From 7c6b58e9daac2c861942154070fa815151c9d825 Mon Sep 17 00:00:00 2001
From: olszomal <Malgorzata.Olszowka@stunnel.org>
Date: Tue, 20 Feb 2024 15:07:14 +0100
Subject: [PATCH] Fix fuzzer error - corrupted data content

---
 osslsigncode.c | 58 +++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 48 insertions(+), 10 deletions(-)

diff --git a/osslsigncode.c b/osslsigncode.c
index 8f0df52e..b43c3f8d 100644
--- a/osslsigncode.c
+++ b/osslsigncode.c
@@ -1864,6 +1864,28 @@ static int verify_timestamp(FILE_FORMAT_CTX *ctx, PKCS7 *p7, CMS_ContentInfo *ti
     return verok;
 }
 
+#if OPENSSL_VERSION_NUMBER<0x30000000L
+static int PKCS7_type_is_other(PKCS7 *p7)
+{
+    int isOther = 1;
+    int nid = OBJ_obj2nid(p7->type);
+
+    switch (nid) {
+    case NID_pkcs7_data:
+    case NID_pkcs7_signed:
+    case NID_pkcs7_enveloped:
+    case NID_pkcs7_signedAndEnveloped:
+    case NID_pkcs7_digest:
+    case NID_pkcs7_encrypted:
+        isOther = 0;
+        break;
+    default:
+        isOther = 1;
+    }
+    return isOther;
+}
+#endif /* OPENSSL_VERSION_NUMBER<0x30000000L */
+
 /*
  * [in] ctx: structure holds input and output data
  * [in] p7: PKCS#7 signature
@@ -1879,6 +1901,7 @@ static int verify_authenticode(FILE_FORMAT_CTX *ctx, PKCS7 *p7, time_t time, X50
     BIO *bio = NULL;
     int verok = 0;
     char *url;
+    PKCS7 *contents = p7->d.sign->contents;
 
     store = X509_STORE_new();
     if (!store)
@@ -1907,17 +1930,32 @@ static int verify_authenticode(FILE_FORMAT_CTX *ctx, PKCS7 *p7, time_t time, X50
         }
     }
     /* verify a PKCS#7 signedData structure */
-    if (p7->d.sign->contents->d.other->type == V_ASN1_SEQUENCE) {
-        /* only verify the contents of the sequence */
-        int seqhdrlen;
-        seqhdrlen = asn1_simple_hdr_len(p7->d.sign->contents->d.other->value.sequence->data,
-            p7->d.sign->contents->d.other->value.sequence->length);
-        bio = BIO_new_mem_buf(p7->d.sign->contents->d.other->value.sequence->data + seqhdrlen,
-            p7->d.sign->contents->d.other->value.sequence->length - seqhdrlen);
+    if (PKCS7_type_is_other(contents) && (contents->d.other != NULL)
+        && (contents->d.other->value.sequence != NULL)
+        && (contents->d.other->value.sequence->length > 0)) {
+        if (contents->d.other->type == V_ASN1_SEQUENCE) {
+            /* only verify the content of the sequence */
+            const unsigned char *data = contents->d.other->value.sequence->data;
+            long len;
+            int inf, tag, class;
+
+            inf = ASN1_get_object(&data, &len, &tag, &class,
+                contents->d.other->value.sequence->length);
+            if (inf != V_ASN1_CONSTRUCTED || tag != V_ASN1_SEQUENCE) {
+                printf("Corrupted data content\n");
+                X509_STORE_free(store);
+                goto out;
+            }
+            bio = BIO_new_mem_buf(data, (int)len);
+        } else {
+            /* verify the entire value */
+            bio = BIO_new_mem_buf(contents->d.other->value.sequence->data,
+                contents->d.other->value.sequence->length);
+        }
     } else {
-        /* verify the entire value */
-        bio = BIO_new_mem_buf(p7->d.sign->contents->d.other->value.sequence->data,
-            p7->d.sign->contents->d.other->value.sequence->length);
+        printf("Corrupted data content\n");
+        X509_STORE_free(store);
+        goto out;
     }
     printf("Signing certificate chain verified using:\n");
     /*