[PATCH] mbedtls: remove incorrect attribute type checker

Raymond Mao raymond.mao at linaro.org
Fri Apr 4 16:05:25 CEST 2025


S/MIME Capabilities (OID: 1.2.840.113549.1.9.15) attributes are
expected to be algorithms but neither data nor MS Inderect Data,
thus the checker for data type is incorrect.

This patch fixes a capsule authentication failure with PKCS#7
message that contains S/MIME capabilities, which formed by the EDK2
GenerateCapsule tool.

S/MIME Capabilities are not common attributes in an EFI capsule,
thus this failure cannot be reproduced with the capsules generated
via mkeficapsule.

Fixes: 7de0d155cce7 ("mbedtls: add PKCS7 parser porting layer")
Reported-by: Ilias Apalodimas <ilias.apalodimas at linaro.org>
Signed-off-by: Raymond Mao <raymond.mao at linaro.org>
---
 lib/mbedtls/pkcs7_parser.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/mbedtls/pkcs7_parser.c b/lib/mbedtls/pkcs7_parser.c
index ecfcc46edfa..bf8ee17b5b8 100644
--- a/lib/mbedtls/pkcs7_parser.c
+++ b/lib/mbedtls/pkcs7_parser.c
@@ -189,10 +189,6 @@ static int authattrs_parse(struct pkcs7_message *msg, void *aa, size_t aa_len,
 						len)) {
 			if (__test_and_set_bit(sinfo_has_smime_caps, &sinfo->aa_set))
 				return -EINVAL;
-
-			if (msg->data_type != OID_msIndirectData &&
-			    msg->data_type != OID_data)
-				return -EINVAL;
 		} else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_MICROSOFT_SPOPUSINFO, inner_p,
 						len)) {
 			if (__test_and_set_bit(sinfo_has_ms_opus_info, &sinfo->aa_set))
-- 
2.25.1



More information about the U-Boot mailing list