Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Merge "Use correct cert chain from PKCS#7 SignedData block." into nyc-dev am: 7fe19060cf am: 815c681f42" into nyc-mr1-dev-plus-aosp

Browse Source
This commit is contained in:
Android Build Merger (Role)
2016-06-01 23:16:35 +00:00
committed by Android (Google) Code Review
parent 713a07c3bd af53ef2308
commit be28ebecb1
1 changed files with 23 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
core/java/android/util/jar/StrictJarVerifier.java
View File

@@ -30,6 +30,7 @@ import java.util.ArrayList;
import java.util.HashMap; import java.util.HashMap;
import java.util.Hashtable; import java.util.Hashtable;
import java.util.Iterator; import java.util.Iterator;
import java.util.List;
import java.util.Locale; import java.util.Locale;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
@@ -41,6 +42,7 @@ import android.util.apk.ApkSignatureSchemeV2Verifier;
import libcore.io.Base64; import libcore.io.Base64;
import sun.security.jca.Providers; import sun.security.jca.Providers;
import sun.security.pkcs.PKCS7; import sun.security.pkcs.PKCS7;
import sun.security.pkcs.SignerInfo;
/** /**
* Non-public class used by {@link JarFile} and {@link JarInputStream} to manage * Non-public class used by {@link JarFile} and {@link JarInputStream} to manage
@@ -308,18 +310,29 @@ class StrictJarVerifier {
obj = Providers.startJarVerification(); obj = Providers.startJarVerification();
PKCS7 block = new PKCS7(blockBytes); PKCS7 block = new PKCS7(blockBytes);
if (block.verify(sfBytes) == null) { SignerInfo[] verifiedSignerInfos = block.verify(sfBytes);
throw new GeneralSecurityException("Failed to verify signature"); if ((verifiedSignerInfos == null) || (verifiedSignerInfos.length == 0)) {
throw new GeneralSecurityException(
"Failed to verify signature: no verified SignerInfos");
} }
X509Certificate[] blockCerts = block.getCertificates(); // Ignore any SignerInfo other than the first one, to be compatible with older Android
Certificate[] signerCertChain = null; // platforms which have been doing this for years. See
if (blockCerts != null) { // libcore/luni/src/main/java/org/apache/harmony/security/utils/JarUtils.java
signerCertChain = new Certificate[blockCerts.length]; // verifySignature method of older platforms.
for (int i = 0; i < blockCerts.length; ++i) { SignerInfo verifiedSignerInfo = verifiedSignerInfos[0];
signerCertChain[i] = blockCerts[i]; List<X509Certificate> verifiedSignerCertChain =
} verifiedSignerInfo.getCertificateChain(block);
if (verifiedSignerCertChain == null) {
// Should never happen
throw new GeneralSecurityException(
"Failed to find verified SignerInfo certificate chain");
} else if (verifiedSignerCertChain.isEmpty()) {
// Should never happen
throw new GeneralSecurityException(
"Verified SignerInfo certificate chain is emtpy");
} }
return signerCertChain; return verifiedSignerCertChain.toArray(
new X509Certificate[verifiedSignerCertChain.size()]);
} catch (IOException e) { } catch (IOException e) {
throw new GeneralSecurityException("IO exception verifying jar cert", e); throw new GeneralSecurityException("IO exception verifying jar cert", e);
} finally { } finally {