commit b69d2ff0551da25644b0b253414696d7df9d6626
author Sami Tolvanen <samitolvanen@google.com> Tue Jun 07 00:05:41 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Jun 07 00:05:41 2016 +0000
tree 5d6ab819b4a40fa5592e3f612c2b5205e7bf2bbf
parent 85420e520124bb86fb19837fbb1f65e473ca29cf
parent ca332ab47ca07ba16861f882d58018c7cb55d94f

Merge "fs_mgr: validate corrected signatures" into nyc-dev
am: eacbb824c9

* commit 'eacbb824c9ee2ccec9e1de641d03e7370888eabc':
  fs_mgr: validate corrected signatures

Change-Id: I3986a59d498a22769611216f5ed475f31332b2c9

fs_mgr/fs_mgr_verity.cpp

diff --git a/fs_mgr/fs_mgr_verity.cpp b/fs_mgr/fs_mgr_verity.cpp
index c73c1e0..4c6e071 100644
--- a/fs_mgr/fs_mgr_verity.cpp
+++ b/fs_mgr/fs_mgr_verity.cpp
@@ -150,6 +150,18 @@
     return retval;
 }
 
+static int verify_verity_signature(const struct fec_verity_metadata& verity)
+{
+    if (verify_table(verity.signature, verity.table,
+            verity.table_length) == 0 ||
+        verify_table(verity.ecc_signature, verity.table,
+            verity.table_length) == 0) {
+        return 0;
+    }
+
+    return -1;
+}
+
 static int invalidate_table(char *table, size_t table_length)
 {
     size_t n = 0;
@@ -955,8 +967,7 @@
     }
 
     // verify the signature on the table
-    if (verify_table(verity.signature, verity.table,
-            verity.table_length) < 0) {
+    if (verify_verity_signature(verity) < 0) {
         if (params.mode == VERITY_MODE_LOGGING) {
             // the user has been warned, allow mounting without dm-verity
             retval = FS_MGR_SETUP_VERITY_SUCCESS;