Correct the Hash Calculation for Revoked X.509 Certificate to align with RFC3280 and UEFI 2.4 Spec.

This patch added one new X509GetTBSCert() interface in BaseCryptLib to retrieve the TBSCertificate, 
and also corrected the hash calculation for revoked certificate to aligned the RFC3280 and UEFI 2.4 spec.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Long, Qin" <qin.long@intel.com>
Reviewed-by: "Dong, Guo" <guo.dong@initel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16559 6f19259b-4bc3-4df7-8a09-765794883524

1 files changed, 14 insertions, 4 deletions

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 2475f35c85..959a9b062d 100644
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -852,6 +852,8 @@ IsCertHashFoundInDatabase (
   UINT8               CertDigest[MAX_DIGEST_SIZE];

   UINT8               *DbxCertHash;

   UINTN               SiglistHeaderSize;

+  UINT8               *TBSCert;

+  UINTN               TBSCertSize;

 

   IsFound  = FALSE;

   DbxList  = SignatureList;

@@ -859,8 +861,16 @@ IsCertHashFoundInDatabase (
   HashCtx  = NULL;

   HashAlg  = HASHALG_MAX;

 

-  ASSERT (RevocationTime != NULL);

-  ASSERT (DbxList != NULL);

+  if ((RevocationTime == NULL) || (DbxList == NULL)) {

+    return FALSE;

+  }

+

+  //

+  // Retrieve the TBSCertificate from the X.509 Certificate.

+  //

+  if (!X509GetTBSCert (Certificate, CertSize, &TBSCert, &TBSCertSize)) {

+    return FALSE;

+  }

 

   while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {

     //

@@ -879,7 +889,7 @@ IsCertHashFoundInDatabase (
     }

 

     //

-    // Calculate the hash value of current db certificate for comparision.

+    // Calculate the hash value of current TBSCertificate for comparision.

     //

     if (mHash[HashAlg].GetContextSize == NULL) {

       goto Done;

@@ -893,7 +903,7 @@ IsCertHashFoundInDatabase (
     if (!Status) {

       goto Done;

     }

-    Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);

+    Status = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);

     if (!Status) {

       goto Done;

     }