mirror of https://github.com/wolfSSL/wolfBoot.git
63b58c5491
security_command_passphrase used strlen(passphrase) on a 32-byte binary buffer from TPM unsealing that carries no null-terminator guarantee, causing an OOB stack read whenever none of the 32 key bytes is zero. Replace strlen with strnlen(passphrase, ATA_SECURITY_PASSWORD_LEN) using a new constant (32, matching the ATA-8 ACS password field size) defined in ata.h. Also add a size check in sata_unlock_disk after sata_get_unlock_secret so a short or malformed unseal result is rejected before reaching the ATA command path. |
||
|---|---|---|
| .. | ||
| MPLAB | ||
| wolfboot | ||
| x86 | ||
| delta.h | ||
| disk.h | ||
| elf.h | ||
| encrypt.h | ||
| fdt.h | ||
| gpt.h | ||
| gzip.h | ||
| hal.h | ||
| hal_fpga.h | ||
| hooks.h | ||
| image.h | ||
| keystore.h | ||
| loader.h | ||
| multiboot.h | ||
| otp_keystore.h | ||
| pci.h | ||
| printf.h | ||
| sdhci.h | ||
| spi_drv.h | ||
| spi_flash.h | ||
| stage2_params.h | ||
| target.h.in | ||
| tpm.h | ||
| uart_drv.h | ||
| uart_flash.h | ||
| user_settings.h | ||