CryptoPkg: Wrapper files updates to support openssl-1.0.2c

This patch updates some support header and wrapper files to support
openssl-1.0.2c build, and correct some openssl API usages and
boundary check.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qin Long <qin.long@intel.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17635 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/CryptoPkg/Include/OpenSslSupport.h b/CryptoPkg/Include/OpenSslSupport.h
index ed889e91c7cc7aaee2cf608f4951d810bff103e0..b5a8b58148ccafe9269445de8e07d061645db8bd 100644 (file)
--- a/CryptoPkg/Include/OpenSslSupport.h
+++ b/CryptoPkg/Include/OpenSslSupport.h
@@ -1,7 +1,7 @@
 /** @file\r
   Root include file to support building OpenSSL Crypto Library.\r
 \r
-Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -109,6 +109,11 @@ struct tm {
   char  *tm_zone;   /* timezone abbreviation */\r
 };\r
 \r
+struct timeval {\r
+  long tv_sec;      /* time value, in seconds */\r
+  long tv_usec;     /* time value, in microseconds */\r
+} timeval;\r
+\r
 struct dirent {\r
   UINT32  d_fileno;         /* file number of entry */\r
   UINT16  d_reclen;         /* length of this record */\r
@@ -240,5 +245,6 @@ extern FILE  *stdout;
 #define assert(expression)\r
 #define localtime(timer)                  NULL\r
 #define gmtime_r(timer,result)            (result = NULL)\r
+#define atoi(nptr)                        AsciiStrDecimalToUintn(nptr)\r
 \r
 #endif\r

diff --git a/CryptoPkg/Include/memory.h b/CryptoPkg/Include/memory.h
new file mode 100644 (file)
index 0000000..092b3cd
--- /dev/null
+++ b/CryptoPkg/Include/memory.h
@@ -0,0 +1,16 @@
+/** @file\r
+  Include file to support building OpenSSL Crypto Library.\r
+\r
+Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
+This program and the accompanying materials\r
+are licensed and made available under the terms and conditions of the BSD License\r
+which accompanies this distribution.  The full text of the license may be found at\r
+http://opensource.org/licenses/bsd-license.php\r
+\r
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+\r
+**/\r
+\r
+#include <OpenSslSupport.h>\r
+\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
index 4ce2b06b161c6d85341a89bf63567a006750e2c7..9e933558e65bb66f4b54ced5d9c139877fe4e6d9 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
@@ -9,7 +9,7 @@
   AuthenticodeVerify() will get PE/COFF Authenticode and will do basic check for\r
   data structure.\r
 \r
-Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2011 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -72,6 +72,7 @@ AuthenticodeVerify (
 {\r
   BOOLEAN      Status;\r
   PKCS7        *Pkcs7;\r
+  CONST UINT8  *Temp;\r
   CONST UINT8  *OrigAuthData;\r
   UINT8        *SpcIndirectDataContent;\r
   UINT8        Asn1Byte;\r
@@ -96,7 +97,8 @@ AuthenticodeVerify (
   //\r
   // Retrieve & Parse PKCS#7 Data (DER encoding) from Authenticode Signature\r
   //\r
-  Pkcs7 = d2i_PKCS7 (NULL, &AuthData, (int)DataSize);\r
+  Temp  = AuthData;\r
+  Pkcs7 = d2i_PKCS7 (NULL, &Temp, (int)DataSize);\r
   if (Pkcs7 == NULL) {\r
     goto _Exit;\r
   }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
index 63fe78fc8655514a747db6321b6cb1d8583002d5..704eb4ec94003b54f7ff2536fc918ebf72b8177e 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
@@ -1,7 +1,7 @@
 /** @file\r
   PKCS#7 SignedData Sign Wrapper Implementation over OpenSSL.\r
 \r
-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -116,9 +116,9 @@ Pkcs7Sign (
   if (Key == NULL) {\r
     goto _Exit;\r
   }\r
-  Key->save_type = EVP_PKEY_RSA;\r
-  Key->type      = EVP_PKEY_type (EVP_PKEY_RSA);\r
-  Key->pkey.rsa  = (RSA *) RsaContext;\r
+  if (EVP_PKEY_assign_RSA (Key, (RSA *) RsaContext) == 0) {\r
+    goto _Exit;\r
+  }\r
 \r
   //\r
   // Convert the data to be signed to BIO format. \r
@@ -175,7 +175,7 @@ Pkcs7Sign (
   }\r
 \r
   CopyMem (*SignedData, P7Data + 19, *SignedDataSize);\r
-  \r
+\r
   OPENSSL_free (P7Data);\r
 \r
   Status = TRUE;\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
index a9665d50473f544d464918eb170ed28557eb2943..a1bab8a0ce56ed3f908ce1da767121e094d5c6c9 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
@@ -10,7 +10,7 @@
   WrapPkcs7Data(), Pkcs7GetSigners(), Pkcs7Verify() will get UEFI Authenticated\r
   Variable and will do basic check for data structure.\r
 \r
-Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -273,7 +273,7 @@ X509PopCertificate (
     goto _Exit;\r
   }\r
 \r
-  Length = ((BUF_MEM *) CertBio->ptr)->length;\r
+  Length = (INT32)(((BUF_MEM *) CertBio->ptr)->length);\r
   if (Length <= 0) {\r
     goto _Exit;\r
   }\r
@@ -343,7 +343,7 @@ Pkcs7GetSigners (
   PKCS7            *Pkcs7;\r
   BOOLEAN          Status;\r
   UINT8            *SignedData;\r
-  UINT8            *Temp;\r
+  CONST UINT8      *Temp;\r
   UINTN            SignedDataSize;\r
   BOOLEAN          Wrapped;\r
   STACK_OF(X509)   *Stack;\r
@@ -549,7 +549,7 @@ Pkcs7Verify (
   X509        *Cert;\r
   X509_STORE  *CertStore;\r
   UINT8       *SignedData;\r
-  UINT8       *Temp;\r
+  CONST UINT8 *Temp;\r
   UINTN       SignedDataSize;\r
   BOOLEAN     Wrapped;\r
 \r
@@ -618,7 +618,8 @@ Pkcs7Verify (
   //\r
   // Read DER-encoded root certificate and Construct X509 Certificate\r
   //\r
-  Cert = d2i_X509 (NULL, &TrustedCert, (long) CertLength);\r
+  Temp = TrustedCert;\r
+  Cert = d2i_X509 (NULL, &Temp, (long) CertLength);\r
   if (Cert == NULL) {\r
     goto _Exit;\r
   }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
index e4b5a8497fdefc5debe3c7ab0beb2e5f0ca1d020..7d269b04588f6d193ce1193f7ffd15d03f4c2f47 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
@@ -5,7 +5,7 @@
   the lifetime of the signature when a signing certificate expires or is later\r
   revoked.\r
 \r
-Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2014 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -441,11 +441,12 @@ TimestampTokenVerify (
   CONST UINT8  *TokenTemp;\r
   PKCS7        *Pkcs7;\r
   X509         *Cert;\r
+  CONST UINT8  *CertTemp;\r
   X509_STORE   *CertStore;\r
   BIO          *OutBio;\r
   UINT8        *TstData;\r
   UINTN        TstSize;\r
-  UINT8        *TstTemp;\r
+  CONST UINT8  *TstTemp;\r
   TS_TST_INFO  *TstInfo;\r
 \r
   Status = FALSE;\r
@@ -490,7 +491,8 @@ TimestampTokenVerify (
   //\r
   // Read the trusted TSA certificate (DER-encoded), and Construct X509 Certificate.\r
   //\r
-  Cert = d2i_X509 (NULL, &TsaCert, (long) CertSize);\r
+  CertTemp = TsaCert;\r
+  Cert = d2i_X509 (NULL, &CertTemp, (long) CertSize);\r
   if (Cert == NULL) {\r
     goto _Exit;\r
   }\r
@@ -605,6 +607,7 @@ ImageTimestampVerify (
 {\r
   BOOLEAN                      Status;\r
   PKCS7                        *Pkcs7;\r
+  CONST UINT8                  *Temp;\r
   STACK_OF(PKCS7_SIGNER_INFO)  *SignerInfos;\r
   PKCS7_SIGNER_INFO            *SignInfo;\r
   UINTN                        Index;\r
@@ -644,7 +647,8 @@ ImageTimestampVerify (
   //\r
   // Decode ASN.1-encoded Authenticode data into PKCS7 structure.\r
   //\r
-  Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **) &AuthData, (int) DataSize);\r
+  Temp  = AuthData;\r
+  Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **) &Temp, (int) DataSize);\r
   if (Pkcs7 == NULL) {\r
     goto _Exit;\r
   }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
index 29efc42b021a60782f54dfd53572f0ef977241fc..02851d5701498537e0e4a5c1877756ba1b1e2b1b 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
@@ -1,7 +1,7 @@
 /** @file\r
   X.509 Certificate Handler Wrapper Implementation over OpenSSL.\r
 \r
-Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -38,7 +38,8 @@ X509ConstructCertificate (
   OUT  UINT8        **SingleX509Cert\r
   )\r
 {\r
-  X509     *X509Cert;\r
+  X509         *X509Cert;\r
+  CONST UINT8  *Temp;\r
 \r
   //\r
   // Check input parameters.\r
@@ -50,7 +51,8 @@ X509ConstructCertificate (
   //\r
   // Read DER-encoded X509 Certificate and Construct X509 object.\r
   //\r
-  X509Cert = d2i_X509 (NULL, &Cert, (long) CertSize);\r
+  Temp     = Cert;\r
+  X509Cert = d2i_X509 (NULL, &Temp, (long) CertSize);\r
   if (X509Cert == NULL) {\r
     return FALSE;\r
   }\r
@@ -123,6 +125,9 @@ X509ConstructCertificateStack (
     }\r
 \r
     CertSize = VA_ARG (Args, UINTN);\r
+    if (CertSize == 0) {\r
+      break;\r
+    }\r
 \r
     //\r
     // Construct X509 Object from the given DER-encoded certificate data.\r
@@ -133,7 +138,9 @@ X509ConstructCertificateStack (
                (UINT8 **) &X509Cert\r
                );\r
     if (!Status) {\r
-      X509_free (X509Cert);\r
+      if (X509Cert != NULL) {\r
+        X509_free (X509Cert);\r
+      }\r
       break;\r
     }\r
 \r
@@ -518,7 +525,8 @@ X509GetTBSCert (
   //\r
   // Check input parameters.\r
   //\r
-  if ((Cert == NULL) || (TBSCert == NULL) || (TBSCertSize == NULL)) {\r
+  if ((Cert == NULL) || (TBSCert == NULL) ||\r
+      (TBSCertSize == NULL) || (CertSize > INT_MAX)) {\r
     return FALSE;\r
   }\r
 \r