commit 4ec835579509200b77864cec72a5f7324bfa491d
author Demi Marie Obenour <demiobenour@gmail.com> Mon Nov 28 00:23:00 2022 -0500
committer Dave Rodgman <dave.rodgman@arm.com> Fri Feb 10 12:56:10 2023 +0000
tree d943bbf544424be56d23c597cc1841ded714fd02
parent aaf3c0028d33262c2707f84ba228d0080eae7396

Check for junk after SignedData

There must not be any.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

library/pkcs7.c

diff --git a/library/pkcs7.c b/library/pkcs7.c
index 398c0c8..5d470dc 100644
--- a/library/pkcs7.c
+++ b/library/pkcs7.c
@@ -457,7 +457,7 @@
 {
     unsigned char *p = buf;
     unsigned char *end = buf + buflen;
-    unsigned char *end_set, *end_content_info;
+    unsigned char *end_content_info;
     size_t len = 0;
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_md_type_t md_alg;
@@ -468,16 +468,19 @@
         return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_FORMAT, ret);
     }
 
-    end_set = p + len;
+    if (p + len != end) {
+        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_FORMAT,
+                                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
+    }
 
     /* Get version of signed data */
-    ret = pkcs7_get_version(&p, end_set, &signed_data->version);
+    ret = pkcs7_get_version(&p, end, &signed_data->version);
     if (ret != 0) {
         return ret;
     }
 
     /* Get digest algorithm */
-    ret = pkcs7_get_digest_algorithm_set(&p, end_set,
+    ret = pkcs7_get_digest_algorithm_set(&p, end,
                                          &signed_data->digest_alg_identifiers);
     if (ret != 0) {
         return ret;
@@ -518,7 +521,7 @@
 
     /* Look for certificates, there may or may not be any */
     mbedtls_x509_crt_init(&signed_data->certs);
-    ret = pkcs7_get_certificates(&p, end_set, &signed_data->certs);
+    ret = pkcs7_get_certificates(&p, end, &signed_data->certs);
     if (ret < 0) {
         return ret;
     }
@@ -534,7 +537,7 @@
     signed_data->no_of_crls = 0;
 
     /* Get signers info */
-    ret = pkcs7_get_signers_info_set(&p, end_set, &signed_data->signers);
+    ret = pkcs7_get_signers_info_set(&p, end, &signed_data->signers);
     if (ret < 0) {
         return ret;
     }
@@ -553,7 +556,7 @@
                             const size_t buflen)
 {
     unsigned char *p;
-    unsigned char *end, *end_content_info;
+    unsigned char *end;
     size_t len = 0;
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;