Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added error checking when copying the public key from the certificate. #252

Merged
merged 1 commit into from May 19, 2021
Merged

Added error checking when copying the public key from the certificate. #252

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
26 changes: 23 additions & 3 deletions TrustKit/Pinning/TSKSPKIHashCache.m
View file
Open in desktop
Expand Up @@ -173,6 +173,11 @@ - (NSData *)hashSubjectPublicKeyInfoFromCertificate:(SecCertificateRef)certifica

// First extract the public key
SecKeyRef publicKey = [self copyPublicKeyFromCertificate:certificate];
if (publicKey == nil)
{
TSKLog(@"Error - could not copy the public key from the certificate");
return nil;
}

// Obtain the public key bytes from the key reference
NSData *publicKeyData = (__bridge_transfer NSData *)SecKeyCopyExternalRepresentation(publicKey, NULL);
Expand Down Expand Up @@ -254,16 +259,31 @@ - (SPKICacheDictionnary *)loadSPKICacheFromFileSystem

- (SecKeyRef)copyPublicKeyFromCertificate:(SecCertificateRef)certificate
{
OSStatus status;

// Create an X509 trust using the using the certificate
SecTrustRef trust;
SecPolicyRef policy = SecPolicyCreateBasicX509();
SecTrustCreateWithCertificates(certificate, policy, &trust);
status = SecTrustCreateWithCertificates(certificate, policy, &trust);
CFRelease(policy);

if (status != errSecSuccess)
{
TSKLog(@"Could not create trust from certificate, got status %d", status);
return nil;
}

// Get a public key reference for the certificate from the trust
SecTrustResultType result;
SecTrustEvaluate(trust, &result);
status = SecTrustEvaluate(trust, &result);
if (status != errSecSuccess)
{
TSKLog(@"Could not evaluate trust for the certificate, got status %d", status);
CFRelease(trust);
return nil;
}

SecKeyRef publicKey = SecTrustCopyPublicKey(trust);
CFRelease(policy);
CFRelease(trust);
return publicKey;
}
Expand Down