Daniel Axtens 1f4d12cf70 secvar/pkcs7: fix a wrong sizeof() ...

This code isn't directly used by skiboot, but it is wrong and potentially
insecure so I'm fixing it in case it's used in the future.

We pass sizeof(hash) into mbedtls_pk_verify(). However, hash is a pointer,
not an array, so rather than passing the length of the hash to verify we'll
pass in 8, and only compare the first 8 bytes of the hash rather than all 32.

Pass in 0 instead. That tells mbedtls to work out the length based on the
hash type. We allocated enough memory for whatever hash type the PKCS#7
message declared so this will be safe.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Cédric Le Goater <clg@kaod.org>

2021-12-09 11:09:02 +01:00

..

mbedtls

crypto: add out-of-tree mbedtls pkcs7 parser

2020-10-01 13:44:07 +10:00

pkcs7

secvar/pkcs7: fix a wrong sizeof()

2021-12-09 11:09:02 +01:00

Makefile.inc

secvar: Clean up makefiles and fix out of tree builds

2020-10-01 23:29:48 +10:00

mbedtls-config.h

secvar/test: use mbedtls cflags when building the test binaries

2020-10-02 12:02:50 +10:00