From c563d34fc14dfb4e57e1841725dfb778e623e681 Mon Sep 17 00:00:00 2001 From: Jacob Garber Date: Fri, 6 Sep 2019 13:29:33 -0600 Subject: [PATCH] security/tpm: Use correct hash digest lengths MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TPMU_HA is a union of all the different hash digests, and so sizeof(TPMU_HA) evaluates to 64 (the size of the largest one). This will lead to out-of-bounds writes when copying smaller digests, so use the specific digest size for each algorithm. Change-Id: Ic9101f157d5a19836b200ecd99f060de552498d2 Signed-off-by: Jacob Garber Found-by: Coverity CID 14049{49,50,51,52,53,54,55,56,57,58,60,61,62} Reviewed-on: https://review.coreboot.org/c/coreboot/+/35287 Tested-by: build bot (Jenkins) Reviewed-by: Julius Werner Reviewed-by: Kyösti Mälkki Reviewed-by: Philipp Deppenwiese --- src/security/tpm/tspi/tspi.c | 4 ++-- src/security/tpm/tss/tcg-2.0/tss.c | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c index 4cf371196e..e64e04fbbe 100644 --- a/src/security/tpm/tspi/tspi.c +++ b/src/security/tpm/tspi/tspi.c @@ -219,12 +219,12 @@ uint32_t tpm_extend_pcr(int pcr, enum vb2_hash_algorithm digest_algo, case VB2_HASH_SHA1: tpml_digests.digests[0].hashAlg = TPM_ALG_SHA1; memcpy(tpml_digests.digests[0].digest.sha1, - digest, sizeof(TPMU_HA)); + digest, SHA1_DIGEST_SIZE); break; case VB2_HASH_SHA256: tpml_digests.digests[0].hashAlg = TPM_ALG_SHA256; memcpy(tpml_digests.digests[0].digest.sha256, - digest, sizeof(TPMU_HA)); + digest, SHA256_DIGEST_SIZE); break; default: return TPM_E_IOERROR; diff --git a/src/security/tpm/tss/tcg-2.0/tss.c b/src/security/tpm/tss/tcg-2.0/tss.c index fab334f798..d9deba515d 100644 --- a/src/security/tpm/tss/tcg-2.0/tss.c +++ b/src/security/tpm/tss/tcg-2.0/tss.c @@ -148,27 +148,27 @@ uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest, case TPM_ALG_SHA1: memcpy(pcr_ext_cmd.digests.digests[i].digest.sha1, tpml_digests->digests[i].digest.sha1, - sizeof(TPMU_HA)); + SHA1_DIGEST_SIZE); break; case TPM_ALG_SHA256: memcpy(pcr_ext_cmd.digests.digests[i].digest.sha256, tpml_digests->digests[i].digest.sha256, - sizeof(TPMU_HA)); + SHA256_DIGEST_SIZE); break; case TPM_ALG_SHA384: memcpy(pcr_ext_cmd.digests.digests[i].digest.sha384, tpml_digests->digests[i].digest.sha384, - sizeof(TPMU_HA)); + SHA384_DIGEST_SIZE); break; case TPM_ALG_SHA512: memcpy(pcr_ext_cmd.digests.digests[i].digest.sha512, tpml_digests->digests[i].digest.sha512, - sizeof(TPMU_HA)); + SHA512_DIGEST_SIZE); break; case TPM_ALG_SM3_256: memcpy(pcr_ext_cmd.digests.digests[i].digest.sm3_256, tpml_digests->digests[i].digest.sm3_256, - sizeof(TPMU_HA)); + SM3_256_DIGEST_SIZE); break; } }