Correct the Hash Calculation for Revoked X.509 Certificate to align with RFC3280...

[mirror_edk2.git] / SecurityPkg / Library / DxeImageVerificationLib / DxeImageVerificationLib.c

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 2475f35c85f544342d3b7610dc4abd07dcb3ef83..959a9b062db3714fa13b244452a93a43cf3b821a 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -852,6 +852,8 @@ IsCertHashFoundInDatabase (
   UINT8               CertDigest[MAX_DIGEST_SIZE];\r
   UINT8               *DbxCertHash;\r
   UINTN               SiglistHeaderSize;\r
+  UINT8               *TBSCert;\r
+  UINTN               TBSCertSize;\r
 \r
   IsFound  = FALSE;\r
   DbxList  = SignatureList;\r
@@ -859,8 +861,16 @@ IsCertHashFoundInDatabase (
   HashCtx  = NULL;\r
   HashAlg  = HASHALG_MAX;\r
 \r
-  ASSERT (RevocationTime != NULL);\r
-  ASSERT (DbxList != NULL);\r
+  if ((RevocationTime == NULL) || (DbxList == NULL)) {\r
+    return FALSE;\r
+  }\r
+\r
+  //\r
+  // Retrieve the TBSCertificate from the X.509 Certificate.\r
+  //\r
+  if (!X509GetTBSCert (Certificate, CertSize, &TBSCert, &TBSCertSize)) {\r
+    return FALSE;\r
+  }\r
 \r
   while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {\r
     //\r
@@ -879,7 +889,7 @@ IsCertHashFoundInDatabase (
     }\r
 \r
     //\r
-    // Calculate the hash value of current db certificate for comparision.\r
+    // Calculate the hash value of current TBSCertificate for comparision.\r
     //\r
     if (mHash[HashAlg].GetContextSize == NULL) {\r
       goto Done;\r
@@ -893,7 +903,7 @@ IsCertHashFoundInDatabase (
     if (!Status) {\r
       goto Done;\r
     }\r
-    Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);\r
+    Status = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);\r
     if (!Status) {\r
       goto Done;\r
     }\r