diff options
| author | Jason Andryuk <jandryuk@gmail.com> | 2021-05-06 09:59:22 -0400 |
|---|---|---|
| committer | Andrew Cooper <andrew.cooper3@citrix.com> | 2021-05-10 14:50:33 +0100 |
| commit | 5974702bddd37445ae2104f567d88c400227d5d4 (patch) | |
| tree | ebfa4fa01af1acd499649ab00c9ba40f4c82e10e | |
| parent | c8d8a1e2e6a1fdba45dd9e9fb993d79d1e5a097c (diff) | |
vtpmmgr: Check req_len before unpacking command
vtpm_handle_cmd doesn't ensure there is enough space before unpacking
the req buffer. Add a minimum size check. Called functions will have
to do their own checking if they need more data from the request.
The error case is tricky since abort_egress wants to rely with a
corresponding tag. Just hardcode TPM_TAG_RQU_COMMAND since the vtpm is
sending in malformed commands in the first place.
Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
| -rw-r--r-- | stubdom/vtpmmgr/vtpm_cmd_handler.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/stubdom/vtpmmgr/vtpm_cmd_handler.c b/stubdom/vtpmmgr/vtpm_cmd_handler.c index c879b24c13..5586be6997 100644 --- a/stubdom/vtpmmgr/vtpm_cmd_handler.c +++ b/stubdom/vtpmmgr/vtpm_cmd_handler.c @@ -840,6 +840,12 @@ TPM_RESULT vtpmmgr_handle_cmd( UINT32 size; TPM_COMMAND_CODE ord; + if (tpmcmd->req_len < sizeof_TPM_RQU_HEADER(tpmcmd->req)) { + status = TPM_BAD_PARAMETER; + tag = TPM_TAG_RQU_COMMAND; + goto abort_egress; + } + unpack_TPM_RQU_HEADER(tpmcmd->req, &tag, &size, &ord); |