WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-11934 - Advance the SPDM receive sequence only after authentication

pull/604/head
Aidan Garske 2026-09-10 11:22:28 -07:00
parent 60fd8ae1d2
commit ef6e19e25b
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/spdm/spdm_secured.c
View File

@ -278,10 +278,6 @@ int wolfSPDM_DecryptInternal(WOLFSPDM_CTX* ctx,
wolfSPDM_BuildIV(iv, ctx->rspDataIv, (word64)rspSeqNum);
}
/* response consumed and seq validated; advance to stay in lockstep with
* the peer even if AEAD/parse below fails */
ctx->rspSeqNum++;
/* ----- AES-GCM decrypt (shared for both transports) ----- */
ret = WOLFSPDM_E_CRYPTO_FAIL;
@ -340,6 +336,9 @@ int wolfSPDM_DecryptInternal(WOLFSPDM_CTX* ctx,
}
if (ret == WOLFSPDM_SUCCESS) {
/* Advance the receive counter only after authentication and payload
* validation succeed, so a forged record cannot desync the sequence */
ctx->rspSeqNum++;
wolfSPDM_DebugPrint(ctx, "Decrypted %u bytes -> %u bytes\n",
encSz, *plainSz);
}