Skip to content

Commit

Permalink
Update authenticode parser
Browse files Browse the repository at this point in the history
This updates authenticode parser to the latest versions which contains
sereral fixes which accumulated over time.

* Several time_t variables replaced with int64_t
* RFC5652 countersignatures are now correctly parsed
* Memory corruption related fixes where authenticode-parser would crash otherwise
  • Loading branch information
metthal committed Jan 30, 2024
1 parent 28ac3d2 commit 198b9d5
Show file tree
Hide file tree
Showing 10 changed files with 1,471 additions and 1,374 deletions.
8 changes: 4 additions & 4 deletions libyara/include/authenticode-parser/authenticode.h
Original file line number Diff line number Diff line change
Expand Up @@ -106,8 +106,8 @@ typedef struct {
char* key_alg; /* Name of the key algorithm */
char* sig_alg; /* Name of the signature algorithm */
char* sig_alg_oid; /* OID of the signature algorithm */
time_t not_before; /* NotBefore validity */
time_t not_after; /* NotAfter validity */
int64_t not_before; /* NotBefore validity */
int64_t not_after; /* NotAfter validity */
char* key; /* PEM encoded public key */
Attributes issuer_attrs; /* Parsed X509 Attributes of Issuer */
Attributes subject_attrs; /* Parsed X509 Attributes of Subject */
Expand All @@ -120,7 +120,7 @@ typedef struct {

typedef struct {
int verify_flags; /* COUNTERISGNATURE_VFY_ flag */
time_t sign_time; /* Signing time of the timestamp countersignature */
int64_t sign_time; /* Signing time of the timestamp countersignature */
char* digest_alg; /* Name of the digest algorithm used */
ByteArray digest; /* Stored message digest */
CertificateArray* chain; /* Certificate chain of the signer */
Expand Down Expand Up @@ -190,7 +190,7 @@ AuthenticodeArray* parse_authenticode(const uint8_t* pe_data, uint64_t pe_len);
* @param len
* @return AuthenticodeArray*
*/
AuthenticodeArray* authenticode_new(const uint8_t* data, long len);
AuthenticodeArray* authenticode_new(const uint8_t* data, int32_t len);

/**
* @brief Deallocates AuthenticodeArray and all it's allocated members
Expand Down
Loading

0 comments on commit 198b9d5

Please sign in to comment.