--- Begin Message ---
Package: pesign
Version: 0.112-4
Severity: important
Tags: upstream patch
I'm wanting to use efisiglist to generate a dbx list in our shim
package at build time. Unfortunately, I've just found (after a lot of
debugging) that efisiglist gets things wrong and produces malformed
output. I've fixed it - see attached patch.
About to push this upstream too, but adding a bug here to help track
things.
-- System Information:
Debian Release: buster/sid
APT prefers testing
APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages pesign depends on:
ii coolkey 1.1.0-13+b1
ii libc6 2.28-8
ii libefivar1 37-2
ii libnspr4 2:4.20-1
ii libnss3 2:3.42.1-1
ii libnss3-tools 2:3.42.1-1
ii libpopt0 1.16-12
ii libuuid1 2.33.1-0.1
ii opensc 0.19.0-1
pesign recommends no packages.
pesign suggests no packages.
-- no debconf information
Description: Fix bugs in efisiglist
* Fix handling of structure sizes in a couple of places, so that memory
copies etc. work properly.
* In signature_list_realize(), don't simply copy the *sl struct over
the *esl struct - they're *not* exactly the same! Copy fields by
hand.
Author: Steve McIntyre <93sam@debian.org>
---
--- pesign-0.112.orig/src/siglist.c
+++ pesign-0.112/src/siglist.c
@@ -77,12 +77,14 @@ static struct sig_type sig_types[] = {
};
static int num_sig_types = sizeof (sig_types) / sizeof (struct sig_type);
+/* How much space does a signature list entry take? Count the space
+ * for the GUID, then the signature/cert itself. */
static int32_t
get_sig_type_size(const efi_guid_t *sig_type)
{
for (int i = 0; i < num_sig_types; i++) {
if (!memcmp(sig_type, sig_types[i].type, sizeof (*sig_type)))
- return sig_types[i].size;
+ return sig_types[i].size + sizeof(efi_guid_t);
}
return -1;
}
@@ -99,7 +101,7 @@ signature_list_new(const efi_guid_t *Sig
return NULL;
sl->SignatureType = SignatureType;
- sl->SignatureSize = size + sizeof (efi_guid_t);
+ sl->SignatureSize = size;
sl->SignatureListSize = sizeof (struct efi_signature_list);
return sl;
@@ -137,11 +139,21 @@ signature_list_add_sig(signature_list *s
sl->realized = NULL;
}
+ /* The sigsize passed in by the caller is just enough for
+ * their object (hash or cert). But sl->SignatureSize includes
+ * the size of the GUID before the hash/cert itself, so
+ * account for that too here. */
+ sigsize += sizeof (efi_guid_t);
+
+ /* If we're adding an x509 cert onto the end of a list of
+ * hashes, we will need to resize the list entries to cope */
if (!efi_guid_cmp(sl->SignatureType, &efi_guid_x509_cert)) {
if (sigsize > sl->SignatureSize)
- resize_entries(sl, sigsize + sizeof (efi_guid_t));
+ resize_entries(sl, sigsize);
} else if (sigsize !=
(unsigned long long)get_sig_type_size(sl->SignatureType)) {
+
+ /* size mismatch - error out */
char *guidname = NULL;
int rc = efi_guid_to_id_guid(sl->SignatureType, &guidname);
if (rc < 0) {
@@ -217,7 +229,10 @@ signature_list_realize(signature_list *s
return -1;
esl = ret;
- memcpy(esl, sl, sizeof (*esl));
+ memcpy(&esl->SignatureType, sl->SignatureType, sizeof *sl->SignatureType);
+ esl->SignatureListSize = sl->SignatureListSize;
+ esl->SignatureHeaderSize = 0;
+ esl->SignatureSize = sl->SignatureSize;
uint8_t *pos = ret + sizeof (*esl);
for (int i = 0; i < count; i++) {
--- End Message ---
--- Begin Message ---
Source: pesign
Source-Version: 0.112-5
We believe that the bug you reported is fixed in the latest version of
pesign, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 928491@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Steve McIntyre <93sam@debian.org> (supplier of updated pesign package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 05 May 2019 21:22:21 +0100
Source: pesign
Architecture: source
Version: 0.112-5
Distribution: unstable
Urgency: high
Maintainer: Debian UEFI maintainers <debian-efi@lists.debian.org>
Changed-By: Steve McIntyre <93sam@debian.org>
Closes: 928491
Changes:
pesign (0.112-5) unstable; urgency=high
.
* Move git repo from alioth to salsa.d.o
* efisiglist: Copy the header correctly (Closes: #928491)
* Update obsolete Build-Depends (remove dh-systemd, update debhelper)
Checksums-Sha1:
1e129ab3481c000e70a514ee27777a5285e2f72e 2178 pesign_0.112-5.dsc
e4fea042783a644d9dba6ed32429700e99bbfc30 11308 pesign_0.112-5.debian.tar.xz
d8136c1ef676270c24ce991bab3980d9a0df8b5b 5632 pesign_0.112-5_source.buildinfo
Checksums-Sha256:
5f6d164c58de364d282757017766a4b8319b08dadb8723843f3c1cd5b51e1d5f 2178 pesign_0.112-5.dsc
ee3bf56bf39d506b17d07ccbdfb8fe668d7ab832f251a908e9ebb1578e7ff2c0 11308 pesign_0.112-5.debian.tar.xz
3bd0a0bbc614576a6412e15938e5d51f3d8fb065dcc3f935c16ca56c6a376e31 5632 pesign_0.112-5_source.buildinfo
Files:
862537bf9acbcb6ab93b27ea422ba99d 2178 devel optional pesign_0.112-5.dsc
a21d0922eb6796869a62536b8fa5cb88 11308 devel optional pesign_0.112-5.debian.tar.xz
7e8dec98c67e7f33c564ecc3c1bbac7c 5632 devel optional pesign_0.112-5_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCAAvFiEEzrtSMB1hfpEDkP4WWHl5VzRCaE4FAlzPcC8RHDkzc2FtQGRl
Ymlhbi5vcmcACgkQWHl5VzRCaE7k4xAAtdrBEBzueAygMrGBYue14cBjOKV51nfL
LiqcCbtZt+etY02Nsm3aRd1c4OQaLgluOP+TV10BAlayQCZeQPng0Fx2ZW78piaC
bs4Osu1uHGyrcTAz12ec8L/hfRMX59huvVoMn4J7NxON72sqoVuxsKnaDS7+JdL3
uF6549koBfjujUS3eVFtdDFq6l2FM6LTnUja2TQCoG6K7a4tz7pysyRlBPPgLcOE
5mnMz2MK2IeAfSEdCjtsH2GMZFdJudbUe/N/fV2CCbeQJy99pu7uv65Exp3jeOeh
PQNa7Codlo9mDbBOQ5pkV1xxsyFR26qE3a36nYMGYx2CqafOkEYEIokhv7daDSbv
QcVuXatxNnY507nStOSX8lE9/hnnkJ7TnIRFL7qqWnLDamvwscjdyiAJnPWFJG08
FvC9d0kmTCQLIiBPmFpK9Q3lleoecf4AHZY2EvdbvlstAr9scnblgEfLTjY/8Mzp
7PUM5AcYhZICaMudX7uRtLmYIh7eElCkVCmQPLZ9QfXWJFd8qE3iG2CZ9AliqUtq
3YUoMTi7tC0rHYl3psjW4FaCU2i6TSvZu8lgRp2IxOLctruSIMvCdovi2KOLxeb5
MaroqJecZvZNijbLMj2OYumw6XZZEw/98+AO1GmNPZmhJZ0hBtAU3hgLDqDMUmc3
dZRNRcHFzRU=
=Qsya
-----END PGP SIGNATURE-----
--- End Message ---