Message-ID: <sashiko-outbox-205990@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH] crypto: asymmetric_keys: verify_pefile: fix integer
 underflow in pefile_strip_sig_wrapper
To: "Gu Bowen" <gubowen5@huawei.com>, "David Howells" <dhowells@redhat.com>, "Lukas
 Wunner" <lukas@wunner.de>, "Ignat Korchagin" <ignat@linux.win>, "Herbert Xu" <herbert@gondor.apana.org.au>
Cc: kexec@lists.infradead.org, lujialin4@huawei.com
In-Reply-To: <20261110015657.528337-1-gubowen5@huawei.com>
References: <20261110015657.528337-1-gubowen5@huawei.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Tue, 10 Nov 2026 01:49:34 +0000
Precedence: list
Reply-To: sashiko-reviews@lists.linux.dev
Sender: "kexec" <kexec-bounces@lists.infradead.org>

> The pefile_strip_sig_wrapper() function validates the win_certificate
> wrapper that precedes the PKCS#7 signature in a PE binary.  It checks
> that the wrapper length does not exceed the certificate table size
> (``wrapper.length > ctx->sig_len``) but fails to verify that the
> wrapper length is at least ``sizeof(struct win_certificate)`` (8 bytes).
>=20
> When a crafted PE image supplies a wrapper with ``length`` in the range
> [1, 7], the subsequent arithmetic::
>=20
>     ctx->sig_len =3D wrapper.length;      /* e.g. 1 */
>     ctx->sig_offset +=3D sizeof(wrapper);
>     ctx->sig_len -=3D sizeof(wrapper);    /* 1 - 8 =3D 0xFFFFFFF9 (unsign=
ed) */
>=20
> underflows the unsigned ``ctx->sig_len`` to a value near UINT_MAX.  The
> following ``sig_len < 4`` sanity check is bypassed because 0xFFFFFFF9 is
> [ ... ]
> prevent the underflow.
>=20
> Fixes: 09dacbbda935 ("pefile: Strip the wrapper off of the cert data bloc=
k")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gu Bowen <gubowen5@huawei.com>

Sashiko has reviewed this patch and found no issues.

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261110015657.5283=
37-1-gubowen5@huawei.com?part=3D1