From 022fe8409df6af956269714c1276317fa09c5aa3 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Thu, 10 Sep 2026 11:34:41 -0700 Subject: [PATCH] F-13531 - Guard the object name marshalling on a successful allocation --- src/fwtpm/fwtpm_command.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/src/fwtpm/fwtpm_command.c b/src/fwtpm/fwtpm_command.c index 9bc90a8d..410c50bf 100644 --- a/src/fwtpm/fwtpm_command.c +++ b/src/fwtpm/fwtpm_command.c @@ -6457,18 +6457,21 @@ static TPM_RC FwCmd_Create(FWTPM_CTX* ctx, TPM2_Packet* cmd, /* Compute object name from public area for creation ticket */ nameDigSz = TPM2_GetHashDigestSize(inPublic->publicArea.nameAlg); FWTPM_ALLOC_BUF(pubBuf2, FWTPM_MAX_PUB_BUF); - tmpPkt2.buf = pubBuf2; - tmpPkt2.pos = 0; - tmpPkt2.size = (int)FWTPM_MAX_PUB_BUF; - TPM2_Packet_AppendPublicArea(&tmpPkt2, &inPublic->publicArea); - FwStoreU16BE(objName, inPublic->publicArea.nameAlg); - if (nameDigSz > 0) { - int hashRc = wc_Hash(FwGetWcHashType(inPublic->publicArea.nameAlg), - pubBuf2, tmpPkt2.pos, objName + 2, nameDigSz); - if (hashRc == 0) - objNameSz = 2 + nameDigSz; + if (rc == 0) { + tmpPkt2.buf = pubBuf2; + tmpPkt2.pos = 0; + tmpPkt2.size = (int)FWTPM_MAX_PUB_BUF; + TPM2_Packet_AppendPublicArea(&tmpPkt2, &inPublic->publicArea); + FwStoreU16BE(objName, inPublic->publicArea.nameAlg); + if (nameDigSz > 0) { + int hashRc = wc_Hash( + FwGetWcHashType(inPublic->publicArea.nameAlg), + pubBuf2, tmpPkt2.pos, objName + 2, nameDigSz); + if (hashRc == 0) + objNameSz = 2 + nameDigSz; + } + FWTPM_FREE_BUF(pubBuf2); } - FWTPM_FREE_BUF(pubBuf2); /* Creation ticket hierarchy = parent's hierarchy per Part 2 * Sec.10.6.5 Table 112. */