Fix issue that RsaPkcs1Verify() may not work in PEI phase.

[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptRsaBasic.c

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c
index 76754b4a72f0a2800fe88ae637c63893821b7e19..cbe3c50fedbce1f604745554e6207259eeff6d29 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c
@@ -285,19 +285,23 @@ RsaPkcs1Verify (
   IN  VOID         *RsaContext,\r
   IN  CONST UINT8  *MessageHash,\r
   IN  UINTN        HashSize,\r
-  IN  UINT8        *Signature,\r
+  IN  CONST UINT8  *Signature,\r
   IN  UINTN        SigSize\r
   )\r
 {\r
   INTN     Length;\r
+  UINT8    *DecryptedSigature;\r
 \r
   //\r
   // Check input parameters.\r
   //\r
-  if (RsaContext == NULL || MessageHash == NULL || Signature == NULL || SigSize > INT_MAX) {\r
+  if (RsaContext == NULL || MessageHash == NULL || Signature == NULL) {\r
     return FALSE;\r
   }\r
 \r
+  if (SigSize > INT_MAX || SigSize == 0) {\r
+    return FALSE;\r
+  }\r
   \r
   //\r
   // Check for unsupported hash size:\r
@@ -306,14 +310,22 @@ RsaPkcs1Verify (
   if (HashSize != MD5_DIGEST_SIZE && HashSize != SHA1_DIGEST_SIZE && HashSize != SHA256_DIGEST_SIZE) {\r
     return FALSE;\r
   }\r
-  \r
+\r
+  //\r
+  // Prepare buffer to store decrypted signature.\r
+  //\r
+  DecryptedSigature = (UINT8 *) malloc (SigSize);\r
+  if (DecryptedSigature == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
   //\r
   // RSA PKCS#1 Signature Decoding using OpenSSL RSA Decryption with Public Key\r
   //\r
   Length = RSA_public_decrypt (\r
              (UINT32) SigSize,\r
              Signature,\r
-             Signature,\r
+             DecryptedSigature,\r
              RsaContext,\r
              RSA_PKCS1_PADDING\r
              );\r
@@ -324,6 +336,7 @@ RsaPkcs1Verify (
   //       Ignore more strict length checking here.\r
   //\r
   if (Length < (INTN) HashSize) {\r
+    free (DecryptedSigature);\r
     return FALSE;\r
   }\r
 \r
@@ -337,15 +350,17 @@ RsaPkcs1Verify (
   //       Then Memory Comparing should skip the DER value of the underlying SEQUENCE\r
   //       type and AlgorithmIdentifier.\r
   //\r
-  if (CompareMem (MessageHash, Signature + Length - HashSize, HashSize) == 0) {\r
+  if (CompareMem (MessageHash, DecryptedSigature + Length - HashSize, HashSize) == 0) {\r
     //\r
     // Valid RSA PKCS#1 Signature\r
     //\r
+    free (DecryptedSigature);\r
     return TRUE;\r
   } else {\r
     //\r
     // Failed to verification\r
     //\r
+    free (DecryptedSigature);\r
     return FALSE;\r
   }\r
 }\r