From 706c4491ce34d623afa2bd2ba0a75d7339555e04 Mon Sep 17 00:00:00 2001 From: Vsevolod Kozlov Date: Mon, 6 Jul 2026 13:40:53 +0300 Subject: [PATCH] sbsign: write unaligned signature size into WIN_CERTIFICATE header The inclusion of padding bytes in the signature size can lead to the signature being rejected by strict PKCS7 parsers. Meanwhile, according to [1], the parser of the WIN_CERTIFICATE structure is expected to round up the value of dwLength to an 8-byte multiple. This also matches the behaviour of the sbsign tool from sbsigntools. Fixes #42884 [1] https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-attribute-certificate-table-image-only Signed-off-by: Vsevolod Kozlov (cherry picked from commit 93aadbf968c0408ce9dea468e22ac0baba527763) --- src/sbsign/sbsign.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/sbsign/sbsign.c b/src/sbsign/sbsign.c index cad7cc54db0..1fa6676fd45 100644 --- a/src/sbsign/sbsign.c +++ b/src/sbsign/sbsign.c @@ -659,7 +659,7 @@ static int verb_sign(int argc, char *argv[], uintptr_t _data, void *userdata) { &(WIN_CERTIFICATE_HEADER) { .wRevision = htole16(0x200), .wCertificateType = htole16(0x0002), /* PKCS7 signedData */ - .dwLength = htole32(ROUND_UP(certsz, 8)), + .dwLength = htole32(certsz), }, sizeof(WIN_CERTIFICATE_HEADER), end);