mirror of https://github.com/wolfSSL/wolfBoot.git
63b58c5491
security_command_passphrase used strlen(passphrase) on a 32-byte binary buffer from TPM unsealing that carries no null-terminator guarantee, causing an OOB stack read whenever none of the 32 key bytes is zero. Replace strlen with strnlen(passphrase, ATA_SECURITY_PASSWORD_LEN) using a new constant (32, matching the ATA-8 ACS password field size) defined in ata.h. Also add a size check in sata_unlock_disk after sata_get_unlock_secret so a short or malformed unseal result is rejected before reaching the ATA command path. |
||
|---|---|---|
| .. | ||
| fsp | ||
| ahci.h | ||
| ata.h | ||
| common.h | ||
| exceptions.h | ||
| fsp.h | ||
| gdt.h | ||
| hob.h | ||
| linux_loader.h | ||
| mptable.h | ||
| paging.h | ||
| tgl_fsp.h | ||