpcIndirectDataContent;\r
   UINT8        Asn1Byte;\r
   UINTN        ContentSize;\r
-  UINT8        *SpcIndirectDataOid;\r
+  CONST UINT8  *SpcIndirectDataOid;\r
 \r
   //\r
   // Check input parameters.\r
@@ -96,7 +91,8 @@ AuthenticodeVerify (
   //\r
   // Retrieve & Parse PKCS#7 Data (DER encoding) from Authenticode Signature\r
   //\r
-  Pkcs7 = d2i_PKCS7 (NULL, &AuthData, (int)DataSize);\r
+  Temp  = AuthData;\r
+  Pkcs7 = d2i_PKCS7 (NULL, &Temp, (int)DataSize);\r
   if (Pkcs7 == NULL) {\r
     goto _Exit;\r
   }\r
@@ -104,7 +100,7 @@ AuthenticodeVerify (
   //\r
   // Check if it's PKCS#7 Signed Data (for Authenticode Scenario)\r
   //\r
-  if (!PKCS7_type_is_signed (Pkcs7)) {\r
+  if (!PKCS7_type_is_signed (Pkcs7) || PKCS7_get_detached (Pkcs7)) {\r
     goto _Exit;\r
   }\r
 \r
@@ -113,18 +109,19 @@ AuthenticodeVerify (
   //       some authenticode-specific structure. Use opaque ASN.1 string to retrieve\r
   //       PKCS#7 ContentInfo here.\r
   //\r
-  SpcIndirectDataOid = (UINT8 *)(Pkcs7->d.sign->contents->type->data);\r
-  if (CompareMem (\r
-        SpcIndirectDataOid,\r
-        mSpcIndirectOidValue,\r
-        sizeof (mSpcIndirectOidValue)\r
-        ) != 0) {\r
+  SpcIndirectDataOid = OBJ_get0_data (Pkcs7->d.sign->contents->type);\r
+  if ((OBJ_length (Pkcs7->d.sign->contents->type) != sizeof (mSpcIndirectOidValue)) ||\r
+      (CompareMem (\r
+         SpcIndirectDataOid,\r
+         mSpcIndirectOidValue,\r
+         sizeof (mSpcIndirectOidValue)\r
+         ) != 0))\r
+  {\r
     //\r
     // Un-matched SPC_INDIRECT_DATA_OBJID.\r
     //\r
     goto _Exit;\r
-  }  \r
-\r
+  }\r
 \r
   SpcIndirectDataContent = (UINT8 *)(Pkcs7->d.sign->contents->d.other->value.asn1_string->data);\r
 \r
@@ -135,19 +132,28 @@ AuthenticodeVerify (
 \r
   if ((Asn1Byte & 0x80) == 0) {\r
     //\r
-    // Short Form of Length Encoding\r
+    // Short Form of Length Encoding (Length < 128)\r
     //\r
-    ContentSize = (UINTN) (Asn1Byte & 0x7F);\r
+    ContentSize = (UINTN)(Asn1Byte & 0x7F);\r
     //\r
     // Skip the SEQUENCE Tag;\r
     //\r
     SpcIndirectDataContent += 2;\r
+  } else if ((Asn1Byte & 0x81) == 0x81) {\r
+    //\r
+    // Long Form of Length Encoding (128 <= Length < 255, Single Octet)\r
+    //\r
+    ContentSize = (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 2));\r
+    //\r
+    // Skip the SEQUENCE Tag;\r
+    //\r
+    SpcIndirectDataContent += 3;\r
   } else if ((Asn1Byte & 0x82) == 0x82) {\r
     //\r
-    // Long Form of Length Encoding, only support two bytes.\r
+    // Long Form of Length Encoding (Length > 255, Two Octet)\r
     //\r
-    ContentSize  = (UINTN) (*(SpcIndirectDataContent + 2));\r
-    ContentSize = (ContentSize << 8) + (UINTN)(*(SpcIndirectDataContent + 3));\r
+    ContentSize = (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 2));\r
+    ContentSize = (ContentSize << 8) + (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 3));\r
     //\r
     // Skip the SEQUENCE Tag;\r
     //\r
@@ -171,7 +177,7 @@ AuthenticodeVerify (
   //\r
   // Verifies the PKCS#7 Signed Data in PE/COFF Authenticode Signature\r
   //\r
-  Status = (BOOLEAN) Pkcs7Verify (OrigAuthData, DataSize, TrustedCert, CertSize, SpcIndirectDataContent, ContentSize);\r
+  Status = (BOOLEAN)Pkcs7Verify (OrigAuthData, DataSize, TrustedCert, CertSize, SpcIndirectDataContent, ContentSize);\r
 \r
 _Exit:\r
   //\r