Skip to content

Commit a32b30f

Browse files
dgarskedgarske
committed
A few more cleanups and checks around TPM2_GetHashDigestSize.
1 parent c29b939 commit a32b30f

1 file changed

Lines changed: 56 additions & 27 deletions

File tree

‎src/tpm2_wrap.c‎

Lines changed: 56 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -985,8 +985,8 @@ int wolfTPM2_SetAuthHandle(WOLFTPM2_DEV* dev, int index,
985985
TPM2_PrintBin(handle->name.name, handle->name.size);
986986
#endif
987987
session->policyAuth = handle->policyAuth;
988-
if ((word32)handle->auth.size + authDigestSz >
989-
sizeof(session->auth.buffer)) {
988+
if (authDigestSz <= 0 ||
989+
(handle->auth.size + authDigestSz) > (int)sizeof(session->auth.buffer)) {
990990
return BUFFER_E;
991991
}
992992
session->auth.size = authDigestSz + handle->auth.size;
@@ -1037,7 +1037,8 @@ int wolfTPM2_SetAuthHandleName(WOLFTPM2_DEV* dev, int index,
10371037
else if (handle->policyAuth) {
10381038
/* HMAC + policy auth value */
10391039
int authDigestSz = TPM2_GetHashDigestSize(session->authHash);
1040-
if ((authDigestSz + handle->auth.size) > (int)sizeof(session->auth.buffer)) {
1040+
if (authDigestSz <= 0 ||
1041+
(authDigestSz + handle->auth.size) > (int)sizeof(session->auth.buffer)) {
10411042
return BUFFER_E;
10421043
}
10431044
session->auth.size = (UINT16)(authDigestSz + handle->auth.size);
@@ -1243,8 +1244,8 @@ static int TPM2_KDFe(
12431244
hashType = (enum wc_HashType)ret;
12441245

12451246
hLen = TPM2_GetHashDigestSize(hashAlg);
1246-
if ((hLen <= 0) || (hLen > WC_MAX_DIGEST_SIZE))
1247-
return NOT_COMPILED_IN;
1247+
if ((hLen <= 0) || (hLen > (int)sizeof(hash)))
1248+
return BUFFER_E;
12481249

12491250
/* get label length if provided, including null termination */
12501251
if (label != NULL) {
@@ -1401,11 +1402,11 @@ static int wolfTPM2_EncryptSecret_ECC(WOLFTPM2_DEV* dev, const WOLFTPM2_KEY* tpm
14011402
if (rc == 0) {
14021403
/* set size encryption key */
14031404
int hashDigestSz = TPM2_GetHashDigestSize(publicArea->nameAlg);
1404-
if (hashDigestSz > 0) {
1405+
if (hashDigestSz > 0 && hashDigestSz <= (int)sizeof(data->buffer)) {
14051406
data->size = (UINT16)hashDigestSz;
14061407
}
14071408
else {
1408-
rc = NOT_COMPILED_IN;
1409+
rc = BUFFER_E;
14091410
}
14101411
}
14111412
if (rc == 0) {
@@ -1484,11 +1485,11 @@ static int wolfTPM2_EncryptSecret_RSA(WOLFTPM2_DEV* dev, const WOLFTPM2_KEY* tpm
14841485
if (rc == 0 && data->size == 0) {
14851486
/* Generate random value to exchange for encryption */
14861487
int hashDigestSz = TPM2_GetHashDigestSize(publicArea->nameAlg);
1487-
if (hashDigestSz > 0) {
1488+
if (hashDigestSz > 0 && hashDigestSz <= (int)sizeof(data->buffer)) {
14881489
data->size = (UINT16)hashDigestSz;
14891490
}
14901491
else {
1491-
rc = NOT_COMPILED_IN;
1492+
rc = BUFFER_E;
14921493
}
14931494
}
14941495
if (rc == 0) {
@@ -1588,8 +1589,9 @@ int wolfTPM2_StartSession(WOLFTPM2_DEV* dev, WOLFTPM2_SESSION* session,
15881589

15891590
authSesIn.authHash = authHash;
15901591
hashDigestSz = TPM2_GetHashDigestSize(authHash);
1591-
if (hashDigestSz <= 0) {
1592-
return NOT_COMPILED_IN;
1592+
if (hashDigestSz <= 0 ||
1593+
hashDigestSz > (int)sizeof(authSesIn.nonceCaller.buffer)) {
1594+
return BUFFER_E;
15931595
}
15941596

15951597
/* set session auth for key */
@@ -1760,13 +1762,31 @@ int wolfTPM2_CreatePrimaryKey_ex(WOLFTPM2_DEV* dev, WOLFTPM2_PKEY* pkey,
17601762
createPriIn.primaryHandle = primaryHandle;
17611763
if (auth && authSz > 0) {
17621764
int nameAlgDigestSz = TPM2_GetHashDigestSize(publicTemplate->nameAlg);
1763-
/* truncate if longer than name size */
1764-
if (nameAlgDigestSz > 0 && authSz > nameAlgDigestSz)
1765-
authSz = nameAlgDigestSz;
1766-
XMEMCPY(createPriIn.inSensitive.sensitive.userAuth.buffer, auth, authSz);
1767-
/* make sure auth is same size as nameAlg digest size */
1768-
if (nameAlgDigestSz > 0 && authSz < nameAlgDigestSz)
1769-
authSz = nameAlgDigestSz;
1765+
/* Ensure auth size matches the name algorithm digest size */
1766+
if (nameAlgDigestSz > 0) {
1767+
/* Truncate if auth is longer than digest size */
1768+
if (authSz > nameAlgDigestSz) {
1769+
authSz = nameAlgDigestSz;
1770+
}
1771+
1772+
/* Copy auth data to buffer */
1773+
XMEMCPY(createPriIn.inSensitive.sensitive.userAuth.buffer, auth, authSz);
1774+
1775+
/* Pad with zeros if auth is shorter than digest size */
1776+
if (authSz < nameAlgDigestSz) {
1777+
XMEMSET(createPriIn.inSensitive.sensitive.userAuth.buffer + authSz,
1778+
0, nameAlgDigestSz - authSz);
1779+
authSz = nameAlgDigestSz;
1780+
}
1781+
}
1782+
else {
1783+
/* Fallback: copy auth as-is if digest size is invalid */
1784+
if (authSz > (int)sizeof(createPriIn.inSensitive.sensitive.userAuth.buffer)) {
1785+
return BUFFER_E;
1786+
}
1787+
XMEMCPY(createPriIn.inSensitive.sensitive.userAuth.buffer, auth, authSz);
1788+
}
1789+
17701790
createPriIn.inSensitive.sensitive.userAuth.size = authSz;
17711791
}
17721792
XMEMCPY(&createPriIn.inPublic.publicArea, publicTemplate,
@@ -2205,11 +2225,11 @@ static int SensitiveToPrivate(TPM2B_SENSITIVE* sens, TPM2B_PRIVATE* priv,
22052225
nameAlg = parentKey->pub.publicArea.nameAlg;
22062226
}
22072227
digestSz = TPM2_GetHashDigestSize(nameAlg);
2208-
if (digestSz == 0) {
2228+
if (digestSz <= 0) {
22092229
#ifdef DEBUG_WOLFTPM
22102230
printf("SensitiveToPrivate: Invalid name algorithm %d\n", nameAlg);
22112231
#endif
2212-
return TPM_RC_FAILURE;
2232+
return BAD_FUNC_ARG;
22132233
}
22142234

22152235
/* Use outer wrap (Integrity then Encrypt) */
@@ -2594,7 +2614,7 @@ int wolfTPM2_ImportRsaPrivateKeySeed(WOLFTPM2_DEV* dev,
25942614
#ifdef DEBUG_WOLFTPM
25952615
printf("Import RSA name alg size invalid! %d\n", digestSz);
25962616
#endif
2597-
return BAD_FUNC_ARG;
2617+
return BUFFER_E;
25982618
}
25992619
if (seed != NULL) {
26002620
/* use custom seed */
@@ -2754,11 +2774,12 @@ int wolfTPM2_ImportEccPrivateKeySeed(WOLFTPM2_DEV* dev, const WOLFTPM2_KEY* pare
27542774

27552775
/* Use Seed */
27562776
digestSz = (word32)TPM2_GetHashDigestSize(pub.publicArea.nameAlg);
2757-
if (digestSz == 0 || digestSz > sizeof(sens.sensitiveArea.seedValue.buffer)) {
2777+
if (digestSz == 0 ||
2778+
digestSz > sizeof(sens.sensitiveArea.seedValue.buffer)) {
27582779
#ifdef DEBUG_WOLFTPM
27592780
printf("Import ECC name alg size invalid! %d\n", digestSz);
27602781
#endif
2761-
return BAD_FUNC_ARG;
2782+
return BUFFER_E;
27622783
}
27632784
if (seed != NULL) {
27642785
/* use custom seed */
@@ -3310,7 +3331,7 @@ int wolfTPM2_ImportPrivateKeyBuffer(WOLFTPM2_DEV* dev,
33103331
printf("Import %s name alg size invalid! %d\n",
33113332
TPM2_GetAlgName((TPM_ALG_ID)keyType), digestSz);
33123333
#endif
3313-
return BAD_FUNC_ARG;
3334+
return BUFFER_E;
33143335
}
33153336
if (seed != NULL) {
33163337
/* use custom seed */
@@ -3876,7 +3897,7 @@ int wolfTPM2_SignHashScheme(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
38763897
signIn.digest.size = (UINT16)TPM2_GetHashDigestSize(hashAlg);
38773898
if (signIn.digest.size == 0 ||
38783899
signIn.digest.size > sizeof(signIn.digest.buffer)) {
3879-
return BAD_FUNC_ARG;
3900+
return BUFFER_E;
38803901
}
38813902
/* if digest provided is smaller than key size then zero pad leading */
38823903
if (digestSz < signIn.digest.size) {
@@ -4031,7 +4052,7 @@ int wolfTPM2_VerifyHashTicket(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
40314052
verifySigIn.digest.size = (UINT16)TPM2_GetHashDigestSize(hashAlg);
40324053
if (verifySigIn.digest.size == 0 ||
40334054
verifySigIn.digest.size > sizeof(verifySigIn.digest.buffer)) {
4034-
return BAD_FUNC_ARG;
4055+
return BUFFER_E;
40354056
}
40364057
/* if digest provided is smaller than key size then zero pad leading */
40374058
if (digestSz < verifySigIn.digest.size) {
@@ -5391,6 +5412,10 @@ static int wolfTPM2_ComputeSymmetricUnique(WOLFTPM2_DEV* dev, int hashAlg,
53915412
}
53925413
if (rc == 0) {
53935414
word32 uniqueSz = TPM2_GetHashDigestSize(hashAlg);
5415+
if (uniqueSz == 0 || uniqueSz > sizeof(unique->buffer)) {
5416+
rc = BUFFER_E;
5417+
}
5418+
if (rc == 0) {
53945419
rc = wolfTPM2_HashFinish(dev, &hash, unique->buffer, &uniqueSz);
53955420
unique->size = uniqueSz;
53965421
}
@@ -5451,6 +5476,10 @@ int wolfTPM2_LoadSymmetricKey(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key, int alg,
54515476

54525477
hashAlg = WOLFTPM2_WRAP_DIGEST;
54535478
hashAlgDigSz = TPM2_GetHashDigestSize(hashAlg);
5479+
if (hashAlgDigSz <= 0 ||
5480+
hashAlgDigSz > (int)sizeof(loadExtIn.inPrivate.sensitiveArea.seedValue.buffer)) {
5481+
return BUFFER_E;
5482+
}
54545483

54555484
/* Setup load command */
54565485
XMEMSET(&loadExtIn, 0, sizeof(loadExtIn));
@@ -7550,7 +7579,7 @@ int wolfTPM2_PolicyAuthValue(WOLFTPM2_DEV* dev, WOLFTPM2_SESSION* tpmSession,
75507579

75517580
if (auth != NULL && authSz >= 0) {
75527581
int authDigestSz = TPM2_GetHashDigestSize(tpmSession->authHash);
7553-
if (authDigestSz < 0 ||
7582+
if (authDigestSz <= 0 ||
75547583
(authSz + authDigestSz) > (int)sizeof(tpmSession->handle.auth.buffer)) {
75557584
return BUFFER_E;
75567585
}

0 commit comments

Comments
 (0)