From 6169f5cf75ea205125b7127b25875f0b2eeb770c Mon Sep 17 00:00:00 2001
From: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
Date: Sun, 1 Mar 2026 03:41:03 +0900
Subject: [PATCH 23/30] fix(tools): add missing null checks after malloc

Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
---
 tools/tpm2_duplicate.c        | 9 +++++++++
 tools/tpm2_encryptdecrypt.c   | 4 ++++
 tools/tpm2_getekcertificate.c | 8 ++++++++
 tools/tpm2_nvreadpublic.c     | 4 ++++
 tools/tpm2_verifysignature.c  | 4 ++++
 5 files changed, 29 insertions(+)

diff --git a/tools/tpm2_duplicate.c b/tools/tpm2_duplicate.c
index 2c7c340c..26f4ca1d 100644
--- a/tools/tpm2_duplicate.c
+++ b/tools/tpm2_duplicate.c
@@ -179,6 +179,11 @@ static tool_rc openssl_create_duplicate(void) {
         encrypted_duplicate_sensitive.size);
 
     ctx.out_private_data = malloc(private.size + sizeof(private.size));
+    if (!ctx.out_private_data) {
+        LOG_ERR("oom");
+        rc = tool_rc_general_error;
+        goto out;
+    }
     memcpy(ctx.out_private_data, &private, private.size + sizeof(private.size));
 
 out:
@@ -231,6 +236,10 @@ static tool_rc process_openssl_duplicate(void) {
 
     ctx.out_sym_seed = malloc(encrypted_seed.size +
         sizeof(encrypted_seed.size));
+    if (!ctx.out_sym_seed) {
+        LOG_ERR("oom");
+        return tool_rc_general_error;
+    }
     memcpy(ctx.out_sym_seed, &encrypted_seed,
         encrypted_seed.size + sizeof(encrypted_seed.size));
 
diff --git a/tools/tpm2_encryptdecrypt.c b/tools/tpm2_encryptdecrypt.c
index e9087dc8..3a6b243a 100644
--- a/tools/tpm2_encryptdecrypt.c
+++ b/tools/tpm2_encryptdecrypt.c
@@ -375,6 +375,10 @@ static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
         ctx.iv_in = 0;
     } else {
         ctx.iv_in = malloc(iv_start.size + sizeof(iv_start));
+        if (!ctx.iv_in) {
+            LOG_ERR("oom");
+            return tool_rc_general_error;
+        }
         ctx.iv_in->size = iv_start.size;
         memcpy(ctx.iv_in->buffer, &iv_start.buffer, iv_start.size);
     }
diff --git a/tools/tpm2_getekcertificate.c b/tools/tpm2_getekcertificate.c
index 961021cf..d962c13c 100644
--- a/tools/tpm2_getekcertificate.c
+++ b/tools/tpm2_getekcertificate.c
@@ -424,6 +424,10 @@ static char *encode_ek_public_amd(void) {
         return NULL;
     }
     char *hash_str = malloc(AMD_EK_URI_LEN * 2 + NULL_TERM_LEN);
+    if (!hash_str) {
+        LOG_ERR("oom");
+        return NULL;
+    }
     for (size_t i = 0; i < AMD_EK_URI_LEN; i++)
     {
         sprintf((char*)(hash_str + (i*2)), "%02x", hash[i]);
@@ -845,6 +849,10 @@ static tool_rc process_input(ESYS_CONTEXT *ectx) {
 
     if (ctx.ek_path) {
         ctx.out_public = malloc(sizeof(*ctx.out_public));
+        if (!ctx.out_public) {
+            LOG_ERR("oom");
+            return tool_rc_general_error;
+        }
         ctx.out_public->size = 0;
         bool res = files_load_public(ctx.ek_path, ctx.out_public);
         if (!res) {
diff --git a/tools/tpm2_nvreadpublic.c b/tools/tpm2_nvreadpublic.c
index b39d1ac7..597ff6d1 100644
--- a/tools/tpm2_nvreadpublic.c
+++ b/tools/tpm2_nvreadpublic.c
@@ -243,6 +243,10 @@ static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
      */
     if (!ctx.is_command_dispatch) {
         ctx.nv_public_list[0] = malloc(sizeof(TPM2B_NV_PUBLIC));
+        if (!ctx.nv_public_list[0]) {
+            LOG_ERR("oom");
+            return tool_rc_general_error;
+        }
     }
 
     /*
diff --git a/tools/tpm2_verifysignature.c b/tools/tpm2_verifysignature.c
index 240165d6..5f7c3e96 100644
--- a/tools/tpm2_verifysignature.c
+++ b/tools/tpm2_verifysignature.c
@@ -196,6 +196,10 @@ static bool on_option(char key, char *value) {
         break;
     case 'd': {
         ctx.msg_hash = malloc(sizeof(TPM2B_DIGEST));
+        if (!ctx.msg_hash) {
+            LOG_ERR("oom");
+            return false;
+        }
         ctx.msg_hash->size = sizeof(ctx.msg_hash->buffer);
         if (!files_load_bytes_from_path(value, ctx.msg_hash->buffer,
                 &ctx.msg_hash->size)) {
-- 
2.54.0