scripts/sign-file.c: correct error handling

Commit Message

Ansgar Burchardt July 6, 2022, 10:54 a.m. UTC

Hi,

The functions CMS_final, i2d_CMS_bio_stream, i2d_PKCS7_bio and
BIO_free all return 1 for success or 0 for failure. The old check
for a value less than 0 would never catch an error.

I tried signing a kernel module with the patched sign-file and that
still worked.

Ansgar

PS: Please CC me on replies.
From d11fb170c3ec172ce6707baab03b1499f14e0f20 Mon Sep 17 00:00:00 2001
From: Ansgar Burchardt <[e-mail]>
Date: Sun, 3 Jul 2022 11:17:50 +0200
Subject: [PATCH] sign-file: correct error handling

The functions CMS_final, i2d_CMS_bio_stream, i2d_PKCS7_bio and
BIO_free all return 1 for success or 0 for failure.

Signed-off-by: Ansgar Burchardt <[e-mail]>
---
 scripts/sign-file.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

Patch

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 7434e9ea926e..4889f919ff8a 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -322,7 +322,7 @@  int main(int argc, char **argv)
 				     CMS_NOSMIMECAP | use_keyid |
 				     use_signed_attrs),
 		    "CMS_add1_signer");
-		ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) < 0,
+		ERR(!CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY),
 		    "CMS_final");
 
 #else
@@ -341,10 +341,10 @@  int main(int argc, char **argv)
 			b = BIO_new_file(sig_file_name, "wb");
 			ERR(!b, "%s", sig_file_name);
 #ifndef USE_PKCS7
-			ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0,
+			ERR(!i2d_CMS_bio_stream(b, cms, NULL, 0),
 			    "%s", sig_file_name);
 #else
-			ERR(i2d_PKCS7_bio(b, pkcs7) < 0,
+			ERR(!i2d_PKCS7_bio(b, pkcs7),
 			    "%s", sig_file_name);
 #endif
 			BIO_free(b);
@@ -374,9 +374,9 @@  int main(int argc, char **argv)
 
 	if (!raw_sig) {
 #ifndef USE_PKCS7
-		ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name);
+		ERR(!i2d_CMS_bio_stream(bd, cms, NULL, 0), "%s", dest_name);
 #else
-		ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name);
+		ERR(!i2d_PKCS7_bio(bd, pkcs7), "%s", dest_name);
 #endif
 	} else {
 		BIO *b;
@@ -396,7 +396,7 @@  int main(int argc, char **argv)
 	ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, "%s", dest_name);
 	ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name);
 
-	ERR(BIO_free(bd) < 0, "%s", dest_name);
+	ERR(!BIO_free(bd), "%s", dest_name);
 
 	/* Finally, if we're signing in place, replace the original. */
 	if (replace_orig)