WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Prevent potential buffer overrun in KDFa 

found by running `CFLAGS="-fsanitize=address" ./configure
--enable-swtpm` and and running `./scripts/swtpm_sim.test`
pull/147/head
Elms 2021-03-03 13:46:07 -08:00
parent b3f3eadac8
commit e0d4aba037
2 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/tpm2_param_enc.c
View File

@ -89,10 +89,11 @@ int TPM2_KDFa(
int ret, hashType; int ret, hashType;
Hmac hmac_ctx; Hmac hmac_ctx;
word32 counter = 0; word32 counter = 0;
int hLen, lLen = 0; int hLen, copyLen, lLen = 0;
byte uint32Buf[sizeof(UINT32)];; byte uint32Buf[sizeof(UINT32)];
UINT32 sizeInBits = keySz * 8, pos; UINT32 sizeInBits = keySz * 8, pos;
BYTE* keyStream = key; BYTE* keyStream = key;
byte hash[WC_MAX_DIGEST_SIZE];
if (key == NULL) if (key == NULL)
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
@ -102,7 +103,7 @@ int TPM2_KDFa(
return NOT_COMPILED_IN; return NOT_COMPILED_IN;
hLen = TPM2_GetHashDigestSize(hashAlg); hLen = TPM2_GetHashDigestSize(hashAlg);
if (hLen <= 0) if ( (hLen <= 0) || (hLen > WC_MAX_DIGEST_SIZE))
return NOT_COMPILED_IN; return NOT_COMPILED_IN;
/* get label length if provided, including null termination */ /* get label length if provided, including null termination */
@ -118,6 +119,7 @@ int TPM2_KDFa(
for (pos = 0; pos < keySz; pos += hLen) { for (pos = 0; pos < keySz; pos += hLen) {
/* KDFa counter starts at 1 */ /* KDFa counter starts at 1 */
counter++; counter++;
copyLen = hLen;
/* start HMAC */ /* start HMAC */
if (keyIn) { if (keyIn) {
@ -163,12 +165,18 @@ int TPM2_KDFa(
goto exit; goto exit;
/* get result */ /* get result */
ret = wc_HmacFinal(&hmac_ctx, keyStream); ret = wc_HmacFinal(&hmac_ctx, hash);
if (ret != 0) if (ret != 0)
goto exit; goto exit;
keyStream += hLen; if ((UINT32)hLen > keySz - pos) {
copyLen = keySz - pos;
} }
memcpy(keyStream, hash, copyLen);
keyStream += copyLen;
}
ret = pos;
ret = keySz; ret = keySz;
exit: exit:

4
tests/unit_tests.c
View File

@ -300,10 +300,10 @@ int unit_tests(int argc, char *argv[])
test_wolfTPM2_Init(); test_wolfTPM2_Init();
test_wolfTPM2_OpenExisting(); test_wolfTPM2_OpenExisting();
test_wolfTPM2_GetCapabilities(); test_wolfTPM2_GetCapabilities();
test_wolfTPM2_ReadPublicKey();
test_wolfTPM2_GetRandom(); test_wolfTPM2_GetRandom();
test_wolfTPM2_Cleanup();
test_TPM2_KDFa(); test_TPM2_KDFa();
test_wolfTPM2_ReadPublicKey();
test_wolfTPM2_Cleanup();
#endif /* !WOLFTPM2_NO_WRAPPER */ #endif /* !WOLFTPM2_NO_WRAPPER */
return 0; return 0;