nerd/rufus
1
1
Fork 0
mirror of https://github.com/pbatard/rufus.git synced 2024-08-14 23:57:05 +00:00
Code Issues 1 Projects Releases Wiki Activity

[pki] clear buffer on invalid signature

Browse source 
* Avoid keeping potentially nasty stuff in memory for too long...
This commit is contained in:
Pete Batard 2018-08-20 08:12:28 +01:00
parent 8920d5222d
commit efcdbe30e5
2 changed files with 13 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/pki.c
View file

@ -690,21 +690,21 @@ BOOL ValidateOpensslSignature(BYTE* pbBuffer, DWORD dwBufferLen, BYTE* pbSignatu
// Import our RSA public key so that the MS API can use it // Import our RSA public key so that the MS API can use it
r = CryptImportKey(hProv, (BYTE*)&pbMyPubKey.BlobHeader, dwMyPubKeyLen, 0, 0, &hPubKey); r = CryptImportKey(hProv, (BYTE*)&pbMyPubKey.BlobHeader, dwMyPubKeyLen, 0, 0, &hPubKey);
if (!r) { if (!r) {
uprintf("Could not import public key: %s", WinPKIErrorString()); uprintf("PKI: Could not import public key: %s", WinPKIErrorString());
goto out; goto out;
} }
// Create the hash object. // Create the hash object.
r = CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash); r = CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash);
if (!r) { if (!r) {
uprintf("Could not create empty hash: %s", WinPKIErrorString()); uprintf("PKI: Could not create empty hash: %s", WinPKIErrorString());
goto out; goto out;
} }
// Compute the cryptographic hash of the buffer. // Compute the cryptographic hash of the buffer.
r = CryptHashData(hHash, pbBuffer, dwBufferLen, 0); r = CryptHashData(hHash, pbBuffer, dwBufferLen, 0);
if (!r) { if (!r) {
uprintf("Could not hash data: %s", WinPKIErrorString()); uprintf("PKI: Could not hash data: %s", WinPKIErrorString());
goto out; goto out;
} }
@ -718,8 +718,12 @@ BOOL ValidateOpensslSignature(BYTE* pbBuffer, DWORD dwBufferLen, BYTE* pbSignatu
// Now that we have all of the public key, hash and signature data in a // Now that we have all of the public key, hash and signature data in a
// format that Microsoft can handle, we can call CryptVerifySignature(). // format that Microsoft can handle, we can call CryptVerifySignature().
r = CryptVerifySignature(hHash, pbSignature, dwSigLen, hPubKey, NULL, 0); r = CryptVerifySignature(hHash, pbSignature, dwSigLen, hPubKey, NULL, 0);
if (!r) if (!r) {
// If the signature is invalid, clear the buffer so that
// we don't keep potentially nasty stuff in memory.
memset(pbBuffer, 0, dwBufferLen);
uprintf("Signature validation failed: %s", WinPKIErrorString()); uprintf("Signature validation failed: %s", WinPKIErrorString());
}
out: out:
if (hHash) if (hHash)

10
src/rufus.rc
View file

@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
IDD_DIALOG DIALOGEX 12, 12, 232, 326 IDD_DIALOG DIALOGEX 12, 12, 232, 326
STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_ACCEPTFILES EXSTYLE WS_EX_ACCEPTFILES
CAPTION "Rufus 3.2.1376" CAPTION "Rufus 3.2.1377"
FONT 9, "Segoe UI Symbol", 400, 0, 0x0 FONT 9, "Segoe UI Symbol", 400, 0, 0x0
BEGIN BEGIN
LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
@ -392,8 +392,8 @@ END
// //
VS_VERSION_INFO VERSIONINFO VS_VERSION_INFO VERSIONINFO
FILEVERSION 3,2,1376,0 FILEVERSION 3,2,1377,0
PRODUCTVERSION 3,2,1376,0 PRODUCTVERSION 3,2,1377,0
FILEFLAGSMASK 0x3fL FILEFLAGSMASK 0x3fL
#ifdef _DEBUG #ifdef _DEBUG
FILEFLAGS 0x1L FILEFLAGS 0x1L
@ -411,13 +411,13 @@ BEGIN
VALUE "Comments", "https://akeo.ie" VALUE "Comments", "https://akeo.ie"
VALUE "CompanyName", "Akeo Consulting" VALUE "CompanyName", "Akeo Consulting"
VALUE "FileDescription", "Rufus" VALUE "FileDescription", "Rufus"
VALUE "FileVersion", "3.2.1376" VALUE "FileVersion", "3.2.1377"
VALUE "InternalName", "Rufus" VALUE "InternalName", "Rufus"
VALUE "LegalCopyright", "© 2011-2018 Pete Batard (GPL v3)" VALUE "LegalCopyright", "© 2011-2018 Pete Batard (GPL v3)"
VALUE "LegalTrademarks", "https://www.gnu.org/copyleft/gpl.html" VALUE "LegalTrademarks", "https://www.gnu.org/copyleft/gpl.html"
VALUE "OriginalFilename", "rufus-3.2.exe" VALUE "OriginalFilename", "rufus-3.2.exe"
VALUE "ProductName", "Rufus" VALUE "ProductName", "Rufus"
VALUE "ProductVersion", "3.2.1376" VALUE "ProductVersion", "3.2.1377"
END END
END END
BLOCK "VarFileInfo" BLOCK "VarFileInfo"