Skip to content

Commit

Permalink
Update authenticode parser (#2034)
Browse files Browse the repository at this point in the history
This updates authenticode parser to the latest versions which contains
sereral fixes which accumulated over time.

* Several time_t variables replaced with int64_t
* RFC5652 countersignatures are now correctly parsed
* Memory corruption related fixes where authenticode-parser would crash otherwise
  • Loading branch information
metthal authored Jan 30, 2024
1 parent 28ac3d2 commit 77b5dfa
Show file tree
Hide file tree
Showing 10 changed files with 1,471 additions and 1,374 deletions.
8 changes: 4 additions & 4 deletions libyara/include/authenticode-parser/authenticode.h
Original file line number Diff line number Diff line change
Expand Up @@ -106,8 +106,8 @@ typedef struct {
char* key_alg; /* Name of the key algorithm */
char* sig_alg; /* Name of the signature algorithm */
char* sig_alg_oid; /* OID of the signature algorithm */
time_t not_before; /* NotBefore validity */
time_t not_after; /* NotAfter validity */
int64_t not_before; /* NotBefore validity */
int64_t not_after; /* NotAfter validity */
char* key; /* PEM encoded public key */
Attributes issuer_attrs; /* Parsed X509 Attributes of Issuer */
Attributes subject_attrs; /* Parsed X509 Attributes of Subject */
Expand All @@ -120,7 +120,7 @@ typedef struct {

typedef struct {
int verify_flags; /* COUNTERISGNATURE_VFY_ flag */
time_t sign_time; /* Signing time of the timestamp countersignature */
int64_t sign_time; /* Signing time of the timestamp countersignature */
char* digest_alg; /* Name of the digest algorithm used */
ByteArray digest; /* Stored message digest */
CertificateArray* chain; /* Certificate chain of the signer */
Expand Down Expand Up @@ -190,7 +190,7 @@ AuthenticodeArray* parse_authenticode(const uint8_t* pe_data, uint64_t pe_len);
* @param len
* @return AuthenticodeArray*
*/
AuthenticodeArray* authenticode_new(const uint8_t* data, long len);
AuthenticodeArray* authenticode_new(const uint8_t* data, int32_t len);

/**
* @brief Deallocates AuthenticodeArray and all it's allocated members
Expand Down
Loading

0 comments on commit 77b5dfa

Please sign in to comment.