268 lines
10 KiB
Diff
268 lines
10 KiB
Diff
From d29d80c8ca14f793ef9a572945b232a52aa72c54 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
|
|
Date: Mon, 21 Jun 2021 15:10:14 -0400
|
|
Subject: [PATCH 2/3] tpm2: Add maxSize parameter to TPM2B_Marshal for sanity
|
|
checks
|
|
|
|
Add maxSize parameter to TPM2B_Marshal and assert on it checking
|
|
the size of the data intended to be marshaled versus the maximum
|
|
buffer size.
|
|
|
|
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
|
|
---
|
|
src/tpm2/Marshal.c | 38 ++++++++++++++++++++------------------
|
|
src/tpm2/Marshal_fp.h | 2 +-
|
|
src/tpm2/NVMarshal.c | 18 +++++++++---------
|
|
3 files changed, 30 insertions(+), 28 deletions(-)
|
|
|
|
diff --git a/src/tpm2/Marshal.c b/src/tpm2/Marshal.c
|
|
index d355096..b498b62 100644
|
|
--- a/src/tpm2/Marshal.c
|
|
+++ b/src/tpm2/Marshal.c
|
|
@@ -61,6 +61,7 @@
|
|
|
|
/* rev 136 */
|
|
|
|
+#include <assert.h> // libtpms added
|
|
#include <string.h>
|
|
|
|
#include "Tpm.h"
|
|
@@ -178,9 +179,10 @@ Array_Marshal(BYTE *sourceBuffer, UINT16 sourceSize, BYTE **buffer, INT32 *size)
|
|
}
|
|
|
|
UINT16
|
|
-TPM2B_Marshal(TPM2B *source, BYTE **buffer, INT32 *size)
|
|
+TPM2B_Marshal(TPM2B *source, UINT32 maxSize, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
+ assert(source->size <= maxSize); // libtpms added
|
|
written += UINT16_Marshal(&(source->size), buffer, size);
|
|
written += Array_Marshal(source->buffer, source->size, buffer, size);
|
|
return written;
|
|
@@ -495,7 +497,7 @@ UINT16
|
|
TPM2B_DIGEST_Marshal(TPM2B_DIGEST *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
-written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -505,7 +507,7 @@ UINT16
|
|
TPM2B_DATA_Marshal(TPM2B_DATA *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
-written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -535,7 +537,7 @@ UINT16
|
|
TPM2B_MAX_BUFFER_Marshal(TPM2B_MAX_BUFFER *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -545,7 +547,7 @@ UINT16
|
|
TPM2B_MAX_NV_BUFFER_Marshal(TPM2B_MAX_NV_BUFFER *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -554,7 +556,7 @@ UINT16
|
|
TPM2B_TIMEOUT_Marshal(TPM2B_TIMEOUT *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -564,7 +566,7 @@ UINT16
|
|
TPM2B_IV_Marshal(TPM2B_IV *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -574,7 +576,7 @@ UINT16
|
|
TPM2B_NAME_Marshal(TPM2B_NAME *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.name), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -1111,7 +1113,7 @@ UINT16
|
|
TPM2B_ATTEST_Marshal(TPM2B_ATTEST *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.attestationData), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -1232,7 +1234,7 @@ UINT16
|
|
TPM2B_SYM_KEY_Marshal(TPM2B_SYM_KEY *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -1253,7 +1255,7 @@ UINT16
|
|
TPM2B_SENSITIVE_DATA_Marshal(TPM2B_SENSITIVE_DATA *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -1613,7 +1615,7 @@ UINT16
|
|
TPM2B_PUBLIC_KEY_RSA_Marshal(TPM2B_PUBLIC_KEY_RSA *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -1633,7 +1635,7 @@ UINT16
|
|
TPM2B_PRIVATE_KEY_RSA_Marshal(TPM2B_PRIVATE_KEY_RSA *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -1643,7 +1645,7 @@ UINT16
|
|
TPM2B_ECC_PARAMETER_Marshal(TPM2B_ECC_PARAMETER *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -1879,7 +1881,7 @@ UINT16
|
|
TPM2B_ENCRYPTED_SECRET_Marshal(TPM2B_ENCRYPTED_SECRET *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.secret), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -2090,7 +2092,7 @@ UINT16
|
|
TPM2B_PRIVATE_Marshal(TPM2B_PRIVATE *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -2100,7 +2102,7 @@ UINT16
|
|
TPM2B_ID_OBJECT_Marshal(TPM2B_ID_OBJECT *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.credential), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
@@ -2157,7 +2159,7 @@ UINT16
|
|
TPM2B_CONTEXT_DATA_Marshal(TPM2B_CONTEXT_DATA *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size); // libtpms changed
|
|
return written;
|
|
}
|
|
|
|
diff --git a/src/tpm2/Marshal_fp.h b/src/tpm2/Marshal_fp.h
|
|
index faf9d2b..53f4f7d 100644
|
|
--- a/src/tpm2/Marshal_fp.h
|
|
+++ b/src/tpm2/Marshal_fp.h
|
|
@@ -79,7 +79,7 @@ extern "C" {
|
|
UINT16
|
|
Array_Marshal(BYTE *sourceBuffer, UINT16 sourceSize, BYTE **buffer, INT32 *size);
|
|
UINT16
|
|
- TPM2B_Marshal(TPM2B *source, BYTE **buffer, INT32 *size);
|
|
+ TPM2B_Marshal(TPM2B *source, UINT32 maxSize, BYTE **buffer, INT32 *size); // libtpms changed
|
|
UINT16
|
|
TPM_KEY_BITS_Marshal(TPM_KEY_BITS *source, BYTE **buffer, INT32 *size);
|
|
UINT16
|
|
diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c
|
|
index b9934d5..1f96bcb 100644
|
|
--- a/src/tpm2/NVMarshal.c
|
|
+++ b/src/tpm2/NVMarshal.c
|
|
@@ -255,7 +255,7 @@ UINT16
|
|
TPM2B_PROOF_Marshal(TPM2B_PROOF *source, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written = 0;
|
|
- written += TPM2B_Marshal(&source->b, buffer, size);
|
|
+ written += TPM2B_Marshal(&source->b, sizeof(source->t.buffer), buffer, size);
|
|
return written;
|
|
}
|
|
|
|
@@ -1332,7 +1332,7 @@ STATE_RESET_DATA_Marshal(STATE_RESET_DATA *data, BYTE **buffer, INT32 *size)
|
|
STATE_RESET_DATA_VERSION,
|
|
STATE_RESET_DATA_MAGIC, 1);
|
|
written += TPM2B_PROOF_Marshal(&data->nullProof, buffer, size);
|
|
- written += TPM2B_Marshal(&data->nullSeed.b, buffer, size);
|
|
+ written += TPM2B_Marshal(&data->nullSeed.b, sizeof(data->nullSeed.t.buffer), buffer, size);
|
|
written += UINT32_Marshal(&data->clearCount, buffer, size);
|
|
written += UINT64_Marshal(&data->objectContextID, buffer, size);
|
|
|
|
@@ -2115,7 +2115,7 @@ TPM2B_HASH_BLOCK_Marshal(TPM2B_HASH_BLOCK *data, BYTE **buffer, INT32 *size)
|
|
{
|
|
UINT16 written;
|
|
|
|
- written = TPM2B_Marshal(&data->b, buffer, size);
|
|
+ written = TPM2B_Marshal(&data->b, sizeof(data->t.buffer), buffer, size);
|
|
|
|
return written;
|
|
}
|
|
@@ -2980,9 +2980,9 @@ VolatileState_Marshal(BYTE **buffer, INT32 *size)
|
|
|
|
/* tie the volatile state to the EP,SP, and PPSeed */
|
|
NvRead(&pd, NV_PERSISTENT_DATA, sizeof(pd));
|
|
- written += TPM2B_Marshal(&pd.EPSeed.b, buffer, size);
|
|
- written += TPM2B_Marshal(&pd.SPSeed.b, buffer, size);
|
|
- written += TPM2B_Marshal(&pd.PPSeed.b, buffer, size);
|
|
+ written += TPM2B_Marshal(&pd.EPSeed.b, sizeof(pd.EPSeed.t.buffer), buffer, size);
|
|
+ written += TPM2B_Marshal(&pd.SPSeed.b, sizeof(pd.SPSeed.t.buffer), buffer, size);
|
|
+ written += TPM2B_Marshal(&pd.PPSeed.b, sizeof(pd.PPSeed.t.buffer), buffer, size);
|
|
|
|
written += BLOCK_SKIP_WRITE_PUSH(TRUE, buffer, size); /* v4 */
|
|
|
|
@@ -3799,9 +3799,9 @@ PERSISTENT_DATA_Marshal(PERSISTENT_DATA *data, BYTE **buffer, INT32 *size)
|
|
written += TPM2B_AUTH_Marshal(&data->ownerAuth, buffer, size);
|
|
written += TPM2B_AUTH_Marshal(&data->endorsementAuth, buffer, size);
|
|
written += TPM2B_AUTH_Marshal(&data->lockoutAuth, buffer, size);
|
|
- written += TPM2B_Marshal(&data->EPSeed.b, buffer, size);
|
|
- written += TPM2B_Marshal(&data->SPSeed.b, buffer, size);
|
|
- written += TPM2B_Marshal(&data->PPSeed.b, buffer, size);
|
|
+ written += TPM2B_Marshal(&data->EPSeed.b, sizeof(data->EPSeed.t.buffer), buffer, size);
|
|
+ written += TPM2B_Marshal(&data->SPSeed.b, sizeof(data->SPSeed.t.buffer), buffer, size);
|
|
+ written += TPM2B_Marshal(&data->PPSeed.b, sizeof(data->PPSeed.t.buffer), buffer, size);
|
|
written += TPM2B_PROOF_Marshal(&data->phProof, buffer, size);
|
|
written += TPM2B_PROOF_Marshal(&data->shProof, buffer, size);
|
|
written += TPM2B_PROOF_Marshal(&data->ehProof, buffer, size);
|
|
--
|
|
2.29.0
|
|
|