From c13dc57879edb43ad7112d2cbe02ae8dc3b91f06 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Mon, 11 May 2026 20:18:26 -0700 Subject: [PATCH] F-3927 - Clamp -password length in keyimport example --- examples/keygen/keyimport.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/examples/keygen/keyimport.c b/examples/keygen/keyimport.c index 97c99e4d..e1568d38 100644 --- a/examples/keygen/keyimport.c +++ b/examples/keygen/keyimport.c @@ -191,7 +191,14 @@ int TPM2_Keyimport_Example(void* userCtx, int argc, char *argv[]) /* setup an auth value */ if (password != NULL) { - impKey.handle.auth.size = (int)XSTRLEN(password); + size_t pwLen = XSTRLEN(password); + if (pwLen > sizeof(impKey.handle.auth.buffer)) { + printf("-password too long (max %zu)\n", + sizeof(impKey.handle.auth.buffer)); + rc = BUFFER_E; + goto exit; + } + impKey.handle.auth.size = (UINT16)pwLen; XMEMCPY(impKey.handle.auth.buffer, password, impKey.handle.auth.size); }