Initialize data and correct faulty logic in TcpComponentNameGetControllerName().

[mirror_edk2.git] / SecurityPkg / Library / DxeImageVerificationLib / DxeImageVerificationLib.c

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 0243eb8c0604605127d282c7779384626570df1b..959a9b062db3714fa13b244452a93a43cf3b821a 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -769,7 +769,7 @@ AddImageExeInfo (
   }\r
 \r
   DevicePathSize            = GetDevicePathSize (DevicePath);\r
-  NewImageExeInfoEntrySize  = sizeof (EFI_IMAGE_EXECUTION_INFO) + NameStringLen + DevicePathSize + SignatureSize;\r
+  NewImageExeInfoEntrySize  = sizeof (EFI_IMAGE_EXECUTION_INFO) - sizeof (EFI_SIGNATURE_LIST) + NameStringLen + DevicePathSize + SignatureSize;\r
   NewImageExeInfoTable      = (EFI_IMAGE_EXECUTION_INFO_TABLE *) AllocateRuntimePool (ImageExeInfoTableSize + NewImageExeInfoEntrySize);\r
   if (NewImageExeInfoTable == NULL) {\r
     return ;\r
@@ -841,7 +841,7 @@ IsCertHashFoundInDatabase (
   )\r
 {\r
   BOOLEAN             IsFound;\r
-  EFI_STATUS          Status;\r
+  BOOLEAN             Status;\r
   EFI_SIGNATURE_LIST  *DbxList;\r
   UINTN               DbxSize;\r
   EFI_SIGNATURE_DATA  *CertHash;\r
@@ -852,6 +852,8 @@ IsCertHashFoundInDatabase (
   UINT8               CertDigest[MAX_DIGEST_SIZE];\r
   UINT8               *DbxCertHash;\r
   UINTN               SiglistHeaderSize;\r
+  UINT8               *TBSCert;\r
+  UINTN               TBSCertSize;\r
 \r
   IsFound  = FALSE;\r
   DbxList  = SignatureList;\r
@@ -859,8 +861,16 @@ IsCertHashFoundInDatabase (
   HashCtx  = NULL;\r
   HashAlg  = HASHALG_MAX;\r
 \r
-  ASSERT (RevocationTime != NULL);\r
-  ASSERT (DbxList != NULL);\r
+  if ((RevocationTime == NULL) || (DbxList == NULL)) {\r
+    return FALSE;\r
+  }\r
+\r
+  //\r
+  // Retrieve the TBSCertificate from the X.509 Certificate.\r
+  //\r
+  if (!X509GetTBSCert (Certificate, CertSize, &TBSCert, &TBSCertSize)) {\r
+    return FALSE;\r
+  }\r
 \r
   while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {\r
     //\r
@@ -879,7 +889,7 @@ IsCertHashFoundInDatabase (
     }\r
 \r
     //\r
-    // Calculate the hash value of current db certificate for comparision.\r
+    // Calculate the hash value of current TBSCertificate for comparision.\r
     //\r
     if (mHash[HashAlg].GetContextSize == NULL) {\r
       goto Done;\r
@@ -893,7 +903,7 @@ IsCertHashFoundInDatabase (
     if (!Status) {\r
       goto Done;\r
     }\r
-    Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);\r
+    Status = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);\r
     if (!Status) {\r
       goto Done;\r
     }\r
@@ -1475,6 +1485,7 @@ DxeImageVerificationHandler (
   UINTN                                AuthDataSize;\r
   EFI_IMAGE_DATA_DIRECTORY             *SecDataDir;\r
   UINT32                               OffSet;\r
+  CHAR16                               *NameStr;\r
 \r
   SignatureList     = NULL;\r
   SignatureListSize = 0;\r
@@ -1778,7 +1789,12 @@ Done:
     //\r
     // Policy decides to defer or reject the image; add its information in image executable information table.\r
     //\r
-    AddImageExeInfo (Action, NULL, File, SignatureList, SignatureListSize);\r
+    NameStr = ConvertDevicePathToText (File, FALSE, TRUE);\r
+    AddImageExeInfo (Action, NameStr, File, SignatureList, SignatureListSize);\r
+    if (NameStr != NULL) {\r
+      DEBUG((EFI_D_INFO, "The image doesn't pass verification: %s\n", NameStr));\r
+      FreePool(NameStr);\r
+    }\r
     Status = EFI_SECURITY_VIOLATION;\r
   }\r
 \r