fileinfo prints "Bad time value" for valid-since and valid-until dates of a digitally signed PE file

[s3rvac]

fileinfo prints "Bad time value" for valid-since and valid-until dates of a digitally signed PE file instead of dates in a valid format.

Input

Run

$ retdec-fileinfo --verbose --json FILE

where FILE is:

• 03EA764EAD2C27B0A98C48A18D4CC8E831F3D9A7BF62A471C2D57EF81183CF80

(The --json parameter is not strictly necessary as the text output is similar.)

Output

"certificateTable" -> "certificates" contains the following values for the first certificate:

"validSince" : "Bad time value",
"validUntil" : "Bad time value"

Expected output

I would expect dates in a valid format, e.g.

"validSince" : "Aug  1 08:00:00 2000 GMT",
"validUntil" : "Nov 12 08:00:00 2010 GMT"

(This is just an example. I am not sure what the actual dates should be.)

Configuration

• Commit: a24aabb (current master)
• 64b Arch Linux, GCC 7.3.0, Debug build of RetDec

[s3rvac]

I had a quick look at this. Here is what I found. The parsing of validity dates is in src/fileformat/types/certificate_table/certificate.cpp:

194 void Certificate::loadValidity()
195 {
196     std::vector<char> tmp(50);
197     auto memBio = managedPtr(BIO_new(BIO_s_mem()), &BIO_free);
198
199     ASN1_TIME_print(memBio.get(), X509_get_notBefore(certImpl));
200     BIO_gets(memBio.get(), tmp.data(), 50);
201     validSince = tmp.data();
202
203     if(BIO_reset(memBio.get()) != 1)
204     {
205         return;
206     }
207     ASN1_TIME_print(memBio.get(), X509_get_notAfter(certImpl));
208     BIO_gets(memBio.get(), tmp.data(), 50);
209     validUntil = tmp.data();
210 }

In there, ASN1_TIME_print() is used to "print" the dates into strings. From the manual for ASN1_TIME_print() (emphasis is mine):

ASN1_TIME_print() prints out the time s to BIO b in human readable format. It will be of the format MMM DD HH:MM:SS YYYY [GMT], for example "Feb 3 00:55:52 2015 GMT" it does not include a newline. If the time structure has invalid format it prints out "Bad time value" and returns an error.

Hence, it seems that the dates in the certificate are invalid. I suggest verifying whether this is indeed the case or whether there is a bug in our code. If the dates are invalid, then I suggest using a different value than "Bad time value" in the JSON representation (maybe null or omit the dates completely?).

[metthal]

Fixed in 11d0b12.