proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-08-03 15:27:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't call AuthenticodeVerify if vendor_cert_size is 0.

Browse Source 
Actually check the size of our vendor cert quite early, so that there's
no confusion as to what's going on.

This isn't strictly necessary, in that in all cases if vendor_cert_size
is 0, then AuthenticodeVerify -> Pkcs7Verify() -> d2i_X509() will result
in a NULL "Cert", and it will return FALSE, and we'll reject the
signature, but better to avoid all that code in the first place.  Belt
and suspenders and whatnot.

Based on a patch from https://github.com/TBOpen .

Signed-off-by: Peter Jones <pjones@redhat.com>
This commit is contained in:
Peter Jones 2014-09-19 11:48:56 -04:00
parent f04d50b747
commit 3d1cdbc4e3
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
shim.c
View File

@ -923,14 +923,13 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
return status;
}
/*
* And finally, check against shim's built-in key
*/
if (AuthenticodeVerify(cert->CertData,
context->SecDir->Size - sizeof(cert->Hdr),
vendor_cert, vendor_cert_size, sha256hash,
SHA256_DIGEST_SIZE)) {
if (vendor_cert_size && AuthenticodeVerify(cert->CertData,
context->SecDir->Size - sizeof(cert->Hdr),
vendor_cert, vendor_cert_size, sha256hash,
SHA256_DIGEST_SIZE)) {
status = EFI_SUCCESS;
return status;
}