Initialize data and correct faulty logic in TcpComponentNameGetControllerName().

[mirror_edk2.git] / SecurityPkg / Library / DxeImageVerificationLib / DxeImageVerificationLib.c

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 3324dba0af862dfad49d2e8e6cc5d93054363208..959a9b062db3714fa13b244452a93a43cf3b821a 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -769,7 +769,7 @@ AddImageExeInfo (
   }\r
 \r
   DevicePathSize            = GetDevicePathSize (DevicePath);\r
-  NewImageExeInfoEntrySize  = sizeof (EFI_IMAGE_EXECUTION_INFO) + NameStringLen + DevicePathSize + SignatureSize;\r
+  NewImageExeInfoEntrySize  = sizeof (EFI_IMAGE_EXECUTION_INFO) - sizeof (EFI_SIGNATURE_LIST) + NameStringLen + DevicePathSize + SignatureSize;\r
   NewImageExeInfoTable      = (EFI_IMAGE_EXECUTION_INFO_TABLE *) AllocateRuntimePool (ImageExeInfoTableSize + NewImageExeInfoEntrySize);\r
   if (NewImageExeInfoTable == NULL) {\r
     return ;\r
@@ -841,7 +841,7 @@ IsCertHashFoundInDatabase (
   )\r
 {\r
   BOOLEAN             IsFound;\r
-  EFI_STATUS          Status;\r
+  BOOLEAN             Status;\r
   EFI_SIGNATURE_LIST  *DbxList;\r
   UINTN               DbxSize;\r
   EFI_SIGNATURE_DATA  *CertHash;\r
@@ -852,6 +852,8 @@ IsCertHashFoundInDatabase (
   UINT8               CertDigest[MAX_DIGEST_SIZE];\r
   UINT8               *DbxCertHash;\r
   UINTN               SiglistHeaderSize;\r
+  UINT8               *TBSCert;\r
+  UINTN               TBSCertSize;\r
 \r
   IsFound  = FALSE;\r
   DbxList  = SignatureList;\r
@@ -859,7 +861,16 @@ IsCertHashFoundInDatabase (
   HashCtx  = NULL;\r
   HashAlg  = HASHALG_MAX;\r
 \r
-  ASSERT (RevocationTime != NULL);\r
+  if ((RevocationTime == NULL) || (DbxList == NULL)) {\r
+    return FALSE;\r
+  }\r
+\r
+  //\r
+  // Retrieve the TBSCertificate from the X.509 Certificate.\r
+  //\r
+  if (!X509GetTBSCert (Certificate, CertSize, &TBSCert, &TBSCertSize)) {\r
+    return FALSE;\r
+  }\r
 \r
   while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {\r
     //\r
@@ -878,7 +889,7 @@ IsCertHashFoundInDatabase (
     }\r
 \r
     //\r
-    // Calculate the hash value of current db certificate for comparision.\r
+    // Calculate the hash value of current TBSCertificate for comparision.\r
     //\r
     if (mHash[HashAlg].GetContextSize == NULL) {\r
       goto Done;\r
@@ -892,7 +903,7 @@ IsCertHashFoundInDatabase (
     if (!Status) {\r
       goto Done;\r
     }\r
-    Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);\r
+    Status = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);\r
     if (!Status) {\r
       goto Done;\r
     }\r
@@ -1132,15 +1143,16 @@ PassTimestampCheck (
   //\r
   DbtDataSize = 0;\r
   Status   = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, NULL);\r
-  if (Status == EFI_BUFFER_TOO_SMALL) {\r
-    DbtData = (UINT8 *) AllocateZeroPool (DbtDataSize);\r
-    if (DbtData == NULL) {\r
-      goto Done;\r
-    }\r
-    Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, (VOID *) DbtData);\r
-    if (EFI_ERROR (Status)) {\r
-      goto Done;\r
-    }\r
+  if (Status != EFI_BUFFER_TOO_SMALL) {\r
+    goto Done;\r
+  }\r
+  DbtData = (UINT8 *) AllocateZeroPool (DbtDataSize);\r
+  if (DbtData == NULL) {\r
+    goto Done;\r
+  }\r
+  Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, (VOID *) DbtData);\r
+  if (EFI_ERROR (Status)) {\r
+    goto Done;\r
   }\r
 \r
   CertList = (EFI_SIGNATURE_LIST *) DbtData;\r
@@ -1229,14 +1241,15 @@ IsForbiddenByDbx (
   //\r
   DataSize = 0;\r
   Status   = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
-  if (Status == EFI_BUFFER_TOO_SMALL) {\r
-    Data = (UINT8 *) AllocateZeroPool (DataSize);\r
-    if (Data == NULL) {\r
-      return IsForbidden;\r
-    }\r
-\r
-    Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);\r
+  if (Status != EFI_BUFFER_TOO_SMALL) {\r
+    return IsForbidden;\r
+  }\r
+  Data = (UINT8 *) AllocateZeroPool (DataSize);\r
+  if (Data == NULL) {\r
+    return IsForbidden;\r
   }\r
+\r
+  Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);\r
   if (EFI_ERROR (Status)) {\r
     return IsForbidden;\r
   }\r
@@ -1254,7 +1267,7 @@ IsForbiddenByDbx (
   //       UINT8  Certn[];\r
   //\r
   Pkcs7GetSigners (AuthData, AuthDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);\r
-  if (BufferLength == 0) {\r
+  if ((BufferLength == 0) || (CertBuffer == NULL)) {\r
     IsForbidden = TRUE;\r
     goto Done;\r
   }\r
@@ -1472,6 +1485,7 @@ DxeImageVerificationHandler (
   UINTN                                AuthDataSize;\r
   EFI_IMAGE_DATA_DIRECTORY             *SecDataDir;\r
   UINT32                               OffSet;\r
+  CHAR16                               *NameStr;\r
 \r
   SignatureList     = NULL;\r
   SignatureListSize = 0;\r
@@ -1662,7 +1676,7 @@ DxeImageVerificationHandler (
   //\r
   for (OffSet = SecDataDir->VirtualAddress;\r
        OffSet < (SecDataDir->VirtualAddress + SecDataDir->Size);\r
-       OffSet += WinCertificate->dwLength, OffSet += ALIGN_SIZE (OffSet)) {\r
+       OffSet += (WinCertificate->dwLength + ALIGN_SIZE (WinCertificate->dwLength))) {\r
     WinCertificate = (WIN_CERTIFICATE *) (mImageBase + OffSet);\r
     if ((SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) <= sizeof (WIN_CERTIFICATE) ||\r
         (SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) < WinCertificate->dwLength) {\r
@@ -1775,7 +1789,12 @@ Done:
     //\r
     // Policy decides to defer or reject the image; add its information in image executable information table.\r
     //\r
-    AddImageExeInfo (Action, NULL, File, SignatureList, SignatureListSize);\r
+    NameStr = ConvertDevicePathToText (File, FALSE, TRUE);\r
+    AddImageExeInfo (Action, NameStr, File, SignatureList, SignatureListSize);\r
+    if (NameStr != NULL) {\r
+      DEBUG((EFI_D_INFO, "The image doesn't pass verification: %s\n", NameStr));\r
+      FreePool(NameStr);\r
+    }\r
     Status = EFI_SECURITY_VIOLATION;\r
   }\r
 \r