CryptoPkg/BaseCryptLib: Eliminate extra buffer copy in Pkcs7Verify()

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3617

Create a read-only openSSL BIO wrapper for the existing input
buffer passed to Pkcs7Verify() instead of copying the buffer
into an empty writable BIO which causes memory allocations
within openSSL.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Bob Morgan <bobm@nvidia.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
index d99597d1810ed7558b309c14487c88cba2f59da0..8eda98f7b289f9c35329a698defc2db0f31a70a7 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
@@ -864,15 +864,11 @@ Pkcs7Verify (
   // For generic PKCS#7 handling, InData may be NULL if the content is present\r
   // in PKCS#7 structure. So ignore NULL checking here.\r
   //\r
-  DataBio = BIO_new (BIO_s_mem ());\r
+  DataBio = BIO_new_mem_buf (InData, (int) DataLength);\r
   if (DataBio == NULL) {\r
     goto _Exit;\r
   }\r
 \r
-  if (BIO_write (DataBio, InData, (int) DataLength) <= 0) {\r
-    goto _Exit;\r
-  }\r
-\r
   //\r
   // Allow partial certificate chains, terminated by a non-self-signed but\r
   // still trusted intermediate certificate. Also disable time checks.\r