F-2975 - https://fenrir.wolfssl.com/finding/2975 - Fix NULL pointer dereference in wolfTPM2_LoadRsaPrivateKey_ex and wolfTPM2_LoadEccPrivateKey

Author: aidangarske

src/tpm2_wrap.c

@@ -3499,8 +3499,15 @@ int wolfTPM2_LoadRsaPrivateKey_ex(WOLFTPM2_DEV* dev,
     rc = wolfTPM2_ImportRsaPrivateKey(dev, parentKey, &keyBlob, rsaPub, rsaPubSz,
         exponent, rsaPriv, rsaPrivSz, scheme, hashAlg);
     if (rc == 0) {
-        rc = wolfTPM2_LoadKey(dev, &keyBlob,
-            (WOLFTPM2_HANDLE*)&parentKey->handle);
+        WOLFTPM2_HANDLE parentHandle_lcl, *parentHandle = &parentHandle_lcl;
+        if (parentKey != NULL) {
+            parentHandle = (WOLFTPM2_HANDLE*)&parentKey->handle;
+        }
+        else {
+            XMEMSET(parentHandle, 0, sizeof(*parentHandle));
+            parentHandle->hndl = TPM_RH_OWNER;
+        }
+        rc = wolfTPM2_LoadKey(dev, &keyBlob, parentHandle);
     }
 
     /* return loaded key */
@@ -3673,8 +3680,15 @@ int wolfTPM2_LoadEccPrivateKey(WOLFTPM2_DEV* dev, const WOLFTPM2_KEY* parentKey,
     rc = wolfTPM2_ImportEccPrivateKey(dev, parentKey, &keyBlob, curveId,
         eccPubX, eccPubXSz, eccPubY, eccPubYSz, eccPriv, eccPrivSz);
     if (rc == 0) {
-        rc = wolfTPM2_LoadKey(dev, &keyBlob,
-            (WOLFTPM2_HANDLE*)&parentKey->handle);
+        WOLFTPM2_HANDLE parentHandle_lcl, *parentHandle = &parentHandle_lcl;
+        if (parentKey != NULL) {
+            parentHandle = (WOLFTPM2_HANDLE*)&parentKey->handle;
+        }
+        else {
+            XMEMSET(parentHandle, 0, sizeof(*parentHandle));
+            parentHandle->hndl = TPM_RH_OWNER;
+        }
+        rc = wolfTPM2_LoadKey(dev, &keyBlob, parentHandle);
     }
 
     /* return loaded key */

tests/unit_tests.c

@@ -1441,6 +1441,51 @@ static void test_wolfTPM2_KeyBlob(TPM_ALG_ID alg)
         TPM2_GetAlgName(alg), rc == 0 ? "Passed" : "Failed");
 }
 
+/* Test NULL parentKey handling in LoadRsaPrivateKey_ex and LoadEccPrivateKey */
+static void test_wolfTPM2_LoadPrivateKey_NullParent(void)
+{
+    int rc;
+    WOLFTPM2_DEV dev;
+    WOLFTPM2_KEY key;
+#ifndef NO_RSA
+    /* Dummy RSA key material for testing NULL parentKey handling */
+    byte rsaPub[1] = {0};
+    byte rsaPriv[1] = {0};
+#endif
+#ifdef HAVE_ECC
+    /* Dummy ECC key material for testing NULL parentKey handling */
+    byte eccPubX[32] = {0};
+    byte eccPubY[32] = {0};
+    byte eccPriv[32] = {0};
+#endif
+
+    rc = wolfTPM2_Init(&dev, TPM2_IoCb, NULL);
+    AssertIntEQ(rc, 0);
+
+    XMEMSET(&key, 0, sizeof(key));
+
+    /* Test NULL parentKey does not crash (should not dereference NULL) */
+#ifndef NO_RSA
+    rc = wolfTPM2_LoadRsaPrivateKey_ex(&dev, NULL, &key, rsaPub, sizeof(rsaPub),
+        RSA_DEFAULT_PUBLIC_EXPONENT, rsaPriv, sizeof(rsaPriv),
+        TPM_ALG_NULL, TPM_ALG_NULL);
+    /* rc may fail due to no real TPM, but must not crash */
+    AssertIntNE(rc, BAD_FUNC_ARG);
+#endif
+#ifdef HAVE_ECC
+    XMEMSET(&key, 0, sizeof(key));
+    rc = wolfTPM2_LoadEccPrivateKey(&dev, NULL, &key, TPM_ECC_NIST_P256,
+        eccPubX, sizeof(eccPubX), eccPubY, sizeof(eccPubY),
+        eccPriv, sizeof(eccPriv));
+    /* rc may fail due to no real TPM, but must not crash */
+    AssertIntNE(rc, BAD_FUNC_ARG);
+#endif
+
+    wolfTPM2_Cleanup(&dev);
+
+    printf("Test TPM Wrapper:\tLoadPrivateKey NullParent:\tPassed\n");
+}
+
 #endif /* !WOLFTPM2_NO_WRAPPER */
 
 #ifndef NO_MAIN_DRIVER
@@ -1476,6 +1521,7 @@ int unit_tests(int argc, char *argv[])
     test_wolfTPM2_PCRPolicy();
     #endif
     test_wolfTPM2_EncryptSecret();
+    test_wolfTPM2_LoadPrivateKey_NullParent();
     test_wolfTPM2_KeyBlob(TPM_ALG_RSA);
     test_wolfTPM2_KeyBlob(TPM_ALG_ECC);
     #if !defined(WOLFTPM2_NO_WOLFCRYPT) && defined(HAVE_ECC) && \