Authenticode fix for #4065

Ylian Saint-Hilaire committed Jun 1, 2022 at 14:34 UTC 286c34799ed2a8041bb1bffc67fe1d4bba30b762
1 file changed +20 -6
authenticode.js
+20 -6
@@ -217,13 +217,27 @@ function createAuthenticodeHandler(path) {
217 // Get the signing attributes
218 obj.signingAttribs = [];
219 for (var i in pkcs7.rawCapture.authenticatedAttributes) {
220 - if (forge.asn1.derToOid(pkcs7.rawCapture.authenticatedAttributes[i].value[0].value) == obj.Oids.SPC_SP_OPUS_INFO_OBJID) {
220 + if (
221 + (pkcs7.rawCapture.authenticatedAttributes[i].value != null) &&
222 + (pkcs7.rawCapture.authenticatedAttributes[i].value[0] != null) &&
223 + (pkcs7.rawCapture.authenticatedAttributes[i].value[0].value != null) &&
224 + (pkcs7.rawCapture.authenticatedAttributes[i].value[1] != null) &&
225 + (pkcs7.rawCapture.authenticatedAttributes[i].value[1].value != null) &&
226 + (forge.asn1.derToOid(pkcs7.rawCapture.authenticatedAttributes[i].value[0].value) == obj.Oids.SPC_SP_OPUS_INFO_OBJID))
227 + {
228 for (var j in pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value) {
222 - var v = pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value[j].value[0].value;
223 - if (v.startsWith('http://') || v.startsWith('https://') || ((v.length % 2) == 1)) { obj.signingAttribs.push(v); } else {
224 - var r = ""; // This string value is in UCS2 format, convert it to a normal string.
225 - for (var k = 0; k < v.length; k += 2) { r += String.fromCharCode((v.charCodeAt(k + 8) << 8) + v.charCodeAt(k + 1)); }
226 - obj.signingAttribs.push(r);
229 + if (
230 + (pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value[j] != null) &&
231 + (pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value[j].value != null) &&
232 + (pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value[j].value[0] != null) &&
233 + (pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value[j].value[0].value != null)
234 + ) {
235 + var v = pkcs7.rawCapture.authenticatedAttributes[i].value[1].value[0].value[j].value[0].value;
236 + if (v.startsWith('http://') || v.startsWith('https://') || ((v.length % 2) == 1)) { obj.signingAttribs.push(v); } else {
237 + var r = ""; // This string value is in UCS2 format, convert it to a normal string.
238 + for (var k = 0; k < v.length; k += 2) { r += String.fromCharCode((v.charCodeAt(k + 8) << 8) + v.charCodeAt(k + 1)); }
239 + obj.signingAttribs.push(r);
240 + }
241 }
242 }
243 }