From b6f94dbeacfc6f0a507413096189304c58dbe66c Mon Sep 17 00:00:00 2001
From: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
Date: Wed, 13 Sep 2017 12:09:40 -0700
Subject: New upstream version 13~git1505328970.9c1c35c5

---
 Cryptlib/Pk/CryptPkcs7Verify.c | 68 +++++++++++++++++-------------------------
 1 file changed, 27 insertions(+), 41 deletions(-)

(limited to 'Cryptlib/Pk/CryptPkcs7Verify.c')

diff --git a/Cryptlib/Pk/CryptPkcs7Verify.c b/Cryptlib/Pk/CryptPkcs7Verify.c
index bf24e921..dcaba436 100644
--- a/Cryptlib/Pk/CryptPkcs7Verify.c
+++ b/Cryptlib/Pk/CryptPkcs7Verify.c
@@ -10,7 +10,7 @@
   WrapPkcs7Data(), Pkcs7GetSigners(), Pkcs7Verify() will get UEFI Authenticated
   Variable and will do basic check for data structure.
 
-Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -163,7 +163,6 @@ X509PopCertificate (
   STACK_OF(X509)  *CertStack;
   BOOLEAN         Status;
   INT32           Result;
-  BUF_MEM         *Ptr;
   INT32           Length;
   VOID            *Buffer;
 
@@ -193,8 +192,7 @@ X509PopCertificate (
     goto _Exit;
   }
 
-  BIO_get_mem_ptr (CertBio, &Ptr);
-  Length = (INT32)(Ptr->length);
+  Length = (INT32)(((BUF_MEM *) CertBio->ptr)->length);
   if (Length <= 0) {
     goto _Exit;
   }
@@ -465,15 +463,12 @@ Pkcs7GetCertificatesList (
   BOOLEAN          Wrapped;
   UINT8            Index;
   PKCS7            *Pkcs7;
-  X509_STORE_CTX   *CertCtx;
-  STACK_OF(X509)   *CtxChain;
-  STACK_OF(X509)   *CtxUntrusted;
-  X509             *CtxCert;
+  X509_STORE_CTX   CertCtx;
   STACK_OF(X509)   *Signers;
   X509             *Signer;
   X509             *Cert;
+  X509             *TempCert;
   X509             *Issuer;
-  X509_NAME        *IssuerName;
   UINT8            *CertBuf;
   UINT8            *OldBuf;
   UINTN            BufferSize;
@@ -487,11 +482,8 @@ Pkcs7GetCertificatesList (
   Status         = FALSE;
   NewP7Data      = NULL;
   Pkcs7          = NULL;
-  CertCtx        = NULL;
-  CtxChain       = NULL;
-  CtxCert        = NULL;
-  CtxUntrusted   = NULL;
   Cert           = NULL;
+  TempCert       = NULL;
   SingleCert     = NULL;
   CertBuf        = NULL;
   OldBuf         = NULL;
@@ -539,26 +531,19 @@ Pkcs7GetCertificatesList (
   }
   Signer = sk_X509_value (Signers, 0);
 
-  CertCtx = X509_STORE_CTX_new ();
-  if (CertCtx == NULL) {
-    goto _Error;
-  }
-  if (!X509_STORE_CTX_init (CertCtx, NULL, Signer, Pkcs7->d.sign->cert)) {
+  if (!X509_STORE_CTX_init (&CertCtx, NULL, Signer, Pkcs7->d.sign->cert)) {
     goto _Error;
   }
   //
   // Initialize Chained & Untrusted stack
   //
-  CtxChain = X509_STORE_CTX_get0_chain (CertCtx);
-  CtxCert  = X509_STORE_CTX_get0_cert (CertCtx);
-  if (CtxChain == NULL) {
-    if (((CtxChain = sk_X509_new_null ()) == NULL) ||
-        (!sk_X509_push (CtxChain, CtxCert))) {
+  if (CertCtx.chain == NULL) {
+    if (((CertCtx.chain = sk_X509_new_null ()) == NULL) ||
+        (!sk_X509_push (CertCtx.chain, CertCtx.cert))) {
       goto _Error;
     }
   }
-  CtxUntrusted = X509_STORE_CTX_get0_untrusted (CertCtx);
-  (VOID)sk_X509_delete_ptr (CtxUntrusted, Signer);
+  (VOID)sk_X509_delete_ptr (CertCtx.untrusted, Signer);
 
   //
   // Build certificates stack chained from Signer's certificate.
@@ -568,25 +553,27 @@ Pkcs7GetCertificatesList (
     //
     // Self-Issue checking
     //
-    Issuer = NULL;
-    if (X509_STORE_CTX_get1_issuer (&Issuer, CertCtx, Cert) == 1) {
-      if (X509_cmp (Issuer, Cert) == 0) {
-        break;
-      }
+    if (CertCtx.check_issued (&CertCtx, Cert, Cert)) {
+      break;
     }
 
     //
     // Found the issuer of the current certificate
     //
-    if (CtxUntrusted != NULL) {
+    if (CertCtx.untrusted != NULL) {
       Issuer = NULL;
-      IssuerName = X509_get_issuer_name (Cert);
-      Issuer     = X509_find_by_subject (CtxUntrusted, IssuerName);
+      for (Index = 0; Index < sk_X509_num (CertCtx.untrusted); Index++) {
+        TempCert = sk_X509_value (CertCtx.untrusted, Index);
+        if (CertCtx.check_issued (&CertCtx, Cert, TempCert)) {
+          Issuer = TempCert;
+          break;
+        }
+      }
       if (Issuer != NULL) {
-        if (!sk_X509_push (CtxChain, Issuer)) {
+        if (!sk_X509_push (CertCtx.chain, Issuer)) {
           goto _Error;
         }
-        (VOID)sk_X509_delete_ptr (CtxUntrusted, Issuer);
+        (VOID)sk_X509_delete_ptr (CertCtx.untrusted, Issuer);
 
         Cert = Issuer;
         continue;
@@ -608,13 +595,13 @@ Pkcs7GetCertificatesList (
   //      UINT8  Certn[];
   //
 
-  if (CtxChain != NULL) {
+  if (CertCtx.chain != NULL) {
     BufferSize = sizeof (UINT8);
     OldSize    = BufferSize;
     CertBuf    = NULL;
 
     for (Index = 0; ; Index++) {
-      Status = X509PopCertificate (CtxChain, &SingleCert, &CertSize);
+      Status = X509PopCertificate (CertCtx.chain, &SingleCert, &CertSize);
       if (!Status) {
         break;
       }
@@ -652,13 +639,13 @@ Pkcs7GetCertificatesList (
     }
   }
 
-  if (CtxUntrusted != NULL) {
+  if (CertCtx.untrusted != NULL) {
     BufferSize = sizeof (UINT8);
     OldSize    = BufferSize;
     CertBuf    = NULL;
 
     for (Index = 0; ; Index++) {
-      Status = X509PopCertificate (CtxUntrusted, &SingleCert, &CertSize);
+      Status = X509PopCertificate (CertCtx.untrusted, &SingleCert, &CertSize);
       if (!Status) {
         break;
       }
@@ -711,8 +698,7 @@ _Error:
   }
   sk_X509_free (Signers);
 
-  X509_STORE_CTX_cleanup (CertCtx);
-  X509_STORE_CTX_free (CertCtx);
+  X509_STORE_CTX_cleanup (&CertCtx);
 
   if (SingleCert != NULL) {
     free (SingleCert);
-- 
cgit v1.2.3