Changeset 106997 in vbox for trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp

Timestamp:

Nov 13, 2024 10:47:41 PM (6 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

165933

Message:

SUPHardNt: Fixed bug from r165898 that ended up mixing TAFs and x.509 certificates. jiraref:VBP-1451

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp (modified) (2 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp

@@ -1748 +1748 @@
     for (uint32_t i = 0; i < cCerts; i++)
     {
-        int rc = RTCrStoreCertAddEncoded(hStore, RTCRCERTCTX_F_ENC_TAF_DER, paCerts[i].pch, paCerts[i].cb, pErrInfo);
+        int rc = RTCrStoreCertAddEncoded(hStore, !paCerts[i].fIsCert ? RTCRCERTCTX_F_ENC_TAF_DER : RTCRCERTCTX_F_ENC_X509_DER,
+                                         paCerts[i].pch, paCerts[i].cb, pErrInfo);
         if (RT_FAILURE(rc))
             return rc;
@@ -2018 +2019 @@
          */
         rc = supHardNtViCertInit(&g_BuildX509Cert, g_abSUPBuildCert, g_cbSUPBuildCert, pErrInfo, "BuildCertificate");
-        SUPTAENTRY const aBuildCerts[1] = { { g_abSUPBuildCert, g_cbSUPBuildCert }, };
+        SUPTAENTRY const aBuildCerts[1] = { { g_abSUPBuildCert, g_cbSUPBuildCert, true }, };
         if (RT_SUCCESS(rc))
             rc = supHardNtViCertStoreInit(&g_hSpecialTrustStore,