On Thu, Jul 16, 2020 at 11:39:36AM +0000, REITHER Robert - Contractor wrote:

Hi,

I think I have found a bug in lib/efi_loader/efi_signature.c

efi_verify_certificate()

•                                         cert = x509_cert_parse(sig_data->data, sig_data->size);
  

•                                         if (!cert) {
  

•                                                        EFI_PRINT("Cannot parse x509 certificate\n");
  

•                                                        continue;
  

•                                         }
  
  
  

x509_cert_parse() not only returns a pointer, but also embed a linux error_code, so if an error happens there, the (!cert) check will fail!

I suggest using:

•                                          if (!cert) {
  

•                                        if (IS_ERR(cert)) {
  

That's correct. Can you post a fix patch, please?

# There was the same problem with pkcs7_parse_message(), # and I have fixed it before.

Thanks, -Takahiro Akashi

Regards Robert