Fix issue while converting public key

- PublicKey is retrieved as unsigned character and some of its value
  is missed during converting into const char due to some hexdata such as 0x00.
- It would cause security issue such as one application could access
  shared/trusted of other non-trusted application.
- Fix codes to convert unsigned character value properly.

Change-Id: Iaca2f7c0fa60677d7aa5852725bb5b120ed54a09
Signed-off-by: Junghyun Yeon <jungh.yeon@samsung.com>

diff --git a/src/common/certificate_validation.cc b/src/common/certificate_validation.cc
index dcf1ad8..49b3449 100644 (file)
--- a/src/common/certificate_validation.cc
+++ b/src/common/certificate_validation.cc
@@ -39,7 +39,7 @@ bool SetAuthorCertificate(ValidationCore::SignatureData data,
   size_t len;
   (*it)->getPublicKeyDER(&public_key, &len);
   std::string author_id =
-      ci::EncodeBase64(reinterpret_cast<const char*>(public_key));
+      ci::EncodeBase64(public_key, len);
   cert_info->author_id.set(author_id);
   cert_info->author_certificate.set(*it);
   // cert_list has at least 3 certificates: end-user, intermediate, root

diff --git a/src/common/utils/base64.cc b/src/common/utils/base64.cc
index 840f506..1517b79 100644 (file)
--- a/src/common/utils/base64.cc
+++ b/src/common/utils/base64.cc
@@ -22,10 +22,10 @@ typedef bai::base64_from_binary<bai::transform_width<const char*, 6, 8>>
 
 namespace common_installer {
 
-std::string EncodeBase64(const std::string& val) {
+std::string EncodeBase64(unsigned char* val, size_t len) {
   std::stringstream os;
-  std::copy(base64_encode(val.c_str()),
-      base64_encode(val.c_str() + val.size()), std::ostream_iterator<char>(os));
+  std::copy(base64_encode(val), base64_encode(val + len),
+      std::ostream_iterator<char>(os));
   return os.str();
 }
 

diff --git a/src/common/utils/base64.h b/src/common/utils/base64.h
index e868743..2817f98 100644 (file)
--- a/src/common/utils/base64.h
+++ b/src/common/utils/base64.h
@@ -9,7 +9,7 @@
 
 namespace common_installer {
 
-std::string EncodeBase64(const std::string& val);
+std::string EncodeBase64(unsigned char* val, size_t len);
 
 }  // namespace common_installer