Skip to content

Commit 48d1644

Browse files
dgarskedgarske
committed
Fenrir fixes: F-2513, F-2514, F-2529, F-2534, F-2522, F-2515, F-2516, F-2520, F-2521
1 parent 68ef2f6 commit 48d1644

8 files changed

Lines changed: 385 additions & 24 deletions

File tree

‎src/tpm2.c‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1069,17 +1069,35 @@ TPM_RC TPM2_GetCapability(GetCapability_In* in, GetCapability_Out* out)
10691069
{
10701070
TPML_TAGGED_PCR_PROPERTY* pcrProp =
10711071
&out->capabilityData.data.pcrProperties;
1072-
TPM2_Packet_ParseU32(&packet, &pcrProp->count);
1072+
UINT32 wireCount;
1073+
UINT32 tag;
1074+
UINT8 wireSizeofSelect;
1075+
TPM2_Packet_ParseU32(&packet, &wireCount);
1076+
pcrProp->count = wireCount;
10731077
if (pcrProp->count > MAX_PCR_PROPERTIES)
10741078
pcrProp->count = MAX_PCR_PROPERTIES;
1075-
for (i=0; i<(int)pcrProp->count; i++) {
1076-
TPMS_TAGGED_PCR_SELECT* sel = &pcrProp->pcrProperty[i];
1077-
TPM2_Packet_ParseU32(&packet, &sel->tag);
1078-
TPM2_Packet_ParseU8(&packet, &sel->sizeofSelect);
1079-
if (sel->sizeofSelect > PCR_SELECT_MAX)
1080-
sel->sizeofSelect = PCR_SELECT_MAX;
1081-
TPM2_Packet_ParseBytes(&packet, sel->pcrSelect,
1082-
sel->sizeofSelect);
1079+
for (i=0; i<(int)wireCount; i++) {
1080+
TPM2_Packet_ParseU32(&packet, &tag);
1081+
TPM2_Packet_ParseU8(&packet, &wireSizeofSelect);
1082+
if (i < (int)pcrProp->count) {
1083+
TPMS_TAGGED_PCR_SELECT* sel =
1084+
&pcrProp->pcrProperty[i];
1085+
sel->tag = tag;
1086+
sel->sizeofSelect = wireSizeofSelect;
1087+
if (sel->sizeofSelect > PCR_SELECT_MAX)
1088+
sel->sizeofSelect = PCR_SELECT_MAX;
1089+
TPM2_Packet_ParseBytes(&packet, sel->pcrSelect,
1090+
sel->sizeofSelect);
1091+
if (wireSizeofSelect > sel->sizeofSelect) {
1092+
TPM2_Packet_ParseBytes(&packet, NULL,
1093+
wireSizeofSelect - sel->sizeofSelect);
1094+
}
1095+
}
1096+
else {
1097+
/* Skip entries beyond array capacity */
1098+
TPM2_Packet_ParseBytes(&packet, NULL,
1099+
wireSizeofSelect);
1100+
}
10831101
}
10841102
break;
10851103
}

‎src/tpm2_packet.c‎

Lines changed: 26 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -445,17 +445,34 @@ void TPM2_Packet_AppendPCR(TPM2_Packet* packet, TPML_PCR_SELECTION* pcr)
445445
void TPM2_Packet_ParsePCR(TPM2_Packet* packet, TPML_PCR_SELECTION* pcr)
446446
{
447447
int i;
448-
TPM2_Packet_ParseU32(packet, &pcr->count);
448+
UINT32 wireCount;
449+
UINT16 hash;
450+
UINT8 wireSizeofSelect;
451+
TPM2_Packet_ParseU32(packet, &wireCount);
452+
pcr->count = wireCount;
449453
if (pcr->count > HASH_COUNT)
450454
pcr->count = HASH_COUNT;
451-
for (i=0; i<(int)pcr->count; i++) {
452-
TPM2_Packet_ParseU16(packet, &pcr->pcrSelections[i].hash);
453-
TPM2_Packet_ParseU8(packet, &pcr->pcrSelections[i].sizeofSelect);
454-
if (pcr->pcrSelections[i].sizeofSelect > PCR_SELECT_MIN)
455-
pcr->pcrSelections[i].sizeofSelect = PCR_SELECT_MIN;
456-
TPM2_Packet_ParseBytes(packet,
457-
pcr->pcrSelections[i].pcrSelect,
458-
pcr->pcrSelections[i].sizeofSelect);
455+
for (i = 0; i < (int)wireCount; i++) {
456+
TPM2_Packet_ParseU16(packet, &hash);
457+
TPM2_Packet_ParseU8(packet, &wireSizeofSelect);
458+
if (i < (int)pcr->count) {
459+
pcr->pcrSelections[i].hash = hash;
460+
pcr->pcrSelections[i].sizeofSelect = wireSizeofSelect;
461+
if (pcr->pcrSelections[i].sizeofSelect > PCR_SELECT_MIN)
462+
pcr->pcrSelections[i].sizeofSelect = PCR_SELECT_MIN;
463+
TPM2_Packet_ParseBytes(packet,
464+
pcr->pcrSelections[i].pcrSelect,
465+
pcr->pcrSelections[i].sizeofSelect);
466+
/* Skip excess select bytes */
467+
if (wireSizeofSelect > pcr->pcrSelections[i].sizeofSelect) {
468+
TPM2_Packet_ParseBytes(packet, NULL,
469+
wireSizeofSelect - pcr->pcrSelections[i].sizeofSelect);
470+
}
471+
}
472+
else {
473+
/* Skip entire entry for overflow iterations */
474+
TPM2_Packet_ParseBytes(packet, NULL, wireSizeofSelect);
475+
}
459476
}
460477
}
461478

‎src/tpm2_param_enc.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ int TPM2_KDFa(
196196

197197

198198
/* Perform XOR encryption over the first parameter of a TPM packet */
199-
static int TPM2_ParamEnc_XOR(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
199+
int TPM2_ParamEnc_XOR(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
200200
TPM2B_AUTH* bindKey, TPM2B_NONCE* nonceCaller, TPM2B_NONCE* nonceTPM,
201201
BYTE *paramData, UINT32 paramSz)
202202
{
@@ -259,7 +259,7 @@ static int TPM2_ParamEnc_XOR(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
259259
}
260260

261261
/* Perform XOR decryption over the first parameter of a TPM packet */
262-
static int TPM2_ParamDec_XOR(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
262+
int TPM2_ParamDec_XOR(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
263263
TPM2B_AUTH* bindKey, TPM2B_NONCE* nonceCaller, TPM2B_NONCE* nonceTPM,
264264
BYTE *paramData, UINT32 paramSz)
265265
{
@@ -322,7 +322,7 @@ static int TPM2_ParamDec_XOR(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
322322

323323
#if !defined(WOLFTPM2_NO_WOLFCRYPT) && defined(WOLFSSL_AES_CFB)
324324
/* Perform AES CFB encryption over the first parameter of a TPM packet */
325-
static int TPM2_ParamEnc_AESCFB(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
325+
int TPM2_ParamEnc_AESCFB(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
326326
TPM2B_AUTH* bindKey, TPM2B_NONCE* nonceCaller, TPM2B_NONCE* nonceTPM,
327327
BYTE *paramData, UINT32 paramSz)
328328
{
@@ -396,7 +396,7 @@ static int TPM2_ParamEnc_AESCFB(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
396396
}
397397

398398
/* Perform AES CFB decryption over the first parameter of a TPM packet */
399-
static int TPM2_ParamDec_AESCFB(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
399+
int TPM2_ParamDec_AESCFB(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
400400
TPM2B_AUTH* bindKey, TPM2B_NONCE* nonceCaller, TPM2B_NONCE* nonceTPM,
401401
BYTE *paramData, UINT32 paramSz)
402402
{

‎src/tpm2_wrap.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6805,6 +6805,7 @@ int wolfTPM2_LoadKeyedHashKey(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
68056805
#ifdef DEBUG_WOLFTPM
68066806
printf("TPM2_Create key failed %d: %s\n", rc, wolfTPM2_GetRCString(rc));
68076807
#endif
6808+
TPM2_ForceZero(&createIn.inSensitive, sizeof(createIn.inSensitive));
68086809
return rc;
68096810
}
68106811

@@ -6827,6 +6828,8 @@ int wolfTPM2_LoadKeyedHashKey(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
68276828
#ifdef DEBUG_WOLFTPM
68286829
printf("TPM2_Load key failed %d: %s\n", rc, wolfTPM2_GetRCString(rc));
68296830
#endif
6831+
TPM2_ForceZero(&createIn.inSensitive,
6832+
sizeof(createIn.inSensitive));
68306833
return rc;
68316834
}
68326835
key->handle.hndl = loadOut.objectHandle;
@@ -7894,6 +7897,7 @@ int wolfTPM2_CreateKeySeal_ex(WOLFTPM2_DEV* dev, WOLFTPM2_KEYBLOB* keyBlob,
78947897
printf("wolfTPM2_CreateKeySeal failed %d: %s\n",
78957898
rc, wolfTPM2_GetRCString(rc));
78967899
#endif
7900+
TPM2_ForceZero(&createIn.inSensitive, sizeof(createIn.inSensitive));
78977901
return rc;
78987902
}
78997903

0 commit comments

Comments
 (0)