Address some security concerns in the cgpt tool.

utility/vbutil_keyblock.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Verified boot key block utility
  */
 
 #include <getopt.h>
 #include <inttypes.h>  /* For PRIu64 */
 #include <stdio.h>
@@ skipping 109 matching lines @@
   }
 
   block = KeyBlockRead(infile);
   if (!block) {
     fprintf(stderr, "vbutil_keyblock: Error reading key block.\n");
     return 1;
   }
 
   /* If the block is signed, then verify it with the signing public key, since
      KeyBlockRead() only verified the hash. */
-  if (block->key_block_signature.sig_size && signpubkey) {
+  if (block->key_block_signature.sig_size) {
+    if (!signpubkey) {
+      fprintf(stderr,
+              "vbutil_keyblock: keyblock requires public key to verify\n");
+      return 1;
+    }
     sign_key = PublicKeyRead(signpubkey);
     if (!sign_key) {
       fprintf(stderr, "vbutil_keyblock: Error reading signpubkey.\n");
       return 1;
     }
     if (0 != KeyBlockVerify(block, block->key_block_size, sign_key, 0)) {
       fprintf(stderr, "vbutil_keyblock: Error verifying key block.\n");
       return 1;
     }
+    printf("Signature algorithm:  %" PRIu64 " %s\n", sign_key->algorithm,
+           (sign_key->algorithm < kNumAlgorithms ?
+            algo_strings[sign_key->algorithm] : "(invalid)"));
     Free(sign_key);
+  } else {
+    printf("Signature Algorithm:  <none>\n");
   }
 
   printf("Key block file:       %s\n", infile);
-  printf("Signature             %s\n", sign_key ? "valid" : "ignored");
-  printf("Flags:                %" PRIu64 " ", block->key_block_flags);
+  printf("Flags:                %" PRIu64 "\n", block->key_block_flags);
   if (block->key_block_flags & KEY_BLOCK_FLAG_DEVELOPER_0)
     printf(" !DEV");
   if (block->key_block_flags & KEY_BLOCK_FLAG_DEVELOPER_1)
     printf(" DEV");
   if (block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_0)
     printf(" !REC");
   if (block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_1)
     printf(" REC");
   printf("\n");
 
@@ skipping 79 matching lines @@
   switch(mode) {
     case OPT_MODE_PACK:
       return Pack(filename, datapubkey, signprivate, flags);
     case OPT_MODE_UNPACK:
       return Unpack(filename, datapubkey, signpubkey);
     default:
       printf("Must specify a mode.\n");
       return PrintHelp(progname);
   }
 }