From 605452e580850e828041ece46c74d6702055680a Mon Sep 17 00:00:00 2001
From: jmestwa-coder <jmestwa@gmail.com>
Date: Tue, 28 Jul 2026 16:29:52 +0530
Subject: [PATCH] check stored digest length before comparing authenticode
 digests (#2234)

the digest carried in a signature can be shorter than the digest algorithm's output size, so the memcmp in parse_authenticode and pkcs9_countersig_new reads past the stored digest; compare the lengths first, the way countersignature.c already does at its other three digest compares.
---
 .../modules/pe/authenticode-parser/authenticode.c |   3 ++-
 .../pe/authenticode-parser/countersignature.c     |   3 ++-
 tests/data/authenticode_short_digest              | Bin 0 -> 596 bytes
 tests/test-pe.c                                   |  13 +++++++++++++
 4 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 tests/data/authenticode_short_digest

diff --git a/libyara/modules/pe/authenticode-parser/authenticode.c b/libyara/modules/pe/authenticode-parser/authenticode.c
index 8c753538..721082e2 100644
--- a/libyara/modules/pe/authenticode-parser/authenticode.c
+++ b/libyara/modules/pe/authenticode-parser/authenticode.c
@@ -571,7 +571,8 @@ AuthenticodeArray* parse_authenticode(const uint8_t* pe_data, uint64_t pe_len)
         }
 
         /* Complete the verification */
-        if (memcmp(sig->file_digest.data, sig->digest.data, mdlen) != 0)
+        if (sig->digest.len != mdlen ||
+            memcmp(sig->file_digest.data, sig->digest.data, mdlen) != 0)
             sig->verify_flags = AUTHENTICODE_VFY_WRONG_FILE_DIGEST;
     }
 
diff --git a/libyara/modules/pe/authenticode-parser/countersignature.c b/libyara/modules/pe/authenticode-parser/countersignature.c
index d74ba367..53e6f518 100644
--- a/libyara/modules/pe/authenticode-parser/countersignature.c
+++ b/libyara/modules/pe/authenticode-parser/countersignature.c
@@ -220,7 +220,8 @@ Countersignature* pkcs9_countersig_new(
         const uint8_t* data_ptr = decData;
         DigestInfo* digest_info = d2i_DigestInfo(NULL, &data_ptr, decLen);
         if (digest_info) {
-            isValid = !memcmp(ASN1_STRING_get0_data(digest_info->digest), calc_digest, mdLen);
+            isValid = ASN1_STRING_length(digest_info->digest) == (int)mdLen &&
+                      !memcmp(ASN1_STRING_get0_data(digest_info->digest), calc_digest, mdLen);
             DigestInfo_free(digest_info);
         } else {
             isValid = false;
diff --git a/tests/data/authenticode_short_digest b/tests/data/authenticode_short_digest
new file mode 100644
index 0000000000000000000000000000000000000000..aa724b23f15dfd36b414e6df84058210bbbda804
GIT binary patch
literal 596
zcmeZ`VjvqdkgXG;F~AkUMrLs{BJ&1-&BVYEG62@n+e)w>nV1+1yx2Ik+C196^D?qC
zEwDAPW@2PCWH2yb<I-khWMOPFXJTYopk$z6z=I^hZy;d6&BmF~=E0cC%mP%wxM~4|
GAp-y{7Y=v;

literal 0
HcmV?d00001

diff --git a/tests/test-pe.c b/tests/test-pe.c
index 7e0dc3e8..43598080 100644
--- a/tests/test-pe.c
+++ b/tests/test-pe.c
@@ -416,6 +416,19 @@ int main(int argc, char** argv)
       "tests/data/"
       "3b8b90159fa9b6048cc5410c5d53f116943564e4d05b04a843f9b3d0540d0c1c");
 
+  // The messageDigest in SpcIndirectDataContent names sha256 but carries a
+  // single digest byte, so the stored digest is shorter than the algorithm's
+  // output size.
+  assert_true_rule_file(
+      "import \"pe\" \
+      rule test { \
+        condition: \
+          pe.number_of_signatures == 1 and \
+          pe.signatures[0].digest_alg == \"sha256\" and \
+          not pe.signatures[0].verified \
+      }",
+      "tests/data/authenticode_short_digest");
+
 #endif
 
   assert_true_rule_file(