[edk2-devel] [PATCH v2] CryptoPkg/BaseCryptLib: Eliminate extra buffer copy in Pkcs7Verify()
Yao, Jiewen
jiewen.yao at intel.com
Sat Sep 11 15:30:15 UTC 2021
Reviewed-by: Jiewen Yao <Jiewen.yao at intel.com>
> -----Original Message-----
> From: Bob Morgan <bobm at nvidia.com>
> Sent: Saturday, September 11, 2021 5:34 AM
> To: devel at edk2.groups.io
> Cc: Bob Morgan <bobm at nvidia.com>; Yao, Jiewen <jiewen.yao at intel.com>;
> Wang, Jian J <jian.j.wang at intel.com>; Lu, XiaoyuX <xiaoyux.lu at intel.com>;
> Jiang, Guomin <guomin.jiang at intel.com>
> Subject: [PATCH v2] CryptoPkg/BaseCryptLib: Eliminate extra buffer copy in
> Pkcs7Verify()
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3617
>
> Create a read-only openSSL BIO wrapper for the existing input
> buffer passed to Pkcs7Verify() instead of copying the buffer
> into an empty writable BIO which causes memory allocations
> within openSSL.
>
> Cc: Jiewen Yao <jiewen.yao at intel.com>
> Cc: Jian J Wang <jian.j.wang at intel.com>
> Cc: Xiaoyu Lu <xiaoyux.lu at intel.com>
> Cc: Guomin Jiang <guomin.jiang at intel.com>
> Signed-off-by: Bob Morgan <bobm at nvidia.com>
> ---
> CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c | 6 +-----
> 1 file changed, 1 insertion(+), 5 deletions(-)
>
> diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
> b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
> index d99597d181..8eda98f7b2 100644
> --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
> +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
> @@ -864,15 +864,11 @@ Pkcs7Verify (
> // For generic PKCS#7 handling, InData may be NULL if the content is present
> // in PKCS#7 structure. So ignore NULL checking here.
> //
> - DataBio = BIO_new (BIO_s_mem ());
> + DataBio = BIO_new_mem_buf (InData, (int) DataLength);
> if (DataBio == NULL) {
> goto _Exit;
> }
>
> - if (BIO_write (DataBio, InData, (int) DataLength) <= 0) {
> - goto _Exit;
> - }
> -
> //
> // Allow partial certificate chains, terminated by a non-self-signed but
> // still trusted intermediate certificate. Also disable time checks.
> --
> 2.17.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#80535): https://edk2.groups.io/g/devel/message/80535
Mute This Topic: https://groups.io/mt/85520871/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list