efi_loader: add missing validation of timestamp

The UEFI specification requires that when UEFI variables are set using time
based authentication we have to check that unused fields of the timestamp
are zero

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

diff --git a/lib/efi_loader/efi_variable.c b/lib/efi_loader/efi_variable.c
index 74a9c65402a889925e4478f61129d3f8ba985eff..f9a0efd427c77d4c39ec16786ef463fd7cf60d4a 100644 (file)
--- a/lib/efi_loader/efi_variable.c
+++ b/lib/efi_loader/efi_variable.c
@@ -481,11 +481,15 @@ static efi_status_t efi_variable_authenticate(u16 *variable,
        if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
                goto err;
 
+       memcpy(&timestamp, &auth->time_stamp, sizeof(timestamp));
+       if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone ||
+           timestamp.daylight || timestamp.pad2)
+               goto err;
+
        *data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
        *data_size -= (sizeof(auth->time_stamp)
                                + auth->auth_info.hdr.dwLength);
 
-       memcpy(&timestamp, &auth->time_stamp, sizeof(timestamp));
        memset(&tm, 0, sizeof(tm));
        tm.tm_year = timestamp.year;
        tm.tm_mon = timestamp.month;