Fix LoadKernel()

src/platform/vboot_reference/vboot_firmware/lib/kernel_image_fw.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for verifying a verified boot kernel image.
  * (Firmware portion)
  */
 
 #include "kernel_image_fw.h"
 
@@ skipping 232 matching lines @@
   StatefulSkip(&st, kernel_sign_key_len);
   StatefulMemcpy(&st, image->header_checksum, FIELD_LEN(header_checksum));
 
   /* Parse signing key into RSAPublicKey structure since it is
    * required multiple times. */
   *kernel_sign_key = RSAPublicKeyFromBuf(image->kernel_sign_key,
                                         kernel_sign_key_len);
   kernel_signature_len = siglen_map[kernel_sign_algorithm];
   kernel_key_signature_len = siglen_map[firmware_sign_algorithm];
   image->kernel_key_signature = (uint8_t*)st.remaining_buf;
-  StatefulSkip(&st, kernel_signature_len);
+  StatefulSkip(&st, kernel_key_signature_len);
 
   /* Only continue if preamble verification succeeds. */
   /* TODO: should pass the remaining len into VerifyKernelPreamble() */
   preamble_ptr = (const uint8_t*)st.remaining_buf;
   if ((error_code = VerifyKernelPreamble(*kernel_sign_key, preamble_ptr,
-                                         kernel_sign_algorithm,
+                                    kernel_sign_algorithm,
                                          &kernel_len))) {
     RSAPublicKeyFree(*kernel_sign_key);
+    *kernel_sign_key = NULL;
     return error_code;  /* AKA jump to recovery. */
   }
 
   /* Copy preamble fields */
   StatefulMemcpy(&st, &image->kernel_version, FIELD_LEN(kernel_version));
   StatefulMemcpy(&st, &image->kernel_len, FIELD_LEN(kernel_len));
   StatefulMemcpy(&st, &image->bootloader_offset, FIELD_LEN(bootloader_offset));
   StatefulMemcpy(&st, &image->bootloader_size, FIELD_LEN(bootloader_size));
   StatefulMemcpy(&st, &image->padded_header_size,
                  FIELD_LEN(padded_header_size));
@@ skipping 102 matching lines @@
 
   kernel_key_signature_len = siglen_map[firmware_sign_algorithm];
   kernel_sign_key_len = RSAProcessedKeySize(kernel_sign_algorithm);
   kernel_ptr += (FIELD_LEN(kernel_key_version) +
                  kernel_sign_key_len +
                  FIELD_LEN(header_checksum) +
                  kernel_key_signature_len);
   Memcpy(&kernel_version, kernel_ptr, sizeof(kernel_version));
   return CombineUint16Pair(kernel_key_version, kernel_version);
 }