Skip to content

Commit 366e4d6

Browse files
dgarskedgarske
authored
Merge pull request #463 from aidangarske/fix-coverity-2-25
Fix coverity scan issues in wolfTPM
2 parents 25466a9 + 6768834 commit 366e4d6

6 files changed

Lines changed: 75 additions & 13 deletions

File tree

‎examples/attestation/activate_credential.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,20 @@ int TPM2_ActivateCredential_Example(void* userCtx, int argc, char *argv[])
192192
}
193193
printf("Read credential blob and secret from %s, %d bytes\n",
194194
input, dataSize);
195+
/* Validate sizes from file data to prevent buffer overrun */
196+
if (activCredIn.credentialBlob.size >
197+
sizeof(activCredIn.credentialBlob.buffer)) {
198+
printf("Credential blob size %d exceeds buffer\n",
199+
activCredIn.credentialBlob.size);
200+
rc = BAD_FUNC_ARG;
201+
goto exit;
202+
}
203+
if (activCredIn.secret.size > sizeof(activCredIn.secret.secret)) {
204+
printf("Secret size %d exceeds buffer\n",
205+
activCredIn.secret.size);
206+
rc = BAD_FUNC_ARG;
207+
goto exit;
208+
}
195209
#else
196210
printf("Can not load credential. File support not enabled\n");
197211
goto exit;

‎examples/attestation/make_credential.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,11 @@ int TPM2_MakeCredential_Example(void* userCtx, int argc, char *argv[])
156156
wolfTPM2_GetRandom(&dev, makeCredIn.credential.buffer,
157157
makeCredIn.credential.size);
158158
/* Set the object name */
159+
if (name.size > sizeof(makeCredIn.objectName.name)) {
160+
printf("Name size %d exceeds buffer\n", name.size);
161+
rc = BAD_FUNC_ARG;
162+
goto exit;
163+
}
159164
makeCredIn.objectName.size = name.size;
160165
XMEMCPY(makeCredIn.objectName.name, name.name,
161166
makeCredIn.objectName.size);

‎examples/pcr/extend.c‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[])
7474
BYTE dataBuffer[1024];
7575
enum wc_HashType hashType;
7676
wc_HashAlg dig;
77+
int hashInitialized = 0;
7778
#endif
7879

7980
union {
@@ -153,15 +154,24 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[])
153154
if (fp != XBADFILE) {
154155
rc = TPM2_GetHashType(alg);
155156
hashType = (enum wc_HashType)rc;
156-
wc_HashInit(&dig, hashType);
157-
while (!XFEOF(fp)) {
157+
rc = wc_HashInit(&dig, hashType);
158+
if (rc == 0)
159+
hashInitialized = 1;
160+
while (rc == 0 && !XFEOF(fp)) {
158161
len = XFREAD(dataBuffer, 1, sizeof(dataBuffer), fp);
159162
if (len > 0) {
160-
wc_HashUpdate(&dig, hashType, dataBuffer, (int)len);
163+
rc = wc_HashUpdate(&dig, hashType, dataBuffer, (int)len);
161164
}
162165
}
163166
XFCLOSE(fp);
164-
wc_HashFinal(&dig, hashType, hash);
167+
if (rc == 0)
168+
rc = wc_HashFinal(&dig, hashType, hash);
169+
if (hashInitialized)
170+
wc_HashFree(&dig, hashType);
171+
if (rc != 0) {
172+
printf("Hash operation failed %d\n", rc);
173+
goto exit;
174+
}
165175

166176
XMEMCPY(cmdIn.pcrExtend.digests.digests[0].digest.H,
167177
hash, hashSz);

‎src/tpm2_linux.c‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -144,17 +144,16 @@ int TPM2_LINUX_SendCommand(TPM2_CTX* ctx, TPM2_Packet* packet)
144144
rspSz = (int)ret;
145145
rc = TPM_RC_SUCCESS;
146146
}
147-
else if (ret == 0) {
148-
#ifdef DEBUG_WOLFTPM
149-
printf("Received EOF(0) from %s: errno %d = %s\n",
150-
TPM2_LINUX_DEV, errno, strerror(errno));
151-
#endif
152-
rc = TPM_RC_FAILURE;
153-
}
154147
else {
155148
#ifdef DEBUG_WOLFTPM
156-
printf("Failed to read from %s: errno %d = %s\n",
157-
TPM2_LINUX_DEV, errno, strerror(errno));
149+
if (ret == 0) {
150+
printf("Received EOF from %s\n", TPM2_LINUX_DEV);
151+
}
152+
else {
153+
printf("Failed to read from %s (ret %zd):"
154+
" errno %d = %s\n", TPM2_LINUX_DEV, ret,
155+
errno, strerror(errno));
156+
}
158157
#endif
159158
rc = TPM_RC_FAILURE;
160159
}

‎src/tpm2_param_enc.c‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,14 @@ static int TPM2_ParamEnc_XOR(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
209209
return BUFFER_E;
210210
}
211211

212+
/* Validate source key sizes to prevent overrun of source buffers */
213+
if (sessKey->size > sizeof(sessKey->buffer)) {
214+
return BUFFER_E;
215+
}
216+
if (bindKey != NULL && bindKey->size > sizeof(bindKey->buffer)) {
217+
return BUFFER_E;
218+
}
219+
212220
/* Validate key sizes before copy to prevent buffer overflow */
213221
if (sessKey->size + bindKeySz > sizeof(keyIn.buffer)) {
214222
return BUFFER_E;
@@ -264,6 +272,14 @@ static int TPM2_ParamDec_XOR(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
264272
return BUFFER_E;
265273
}
266274

275+
/* Validate source key sizes to prevent overrun of source buffers */
276+
if (sessKey->size > sizeof(sessKey->buffer)) {
277+
return BUFFER_E;
278+
}
279+
if (bindKey != NULL && bindKey->size > sizeof(bindKey->buffer)) {
280+
return BUFFER_E;
281+
}
282+
267283
/* Validate key sizes before copy to prevent buffer overflow */
268284
if (sessKey->size + bindKeySz > sizeof(keyIn.buffer)) {
269285
return BUFFER_E;
@@ -321,6 +337,14 @@ static int TPM2_ParamEnc_AESCFB(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
321337
return BUFFER_E;
322338
}
323339

340+
/* Validate source key sizes to prevent overrun of source buffers */
341+
if (sessKey->size > sizeof(sessKey->buffer)) {
342+
return BUFFER_E;
343+
}
344+
if (bindKey != NULL && bindKey->size > sizeof(bindKey->buffer)) {
345+
return BUFFER_E;
346+
}
347+
324348
/* Validate key sizes before copy to prevent buffer overflow */
325349
if (sessKey->size + bindKeySz > sizeof(keyIn.buffer)) {
326350
return BUFFER_E;
@@ -387,6 +411,14 @@ static int TPM2_ParamDec_AESCFB(TPM2_AUTH_SESSION *session, TPM2B_AUTH* sessKey,
387411
return BUFFER_E;
388412
}
389413

414+
/* Validate source key sizes to prevent overrun of source buffers */
415+
if (sessKey->size > sizeof(sessKey->buffer)) {
416+
return BUFFER_E;
417+
}
418+
if (bindKey != NULL && bindKey->size > sizeof(bindKey->buffer)) {
419+
return BUFFER_E;
420+
}
421+
390422
/* Validate key sizes before copy to prevent buffer overflow */
391423
if (sessKey->size + bindKeySz > sizeof(keyIn.buffer)) {
392424
return BUFFER_E;

‎src/tpm2_wrap.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,9 @@ static int wolfTPM2_Init_ex(TPM2_CTX* ctx, TPM2HalIoCb ioCb, void* userCtx,
123123
rc = TPM2_Init_ex(ctx, ioCb, userCtx, timeoutTries);
124124
#endif
125125
if (rc != TPM_RC_SUCCESS) {
126+
#ifdef DEBUG_WOLFTPM
126127
printf("TPM2_Init failed 0x%x: %s\n", rc, wolfTPM2_GetRCString(rc));
128+
#endif
127129
return rc;
128130
}
129131
#ifdef DEBUG_WOLFTPM

0 commit comments

Comments
 (0)