efi_loader: signature: fix a size check against revocation list

Since the size check against an entry in efi_search_siglist() is
incorrect, this function will never find out a to-be-matched certificate
and its associated revocation time in the signature list.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>

diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c
index e05c471c61cee4fddf36aa17966939571fff07cc..cd2df462649077dcb7022b3f79daeebe7ab3ec52 100644 (file)
--- a/lib/efi_loader/efi_signature.c
+++ b/lib/efi_loader/efi_signature.c
@@ -433,10 +433,11 @@ static bool efi_search_siglist(struct x509_certificate *cert,
                 *      time64_t revocation_time;
                 * };
                 */
-               if ((sig_data->size == SHA256_SUM_LEN) &&
-                   !memcmp(sig_data->data, hash, SHA256_SUM_LEN)) {
+               if ((sig_data->size >= SHA256_SUM_LEN + sizeof(time64_t)) &&
+                   !memcmp(sig_data->data, msg, SHA256_SUM_LEN)) {
                        memcpy(revoc_time, sig_data->data + SHA256_SUM_LEN,
                               sizeof(*revoc_time));
+                       EFI_PRINT("revocation time: 0x%llx\n", *revoc_time);
                        found = true;
                        goto out;
                }